Edit tour

Windows Analysis Report
5IRIk4f1PO.exe

Overview

General Information

Sample name:	5IRIk4f1PO.exe renamed because original name is a hash value
Original sample name:	9f3205479a5ff3acd9eafdb8eaa629e9.exe
Analysis ID:	1464556
MD5:	9f3205479a5ff3acd9eafdb8eaa629e9
SHA1:	0db77b61300e8e3ea19c8de71a078bb853e5166d
SHA256:	5c483ed90d904d0d81967c91ac431a2c27228fd9562dd2f2e3f003644c59076e
Tags:	32exe
Infos:

Detection

CryptOne, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Yara detected CryptOne packer

Yara detected Powershell download and execute

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Sample uses process hollowing technique

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

5IRIk4f1PO.exe (PID: 6328 cmdline: "C:\Users\user\Desktop\5IRIk4f1PO.exe" MD5: 9F3205479A5FF3ACD9EAFDB8EAA629E9)

kat6899.tmp (PID: 6332 cmdline: C:\Users\user\AppData\Local\Temp\kat6899.tmp MD5: 66064DBDB70A5EB15EBF3BF65ABA254B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199707802586", "https://t.me/g067n"], "Botnet": "f5b5622f4f4fc7235c0e9e6367cafc13"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1652012877.0000000002ADB000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Crypt	Yara detected CryptOne packer	Joe Security
00000000.00000002.1651789610.0000000002420000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1652197583.00000000040A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: 5IRIk4f1PO.exe PID: 6328	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 5IRIk4f1PO.exe PID: 6328	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 5IRIk4f1PO.exe PID: 6328	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: kat6899.tmp PID: 6332	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: kat6899.tmp PID: 6332	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.5IRIk4f1PO.exe.2aa7719.2.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.5IRIk4f1PO.exe.40a0000.5.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.5IRIk4f1PO.exe.40a0000.5.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.5IRIk4f1PO.exe.2420000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.5IRIk4f1PO.exe.2420000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Click to see the 1 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199707802586	Avira URL Cloud: Label: malware
Source: https://t.me/g067n	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199707802586", "https://t.me/g067n"], "Botnet": "f5b5622f4f4fc7235c0e9e6367cafc13"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 5IRIk4f1PO.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetProcAddress
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: LoadLibraryA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: lstrcatA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: OpenEventA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: CreateEventA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: CloseHandle
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Sleep
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: VirtualFree
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetSystemInfo
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: VirtualAlloc
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: HeapAlloc
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetComputerNameA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: lstrcpyA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetProcessHeap
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetCurrentProcess
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: lstrlenA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: ExitProcess
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetSystemTime
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: advapi32.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: gdi32.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: user32.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: crypt32.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: ntdll.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetUserNameA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: CreateDCA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetDeviceCaps
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: ReleaseDC
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: sscanf
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: NtQueryInformationProcess
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: VMwareVMware
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: HAL9TH
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: JohnDoe
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: DISPLAY
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetFileAttributesA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GlobalLock
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: HeapFree
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetFileSize
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GlobalSize
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: IsWow64Process
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Process32Next
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetLocalTime
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: FreeLibrary
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Process32First
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: DeleteFileA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: FindNextFileA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: LocalFree
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: FindClose
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: LocalAlloc
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetFileSizeEx
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: ReadFile
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: SetFilePointer
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: WriteFile
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: CreateFileA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: FindFirstFileA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: CopyFileA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: VirtualProtect
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetLastError
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: lstrcpynA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GlobalFree
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GlobalAlloc
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: OpenProcess
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: TerminateProcess
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: gdiplus.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: ole32.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: bcrypt.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: wininet.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: shlwapi.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: shell32.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: psapi.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: SelectObject
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: BitBlt
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: DeleteObject
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GdiplusStartup
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GdiplusShutdown
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GdipDisposeImage
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GdipFree
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: CoUninitialize
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: CoInitialize
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: CoCreateInstance
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: BCryptDecrypt
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: BCryptSetProperty
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetWindowRect
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetDesktopWindow
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetDC
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: CloseWindow
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: wsprintfA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: CharToOemW
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: wsprintfW
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: RegQueryValueExA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: RegCloseKey
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: RegEnumValueA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: CryptUnprotectData
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: ShellExecuteExA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: InternetConnectA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: InternetCloseHandle
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: InternetOpenA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: HttpSendRequestA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: InternetReadFile
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: StrCmpCA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: StrStrA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: StrCmpCW
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: PathMatchSpecA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: RmStartSession
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: RmRegisterResources
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: RmGetList
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: RmEndSession
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: sqlite3_open
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: sqlite3_step
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: sqlite3_column_text
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: sqlite3_finalize
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: sqlite3_close
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: encrypted_key
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: PATH
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: NSS_Init
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: NSS_Shutdown
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: PK11_Authenticate
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: C:\ProgramData\
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Soft:
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: profile:
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Host:
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Login:
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Password:
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Opera
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: OperaGX
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Network
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Cookies
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: .txt
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: TRUE
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: FALSE
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Autofill
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: History
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Name:
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Month:
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Year:
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Card:
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Cookies
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Login Data
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Web Data
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: History
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: logins.json
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: formSubmitURL
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: usernameField
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: encryptedUsername
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: encryptedPassword
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: guid
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: cookies.sqlite
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: formhistory.sqlite
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: places.sqlite
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Plugins
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Local Extension Settings
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Sync Extension Settings
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: IndexedDB
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Opera Stable
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Opera GX Stable
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: CURRENT
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: chrome-extension_
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Local State
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: profiles.ini
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: chrome
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: opera
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: firefox
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Wallets
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: ProductName
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: ProcessorNameString
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: DisplayName
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: DisplayVersion
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: freebl3.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: mozglue.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: msvcp140.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: nss3.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: softokn3.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: vcruntime140.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: \Temp\
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: .exe
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: runas
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: open
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: /c start
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: %DESKTOP%
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: %APPDATA%
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: %USERPROFILE%
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: %RECENT%
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: *.lnk
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Files
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: \discord\
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: key_datas
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: map*
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Telegram
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: *.tox
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: *.ini
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Password
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: 00000001
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: 00000002
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: 00000003
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: 00000004
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Pidgin
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: \.purple\
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: accounts.xml
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: token:
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: SteamPath
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: \config\
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: ssfn*
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: config.vdf
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: loginusers.vdf
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: \Steam\
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: sqlite3.dll
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: browsers
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: done
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Soft
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: https
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: POST
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: HTTP/1.1
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: hwid
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: build
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: token
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: file_name
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: file
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: message
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack	String decryptor: screenshot.jpg

Source: 5IRIk4f1PO.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown

HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49731 version: TLS 1.2

Source:

Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: kat6899.tmp, 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr

Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199707802586
Source: Malware configuration extractor	URLs: https://t.me/g067n

Source: global traffic

TCP traffic: 192.168.2.4:49732 -> 195.201.251.214:9000

Source: global traffic

HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Source: Joe Sandbox View

ASN Name: TELEGRAMRU TELEGRAMRU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214

Source: global traffic

HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: t.me

Source: kat6899.tmp, 00000001.00000003.1719247024.00000000009E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: kat6899.tmp, 00000001.00000003.1854190744.000000000095A000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2913965823.000000000095A000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: kat6899.tmp, 00000001.00000002.2913965823.0000000000900000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enf
Source: 5IRIk4f1PO.exe, 00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000000.1651157970.00000000004B4000.00000002.00000001.01000000.00000004.sdmp, kat6899.tmp.0.dr	String found in binary or memory: http://rpi.net.au/~ajohnson/resourcehacker
Source: 5IRIk4f1PO.exe	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types
Source: 5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/on-c
Source: 5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Types
Source: 5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Types0
Source: 5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Types2u.dll
Source: 5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/TypesP
Source: 5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/TypesStv4
Source: 5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesc0da53
Source: 5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesmmon-c
Source: 5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesxt_4
Source: kat6899.tmp, 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: kat6899.tmp, 00000001.00000002.2913965823.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214/
Source: kat6899.tmp, 00000001.00000003.1694784942.0000000000917000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000539000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000
Source: kat6899.tmp, 00000001.00000002.2913965823.00000000008E2000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.2309830595.0000000000994000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1853991046.0000000000A26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/0aosoft
Source: kat6899.tmp, 00000001.00000003.1854190744.000000000099C000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1857143929.00000000009C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/C
Source: kat6899.tmp, 00000001.00000002.2913965823.0000000000933000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/Mac
Source: kat6899.tmp, 00000001.00000003.1857143929.00000000009BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/d
Source: kat6899.tmp, 00000001.00000002.2913965823.0000000000950000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1876370682.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2914483011.00000000009E5000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.2309830595.00000000009E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dll
Source: kat6899.tmp, 00000001.00000003.1876370682.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllD
Source: kat6899.tmp, 00000001.00000002.2913965823.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllet
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllge
Source: kat6899.tmp, 00000001.00000003.1876370682.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dlll
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/icrosoft
Source: kat6899.tmp, 00000001.00000003.2309830595.00000000009BD000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2914483011.00000000009C1000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2913965823.000000000095A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/k
Source: kat6899.tmp, 00000001.00000003.2309830595.00000000009BD000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2914483011.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/l
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2914483011.00000000009E5000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.2309830595.00000000009E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dll
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dllge
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2914483011.00000000009E5000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.2309830595.00000000009E4000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2913965823.00000000008E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/msvcp140.dll
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/msvcp140.dlle
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2913965823.000000000095A000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2914483011.00000000009E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/nss3.dll
Source: kat6899.tmp, 00000001.00000003.2309830595.00000000009BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/nss3.dllm
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2914483011.00000000009E5000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.2309830595.00000000009E4000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2913965823.00000000008E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/softokn3.dll
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/softokn3.dlle
Source: kat6899.tmp, 00000001.00000003.1857143929.0000000000988000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1854190744.000000000097E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/sqlt.dll
Source: kat6899.tmp, 00000001.00000002.2913965823.000000000091F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/sqlt.dllL
Source: kat6899.tmp, 00000001.00000002.2913965823.000000000091F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/sqlt.dllV
Source: kat6899.tmp, 00000001.00000002.2914483011.00000000009C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dll
Source: kat6899.tmp, 00000001.00000003.2309830595.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2914483011.00000000009C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dll/
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000539000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dller
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000539000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dllrv:129.0)
Source: kat6899.tmp, 00000001.00000003.1868797978.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1865603122.0000000000A26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/xg
Source: kat6899.tmp, 00000001.00000002.2912988617.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000539000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:900010ale
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000Microsoft
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000g
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000ontent-Disposition:
Source: DBKFHJ.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: DBKFHJ.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: DBKFHJ.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: DBKFHJ.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: DBKFHJ.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: DBKFHJ.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: DBKFHJ.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 5IRIk4f1PO.exe, 00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, 5IRIk4f1PO.exe, 00000000.00000002.1652197583.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, 5IRIk4f1PO.exe, 00000000.00000002.1651789610.0000000002420000.00000040.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000425000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586
Source: 5IRIk4f1PO.exe, 00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, 5IRIk4f1PO.exe, 00000000.00000002.1652197583.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, 5IRIk4f1PO.exe, 00000000.00000002.1651789610.0000000002420000.00000040.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000425000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll
Source: kat6899.tmp, 00000001.00000003.1846693648.0000000000A22000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1836222806.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2917825020.000000001FF1D000.00000004.00000020.00020000.00000000.sdmp, GCFHDA.1.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: GCFHDA.1.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: kat6899.tmp, 00000001.00000003.1846693648.0000000000A22000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1836222806.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2917825020.000000001FF1D000.00000004.00000020.00020000.00000000.sdmp, GCFHDA.1.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: GCFHDA.1.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: kat6899.tmp, 00000001.00000002.2913965823.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: 5IRIk4f1PO.exe, 00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, 5IRIk4f1PO.exe, 00000000.00000002.1652197583.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, 5IRIk4f1PO.exe, 00000000.00000002.1651789610.0000000002420000.00000040.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2913965823.000000000091F000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2913965823.0000000000900000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1694784942.0000000000933000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1694784942.0000000000917000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000425000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g067n
Source: kat6899.tmp, 00000001.00000002.2913965823.0000000000900000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g067nr
Source: 5IRIk4f1PO.exe, 00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, 5IRIk4f1PO.exe, 00000000.00000002.1652197583.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, 5IRIk4f1PO.exe, 00000000.00000002.1651789610.0000000002420000.00000040.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000425000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g067nry1neMozilla/5.0
Source: kat6899.tmp, 00000001.00000003.1694784942.0000000000933000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: DBKFHJ.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: DBKFHJ.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: Yara match	File source: 00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5IRIk4f1PO.exe PID: 6328, type: MEMORYSTR

Source: C:\Users\user\Desktop\5IRIk4f1PO.exe	Code function: 0_2_02ADB510 NtProtectVirtualMemory,NtProtectVirtualMemory,	0_2_02ADB510
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe	Code function: 0_2_02ADBEF0 NtAllocateVirtualMemory,GetTempFileNameA,CreateFileA,WriteFile,CreateProcessA,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64GetThreadContext,Wow64SetThreadContext,ResumeThread,ExitProcess,	0_2_02ADBEF0
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe	Code function: 0_2_02ADB250 NtCreateFile,CreateFileMappingA,MapViewOfFile,FindCloseChangeNotification,	0_2_02ADB250

Source: C:\Users\user\Desktop\5IRIk4f1PO.exe	Code function: 0_2_02ADC510	0_2_02ADC510
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20104CF0	1_2_20104CF0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_2017A0B0	1_2_2017A0B0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_200F209F	1_2_200F209F
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_200F47AF	1_2_200F47AF
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_2011A560	1_2_2011A560
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_201EA590	1_2_201EA590
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_201066C0	1_2_201066C0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_2022E800	1_2_2022E800
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_200F3E3B	1_2_200F3E3B
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_200F481D	1_2_200F481D
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_2020A900	1_2_2020A900
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_201EA940	1_2_201EA940
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_201D69C0	1_2_201D69C0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_200FAA40	1_2_200FAA40
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_200FEA80	1_2_200FEA80
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_200F19DD	1_2_200F19DD
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_202CAEBE	1_2_202CAEBE
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20136E80	1_2_20136E80
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20152EE0	1_2_20152EE0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_200FF160	1_2_200FF160
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_200F174E	1_2_200F174E
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20123370	1_2_20123370
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_200F251D	1_2_200F251D
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_2011BAB0	1_2_2011BAB0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_200F290A	1_2_200F290A
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20218030	1_2_20218030
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20170090	1_2_20170090
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20178120	1_2_20178120
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_200F3AB2	1_2_200F3AB2
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20230480	1_2_20230480
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20118680	1_2_20118680
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20118763	1_2_20118763
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20154760	1_2_20154760
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20188760	1_2_20188760
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_200F1EF1	1_2_200F1EF1
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_201F4A60	1_2_201F4A60
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20118D2A	1_2_20118D2A
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20109000	1_2_20109000
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20215040	1_2_20215040
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_202CD209	1_2_202CD209
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_201853B0	1_2_201853B0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_200F3580	1_2_200F3580
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20259430	1_2_20259430
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20199690	1_2_20199690
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_201AD6D0	1_2_201AD6D0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_200F1C9E	1_2_200F1C9E
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_201A5940	1_2_201A5940
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20219A20	1_2_20219A20
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_200F2018	1_2_200F2018
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_200F292D	1_2_200F292D
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20259CC0	1_2_20259CC0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_200F12A8	1_2_200F12A8
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_200F2AA9	1_2_200F2AA9

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\kat6899.tmp 6A94DBDA2DD1EDCFF2331061D65E1BAF09D4861CC7BA590C5EC754F3AC96A795

Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: String function: 200F395E appears 78 times
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: String function: 200F3AF3 appears 37 times
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: String function: 200F1F5A appears 31 times
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: String function: 202D06B1 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: String function: 200F415B appears 133 times
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: String function: 200F1C2B appears 47 times

Source: 5IRIk4f1PO.exe, 00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameResHack! vs 5IRIk4f1PO.exe

Source: 5IRIk4f1PO.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/11@1/2

Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\DGTGRKDF.htm

Jump to behavior

Source: C:\Users\user\Desktop\5IRIk4f1PO.exe

File created: C:\Users\user\AppData\Local\Temp\kat6899.tmp

Jump to behavior

Source: C:\Users\user\Desktop\5IRIk4f1PO.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: C:\Users\user\Desktop\5IRIk4f1PO.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: kat6899.tmp, 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: kat6899.tmp, 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: kat6899.tmp, kat6899.tmp, 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: kat6899.tmp, 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: kat6899.tmp, kat6899.tmp, 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: kat6899.tmp, 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: kat6899.tmp, 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: kat6899.tmp, 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: kat6899.tmp, 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: kat6899.tmp, 00000001.00000003.1854190744.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1857049917.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp, DAKJDA.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: kat6899.tmp, kat6899.tmp, 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: kat6899.tmp, 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: unknown	Process created: C:\Users\user\Desktop\5IRIk4f1PO.exe "C:\Users\user\Desktop\5IRIk4f1PO.exe"
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe	Process created: C:\Users\user\AppData\Local\Temp\kat6899.tmp C:\Users\user\AppData\Local\Temp\kat6899.tmp
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe	Process created: C:\Users\user\AppData\Local\Temp\kat6899.tmp C:\Users\user\AppData\Local\Temp\kat6899.tmp	Jump to behavior

Source: C:\Users\user\Desktop\5IRIk4f1PO.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: 5IRIk4f1PO.exe

Static file information: File size 2288128 > 1048576

Source: 5IRIk4f1PO.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x127800

Source:

Source: sqlt[1].dll.1.dr

Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\5IRIk4f1PO.exe	Code function: 0_2_02ADCA10 push edx; ret	0_2_02ADCC1F
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe	Code function: 0_2_02ADC310 push edx; ret	0_2_02ADC31B
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_200F10C8 push ecx; ret	1_2_202F3552
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_200F1BF9 push ecx; ret	1_2_20294C03

Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll			Jump to dropped file
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe	File created: C:\Users\user\AppData\Local\Temp\kat6899.tmp			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: icon.png

Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp

API coverage: 0.8 %

Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: kat6899.tmp, 00000001.00000002.2913965823.000000000090C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: kat6899.tmp, 00000001.00000002.2913965823.000000000089E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: kat6899.tmp, 00000001.00000002.2913965823.000000000089E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH

Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp

Code function: 1_2_200F2C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_200F2C8E

Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp

Code function: 1_2_200F46A6 GetProcessHeap,

1_2_200F46A6

Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_200F2C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		1_2_200F2C8E
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_200F42AF SetUnhandledExceptionFilter,		1_2_200F42AF

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 5IRIk4f1PO.exe PID: 6328, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\5IRIk4f1PO.exe

Memory allocated: C:\Users\user\AppData\Local\Temp\kat6899.tmp base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\5IRIk4f1PO.exe

Code function: 0_2_02ADBEF0 NtAllocateVirtualMemory,GetTempFileNameA,CreateFileA,WriteFile,CreateProcessA,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64GetThreadContext,Wow64SetThreadContext,ResumeThread,ExitProcess,

0_2_02ADBEF0

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\5IRIk4f1PO.exe

Memory written: C:\Users\user\AppData\Local\Temp\kat6899.tmp base: 400000 value starts with: 4D5A

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\5IRIk4f1PO.exe

Section unmapped: C:\Users\user\AppData\Local\Temp\kat6899.tmp base address: 400000

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\5IRIk4f1PO.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat6899.tmp base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat6899.tmp base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat6899.tmp base: 425000	Jump to behavior
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat6899.tmp base: 42E000	Jump to behavior
Source: C:\Users\user\Desktop\5IRIk4f1PO.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat6899.tmp base: 643000	Jump to behavior

Source: C:\Users\user\Desktop\5IRIk4f1PO.exe

Process created: C:\Users\user\AppData\Local\Temp\kat6899.tmp C:\Users\user\AppData\Local\Temp\kat6899.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: EnumSystemLocalesW,	1_2_202E2CB6
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: EnumSystemLocalesW,	1_2_202E2D38
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: EnumSystemLocalesW,	1_2_202E2DF9
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_202E3300
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	1_2_200F3AA3
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: EnumSystemLocalesW,	1_2_202CFF17
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: GetLocaleInfoW,	1_2_200F2112
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: GetLocaleInfoW,	1_2_200F2112

Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp

Code function: 1_2_20294323 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_20294323

Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp

Code function: 1_2_202D4A46 GetTimeZoneInformation,

1_2_202D4A46

Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: kat6899.tmp, 00000001.00000002.2914483011.0000000000988000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1857143929.0000000000988000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1876370682.0000000000987000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.2309830595.0000000000987000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1854190744.000000000097E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected CryptOne packer

Source: Yara match

File source: 00000000.00000002.1652012877.0000000002ADB000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.5IRIk4f1PO.exe.2aa7719.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5IRIk4f1PO.exe.40a0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5IRIk4f1PO.exe.40a0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5IRIk4f1PO.exe.2420000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5IRIk4f1PO.exe.2420000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1651789610.0000000002420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1652197583.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5IRIk4f1PO.exe PID: 6328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kat6899.tmp PID: 6332, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Source: Yara match

File source: Process Memory Space: kat6899.tmp PID: 6332, type: MEMORYSTR

Remote Access Functionality

Yara detected CryptOne packer

Source: Yara match

File source: 00000000.00000002.1652012877.0000000002ADB000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.5IRIk4f1PO.exe.2aa7719.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5IRIk4f1PO.exe.2aa7719.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5IRIk4f1PO.exe.40a0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5IRIk4f1PO.exe.40a0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5IRIk4f1PO.exe.2420000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5IRIk4f1PO.exe.2420000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1651789610.0000000002420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1652197583.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5IRIk4f1PO.exe PID: 6328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kat6899.tmp PID: 6332, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_2015E090 sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	1_2_2015E090
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_2016E170 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_2016E170
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_2015E200 sqlite3_initialize,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	1_2_2015E200
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_201066C0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_bind_value,sqlite3_free,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	1_2_201066C0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_2016A6F0 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,	1_2_2016A6F0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_2014EF30 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,	1_2_2014EF30
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_2011B400 sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,sqlite3_reset,sqlite3_step,sqlite3_reset,sqlite3_column_int64,	1_2_2011B400
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_201B3770 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_201B3770
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_201D37E0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_201D37E0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20168200 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,	1_2_20168200
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20148550 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,	1_2_20148550
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20118680 sqlite3_mprintf,sqlite3_mprintf,sqlite3_initialize,sqlite3_finalize,sqlite3_free,sqlite3_mprintf,sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_int64,	1_2_20118680
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_201406E0 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	1_2_201406E0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20104820 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_initialize,	1_2_20104820
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_201D4D40 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,InitOnceBeginInitialize,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	1_2_201D4D40
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20120FB0 sqlite3_result_int64,sqlite3_result_double,sqlite3_result_int,sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	1_2_20120FB0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20189090 sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_errmsg,sqlite3_mprintf,	1_2_20189090
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_201951D0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_201951D0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_201AD3B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_201AD3B0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_2021D4F0 sqlite3_bind_value,sqlite3_log,sqlite3_log,sqlite3_log,	1_2_2021D4F0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_202114D0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	1_2_202114D0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_201955B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_201955B0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_201CD610 sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_201CD610
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20195910 sqlite3_mprintf,sqlite3_bind_int64,	1_2_20195910
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_2021D9E0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	1_2_2021D9E0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_2016DB10 sqlite3_initialize,sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	1_2_2016DB10
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20105C70 sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	1_2_20105C70
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_2016DFC0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_mprintf,sqlite3_bind_text,sqlite3_step,sqlite3_reset,	1_2_2016DFC0
Source: C:\Users\user\AppData\Local\Temp\kat6899.tmp	Code function: 1_2_20171FE0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_20171FE0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	511 Process Injection	11 Masquerading	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Shared Modules	Boot or Logon Initialization Scripts	1 DLL Side-Loading	511 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	1 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	41 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
5IRIk4f1PO.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\kat6899.tmp	4%	ReversingLabs

Source	Detection	Scanner	Label
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/mozglue.dll	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/nss3.dll	0%	Avira URL Cloud	safe
https://web.telegram.org	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://t.me/	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/TypesP	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/freebl3.dllD	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/l	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/mozglue.dllge	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/soap/encoding/on-c	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/Mac	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/icrosoft	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/k	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Types	0%	Avira URL Cloud	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	0%	Avira URL Cloud	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	Avira URL Cloud	safe
https://195.201.251.214:900010ale	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/0aosoft	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/freebl3.dll	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/sqlt.dllL	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/sqlt.dllV	0%	Avira URL Cloud	safe
https://t.me/g067nr	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/softokn3.dll	0%	Avira URL Cloud	safe
https://t.me/g067nry1neMozilla/5.0	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/nss3.dllm	0%	Avira URL Cloud	safe
http://www.sqlite.org/copyright.html.	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/freebl3.dllet	0%	Avira URL Cloud	safe
https://195.201.251.214:9000g	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/msvcp140.dll	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/vcruntime140.dll/	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/vcruntime140.dllrv:129.0)	0%	Avira URL Cloud	safe
http://rpi.net.au/~ajohnson/resourcehacker	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/vcruntime140.dll	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/vcruntime140.dller	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/msvcp140.dlle	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/freebl3.dlll	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/softokn3.dlle	0%	Avira URL Cloud	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199707802586	100%	Avira URL Cloud	malware
https://195.201.251.214:9000/d	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/xg	0%	Avira URL Cloud	safe
https://t.me/g067n	100%	Avira URL Cloud	malware
https://195.201.251.214:9000/freebl3.dllge	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Types2u.dll	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Types0	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Typesmmon-c	0%	Avira URL Cloud	safe
https://195.201.251.214/	0%	Avira URL Cloud	safe
https://195.201.251.214:9000	0%	Avira URL Cloud	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Typesc0da53	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/sqlt.dll	0%	Avira URL Cloud	safe
https://195.201.251.214:9000ontent-Disposition:	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/TypesStv4	0%	Avira URL Cloud	safe
https://195.201.251.214:9000Microsoft	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Typesxt_4	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
t.me	149.154.167.99	true	true		unknown
windowsupdatebg.s.llnwi.net	178.79.238.0	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/profiles/76561199707802586	true	Avira URL Cloud: malware	unknown
https://t.me/g067n	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	DBKFHJ.1.dr	false	Avira URL Cloud: safe	unknown
https://t.me/	kat6899.tmp, 00000001.00000002.2913965823.000000000089E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	DBKFHJ.1.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types	5IRIk4f1PO.exe	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/mozglue.dll	kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2914483011.00000000009E5000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.2309830595.00000000009E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/nss3.dll	kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2913965823.000000000095A000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2914483011.00000000009E2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://web.telegram.org	kat6899.tmp, 00000001.00000003.1694784942.0000000000933000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll	5IRIk4f1PO.exe, 00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, 5IRIk4f1PO.exe, 00000000.00000002.1652197583.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, 5IRIk4f1PO.exe, 00000000.00000002.1651789610.0000000002420000.00000040.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000425000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/	kat6899.tmp, 00000001.00000002.2913965823.00000000008E2000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.2309830595.0000000000994000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1853991046.0000000000A26000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.borland.com/namespaces/TypesP	5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/freebl3.dllD	kat6899.tmp, 00000001.00000003.1876370682.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/l	kat6899.tmp, 00000001.00000003.2309830595.00000000009BD000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2914483011.00000000009C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/mozglue.dllge	kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	DBKFHJ.1.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/on-c	5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/k	kat6899.tmp, 00000001.00000003.2309830595.00000000009BD000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2914483011.00000000009C1000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2913965823.000000000095A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/Mac	kat6899.tmp, 00000001.00000002.2913965823.0000000000933000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	kat6899.tmp, 00000001.00000003.1846693648.0000000000A22000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1836222806.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2917825020.000000001FF1D000.00000004.00000020.00020000.00000000.sdmp, GCFHDA.1.dr	false	URL Reputation: safe	unknown
https://195.201.251.214:9000/icrosoft	kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.borland.com/namespaces/Types	5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	GCFHDA.1.dr	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/sqlt.dllV	kat6899.tmp, 00000001.00000002.2913965823.000000000091F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	DBKFHJ.1.dr	false	URL Reputation: safe	unknown
https://195.201.251.214:900010ale	kat6899.tmp, 00000001.00000002.2912988617.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000539000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/0aosoft	kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/freebl3.dll	kat6899.tmp, 00000001.00000002.2913965823.0000000000950000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1876370682.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2914483011.00000000009E5000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.2309830595.00000000009E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/sqlt.dllL	kat6899.tmp, 00000001.00000002.2913965823.000000000091F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/g067nr	kat6899.tmp, 00000001.00000002.2913965823.0000000000900000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/softokn3.dll	kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2914483011.00000000009E5000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.2309830595.00000000009E4000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2913965823.00000000008E2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/g067nry1neMozilla/5.0	5IRIk4f1PO.exe, 00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, 5IRIk4f1PO.exe, 00000000.00000002.1652197583.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, 5IRIk4f1PO.exe, 00000000.00000002.1651789610.0000000002420000.00000040.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000425000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	kat6899.tmp, 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2919196486.000000002BC24000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/freebl3.dllet	kat6899.tmp, 00000001.00000002.2913965823.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/nss3.dllm	kat6899.tmp, 00000001.00000003.2309830595.00000000009BD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000g	kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	DBKFHJ.1.dr	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/msvcp140.dll	kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2914483011.00000000009E5000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.2309830595.00000000009E4000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2913965823.00000000008E2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/vcruntime140.dll/	kat6899.tmp, 00000001.00000003.2309830595.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2914483011.00000000009C9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/C	kat6899.tmp, 00000001.00000003.1854190744.000000000099C000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1857143929.00000000009C6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	DBKFHJ.1.dr	false	Avira URL Cloud: safe	unknown
http://rpi.net.au/~ajohnson/resourcehacker	5IRIk4f1PO.exe, 00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000000.1651157970.00000000004B4000.00000002.00000001.01000000.00000004.sdmp, kat6899.tmp.0.dr	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	kat6899.tmp, 00000001.00000003.1846693648.0000000000A22000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1836222806.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2917825020.000000001FF1D000.00000004.00000020.00020000.00000000.sdmp, GCFHDA.1.dr	false	URL Reputation: safe	unknown
https://195.201.251.214:9000/vcruntime140.dllrv:129.0)	kat6899.tmp, 00000001.00000002.2912988617.0000000000539000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/freebl3.dlll	kat6899.tmp, 00000001.00000003.1876370682.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe	kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	DBKFHJ.1.dr	false	URL Reputation: safe	unknown
https://195.201.251.214:9000/vcruntime140.dller	kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000539000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/vcruntime140.dll	kat6899.tmp, 00000001.00000002.2914483011.00000000009C9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	DBKFHJ.1.dr	false	URL Reputation: safe	unknown
https://195.201.251.214:9000/msvcp140.dlle	kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/softokn3.dlle	kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/xg	kat6899.tmp, 00000001.00000003.1868797978.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1865603122.0000000000A26000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/d	kat6899.tmp, 00000001.00000003.1857143929.00000000009BD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/freebl3.dllge	kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.borland.com/namespaces/Types0	5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.borland.com/namespaces/Types2u.dll	5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214/	kat6899.tmp, 00000001.00000002.2913965823.000000000089E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.borland.com/namespaces/Typesmmon-c	5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000	kat6899.tmp, 00000001.00000003.1694784942.0000000000917000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000002.2912988617.0000000000539000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	GCFHDA.1.dr	false	Avira URL Cloud: safe	unknown
http://www.borland.com/namespaces/Typesc0da53	5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.borland.com/namespaces/Typesxt_4	5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.borland.com/namespaces/TypesStv4	5IRIk4f1PO.exe, 00000000.00000002.1651550618.000000000077E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	DBKFHJ.1.dr	false	URL Reputation: safe	unknown
https://195.201.251.214:9000/sqlt.dll	kat6899.tmp, 00000001.00000003.1857143929.0000000000988000.00000004.00000020.00020000.00000000.sdmp, kat6899.tmp, 00000001.00000003.1854190744.000000000097E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000ontent-Disposition:	kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000Microsoft	kat6899.tmp, 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
195.201.251.214	unknown	Germany		24940	HETZNER-ASDE	false
149.154.167.99	t.me	United Kingdom		62041	TELEGRAMRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1464556
Start date and time:	2024-06-29 01:43:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5IRIk4f1PO.exe renamed because original name is a hash value
Original Sample Name:	9f3205479a5ff3acd9eafdb8eaa629e9.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/11@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 85% Number of executed functions: 7 Number of non-executed functions: 201
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 178.79.238.0
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 5IRIk4f1PO.exe

Simulations

Behavior and APIs

Time	Type	Description
19:44:08	API Interceptor	1x Sleep call for process: kat6899.tmp modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
195.201.251.214	1719520929.094843_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse
195.201.251.214	1Cvd8TyYPm.exe	Get hash	malicious	LummaC, Mars Stealer, PureLog Stealer, Stealc, Vidar, Xmrig, zgRAT	Browse
149.154.167.99	http://telegramtw1.org/	Get hash	malicious	Unknown	Browse	telegram.org/?setln=pl
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegram.dog	Get hash	malicious	Unknown	Browse	telegram.dog/
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot
	jtfCFDmLdX.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot
	vSlVoTPrmP.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot
	RO67OsrIWi.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot
	KeyboardRGB.exe	Get hash	malicious	Unknown	Browse	t.me/cinoshibot
	file.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	1719520929.094843_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse	149.154.167.99
	1Cvd8TyYPm.exe	Get hash	malicious	LummaC, Mars Stealer, PureLog Stealer, Stealc, Vidar, Xmrig, zgRAT	Browse	149.154.167.99
	project.exe	Get hash	malicious	RedLine	Browse	149.154.167.99
	WR0fuHnEVW.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	BRWgvKaqbg.exe	Get hash	malicious	PureLog Stealer, RisePro Stealer, Vidar, zgRAT	Browse	149.154.167.99
	Resolucion Juridica Bloqueo Cuentas y servicios SRI.vbs.xz	Get hash	malicious	Unknown	Browse	104.21.51.236
	vidar2406.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	RW3MLiFPzL.exe	Get hash	malicious	PureLog Stealer, Vidar, zgRAT	Browse	149.154.167.99
	nEtQ9BP9hL.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
windowsupdatebg.s.llnwi.net	https://t4ha7.shop/	Get hash	malicious	Unknown	Browse	87.248.205.0
	http://pub-5d5794a1344e4ef09c0d498cb30f8875.r2.dev/index.html	Get hash	malicious	Unknown	Browse	87.248.205.0
	http://pub-5e86a1f01e5a4476812e4d108add0587.r2.dev/index.html	Get hash	malicious	Unknown	Browse	41.63.96.0
	https://pub-4d0a115db8fb4f15a6bf3059fadf5ec9.r2.dev/secure_response.html?user-agent=Mozilla/5.0WindowsNT10.0;Win64;x64AppleWebKit/537.36KHTML,likeGeckoChrome/86.0.4240.75Safari/537.36	Get hash	malicious	HTMLPhisher	Browse	178.79.208.1
	http://sites.google.com/l0gin-microsoftwebonlne.app/867487/	Get hash	malicious	Unknown	Browse	41.63.96.128
	https://aradcofeenet1.aradcofeenet1.workers.dev/	Get hash	malicious	Unknown	Browse	87.248.205.0
	http://pub-5e86a1f01e5a4476812e4d108add0587.r2.dev/index.html	Get hash	malicious	Unknown	Browse	87.248.202.1
	http://pub-49f7bdad3ae7458f8076aa4480203a8b.r2.dev/index.html	Get hash	malicious	Unknown	Browse	87.248.202.1
	https://strangetype.shop/	Get hash	malicious	Unknown	Browse	87.248.205.0
	http://sites.google.com/l0gin-microsoftwebonlne.app/867487/	Get hash	malicious	Unknown	Browse	87.248.204.0

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	https://telegrambot-resolved.pages.dev/	Get hash	malicious	Unknown	Browse	149.154.167.99
	1719520929.094843_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse	149.154.167.99
	Kyeryong Construction - Products List & Spec.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	zrrHgsDzgS.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, StormKitty, WorldWind Stealer, zgRAT	Browse	149.154.167.220
	1Cvd8TyYPm.exe	Get hash	malicious	LummaC, Mars Stealer, PureLog Stealer, Stealc, Vidar, Xmrig, zgRAT	Browse	149.154.167.99
	H1XdsfkcgU.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	w5APKwp5DD.exe	Get hash	malicious	AsyncRAT, HTMLPhisher, MicroClip, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	https://telegrambot-resolved.pages.dev/	Get hash	malicious	Unknown	Browse	149.154.167.99
	project.exe	Get hash	malicious	RedLine	Browse	149.154.167.99
	WR0fuHnEVW.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
HETZNER-ASDE	https://he110ca11he1lpn0wwb112.pages.dev/	Get hash	malicious	TechSupportScam	Browse	195.201.57.90
	Find-DscResource_QoS.ps1	Get hash	malicious	Unknown	Browse	5.161.214.209
	https://serviceca11he1pn0waa12.pages.dev/	Get hash	malicious	TechSupportScam	Browse	195.201.57.90
	Find-DscResource_QoS.ps1	Get hash	malicious	Unknown	Browse	5.161.214.209
	1719520929.094843_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse	195.201.251.214
	http://hostedonsporestack.com	Get hash	malicious	Unknown	Browse	95.216.25.250
	https://email.abad-ca.com/	Get hash	malicious	Unknown	Browse	135.181.16.82
	QUjE2KgAq6.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	cEEsFMSdw8.elf	Get hash	malicious	Mirai	Browse	213.239.211.194
	iOf1YICai3.elf	Get hash	malicious	Mirai	Browse	159.69.202.135

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	1719520929.094843_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse	149.154.167.99
	3443424611#U00b7pdf.exe	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.99
	UTN RFP_24-0676#U00b7pdf.exe	Get hash	malicious	GuLoader, Lokibot	Browse	149.154.167.99
	RFQ_22Q7305A-N23A-01#U00b7pdf.exe	Get hash	malicious	Remcos	Browse	149.154.167.99
	UPS_Bill_of_lading_291098829T_28_06_2024_000000_pdf.vbs	Get hash	malicious	GuLoader, Remcos	Browse	149.154.167.99
	PLANT PROJECT PROPOSAL BID_24-0676#U00b7pdf.exe	Get hash	malicious	GuLoader, Lokibot	Browse	149.154.167.99
	1Cvd8TyYPm.exe	Get hash	malicious	LummaC, Mars Stealer, PureLog Stealer, Stealc, Vidar, Xmrig, zgRAT	Browse	149.154.167.99
	w5APKwp5DD.exe	Get hash	malicious	AsyncRAT, HTMLPhisher, MicroClip, StormKitty, WorldWind Stealer	Browse	149.154.167.99
	sterverexe.exe	Get hash	malicious	FatalRAT, GhostRat, Nitol	Browse	149.154.167.99
	doc20240627-00073.bat.exe	Get hash	malicious	GuLoader	Browse	149.154.167.99

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\kat6899.tmp	unKdkI2OE7.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
	igGqB0yylQ.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
	I71ylA9bM6.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
	RPI1VJ83ui.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
	l3gMFGppEi.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
	eyduk1OwKt.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
	8Scta2jVt5.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
	38XY6jzm6P.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
	tUB0RZsuki.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
	zny5cLXehf.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll	1719520929.094843_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse
	1Cvd8TyYPm.exe	Get hash	malicious	LummaC, Mars Stealer, PureLog Stealer, Stealc, Vidar, Xmrig, zgRAT	Browse
	WR0fuHnEVW.exe	Get hash	malicious	Vidar	Browse
	BRWgvKaqbg.exe	Get hash	malicious	PureLog Stealer, RisePro Stealer, Vidar, zgRAT	Browse
	vidar2406.exe	Get hash	malicious	Vidar	Browse
	RW3MLiFPzL.exe	Get hash	malicious	PureLog Stealer, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	Setup.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	setup.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse

Created / dropped Files

C:\ProgramData\HIIEGHJJDGHC\AAAKEB

Download File

Process:	C:\Users\user\AppData\Local\Temp\kat6899.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIIEGHJJDGHC\CFIECB

Download File

Process:	C:\Users\user\AppData\Local\Temp\kat6899.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	modified
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIIEGHJJDGHC\DAKJDA

Download File

Process:	C:\Users\user\AppData\Local\Temp\kat6899.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIIEGHJJDGHC\DBKFHJ

Download File

Process:	C:\Users\user\AppData\Local\Temp\kat6899.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIIEGHJJDGHC\EBGCBA

Download File

Process:	C:\Users\user\AppData\Local\Temp\kat6899.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIIEGHJJDGHC\EBKJDB

Download File

Process:	C:\Users\user\AppData\Local\Temp\kat6899.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIIEGHJJDGHC\GCFHDA

Download File

Process:	C:\Users\user\AppData\Local\Temp\kat6899.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Local\Temp\kat6899.tmp
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Local\Temp\kat6899.tmp
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	2.965078371815708
Encrypted:	false
SSDEEP:	6:kKjBMD9Usw9L+N+SkQlPlEGYRMY9z+4KlDA3RUe/:rBdD9LNkPlE99SNxAhUe/
MD5:	65DF5179B04E0ED865E5A8F1A40F711C
SHA1:	BD92994C9D9513C19EC81DBA4D4320C2B781F001
SHA-256:	5CBD915CE5D03594E4BDBDB33CEE8EB21060A6E7A87222A34ADFA7E6DE15219F
SHA-512:	443AD7851FB96FED210104A829B701B347E471ADFF2E0C2077CFC9705412820E5B839EFBD829FE8C8A5F2892544E0CD31414C1778A2DE4DA66A2E9ACD21DF2EE
Malicious:	false
Preview:	p...... .........e......(....................................................... ........G..@.......................h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\kat6899.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 1719520929.094843_setup.exe, Detection: malicious, Browse Filename: 1Cvd8TyYPm.exe, Detection: malicious, Browse Filename: WR0fuHnEVW.exe, Detection: malicious, Browse Filename: BRWgvKaqbg.exe, Detection: malicious, Browse Filename: vidar2406.exe, Detection: malicious, Browse Filename: RW3MLiFPzL.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kat6899.tmp

Download File

Process:	C:\Users\user\Desktop\5IRIk4f1PO.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	881664
Entropy (8bit):	6.555251818096116
Encrypted:	false
SSDEEP:	24576:o0ESdQpglO1CxDyawn27h+9hrlgKQY9SGcZwCdTp:o0RIglO1CuL9VNcaCd9
MD5:	66064DBDB70A5EB15EBF3BF65ABA254B
SHA1:	0284FD320F99F62ACA800FB1251EFF4C31EC4ED7
SHA-256:	6A94DBDA2DD1EDCFF2331061D65E1BAF09D4861CC7BA590C5EC754F3AC96A795
SHA-512:	B05C6C09AE7372C381FBA591C3CB13A69A2451B9D38DA1A95AAC89413D7438083475D06796ACB5440CD6EC65B030C9FA6CBDAA0D2FE91A926BAE6499C360F17F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: unKdkI2OE7.exe, Detection: malicious, Browse Filename: igGqB0yylQ.exe, Detection: malicious, Browse Filename: I71ylA9bM6.exe, Detection: malicious, Browse Filename: RPI1VJ83ui.exe, Detection: malicious, Browse Filename: l3gMFGppEi.exe, Detection: malicious, Browse Filename: eyduk1OwKt.exe, Detection: malicious, Browse Filename: 8Scta2jVt5.exe, Detection: malicious, Browse Filename: 38XY6jzm6P.exe, Detection: malicious, Browse Filename: tUB0RZsuki.exe, Detection: malicious, Browse Filename: zny5cLXehf.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*............................0.............@..............................................@..............................2'...........................@..p............................0......................................................CODE....d........................... ..`DATA................................@...BSS......................................idata..2'.......(..................@....tls......... ...........................rdata.......0......................@..P.reloc..p....@......................@..P.rsrc...............................@..P.....................t..............@..P........................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.128917116056813
TrID:	Win32 Executable (generic) a (10002005/4) 93.58% Win32 Executable Borland Delphi 7 (665061/41) 6.22% Win32 Executable Delphi generic (14689/80) 0.14% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	5IRIk4f1PO.exe
File size:	2'288'128 bytes
MD5:	9f3205479a5ff3acd9eafdb8eaa629e9
SHA1:	0db77b61300e8e3ea19c8de71a078bb853e5166d
SHA256:	5c483ed90d904d0d81967c91ac431a2c27228fd9562dd2f2e3f003644c59076e
SHA512:	adfd9e32fa17d358b5093bfdd9c257b20c8015303ced7b94e2acd00b407fd0e79d5bfa30d38272ebdc8564730f4316d0831833236a20d4daee815c288a04b065
SSDEEP:	49152:qpjNvr9ySAOmw4FHHO+SASagXkJr4MDkUwm:qpjNp7p4FHH8n5A
TLSH:	77B5AE22F392C537C4723A789D1AB26994357D111D3874467BE85F4CDF3AA823F2E292
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	c1692e1f373f1307

Static PE Info

General

Entrypoint:	0x4f0b24
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1b5ec46ea5b288abd35faaa6c5e29620

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 004F0674h
call 00007F37E4A01EA5h
mov eax, dword ptr [004F358Ch]
mov eax, dword ptr [eax]
call 00007F37E4A580F9h
mov ecx, dword ptr [004F3714h]
mov eax, dword ptr [004F358Ch]
mov eax, dword ptr [eax]
mov edx, dword ptr [004F00B8h]
call 00007F37E4A580F9h
mov eax, dword ptr [004F358Ch]
mov eax, dword ptr [eax]
call 00007F37E4A5816Dh
call 00007F37E49FF838h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xf5000	0x2226	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x10d000	0x127800	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xfa000	0x122e0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xf9000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0xefb6c	0xefc00	b6cbccf4120abae452c4f4bb0c0241a1	False	0.4459682937956204	data	6.569769101849669	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0xf1000	0x27b0	0x2800	075c39913dba2b50d48b34e05836ce6d	False	0.3671875	data	4.187577550487257	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xf4000	0xdd9	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xf5000	0x2226	0x2400	900ba339ba647a2a80150451120be588	False	0.3502604166666667	data	4.767633120388674	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xf8000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xf9000	0x18	0x200	bb1897305839cee8a2c35260b95c6576	False	0.05078125	data	0.2005819074398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0xfa000	0x122e0	0x12400	00541f5ce5b3ab6485498fee99281fc2	False	0.550339790239726	data	6.68159046363066	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x10d000	0x127800	0x127800	e5eb1ae36e98672c5e2d22ea6ce130d8	False	0.7496992650169205	data	7.298883026621249	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x10dc94	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"			0.38636363636363635
RT_CURSOR	0x10ddc8	0x134	data			0.4642857142857143
RT_CURSOR	0x10defc	0x134	data			0.4805194805194805
RT_CURSOR	0x10e030	0x134	data			0.38311688311688313
RT_CURSOR	0x10e164	0x134	data			0.36038961038961037
RT_CURSOR	0x10e298	0x134	data			0.4090909090909091
RT_CURSOR	0x10e3cc	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"			0.4967532467532468
RT_BITMAP	0x10e500	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0x10e6d0	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380			0.46487603305785125
RT_BITMAP	0x10e8b4	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0x10ea84	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39870689655172414
RT_BITMAP	0x10ec54	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.4245689655172414
RT_BITMAP	0x10ee24	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5021551724137931
RT_BITMAP	0x10eff4	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5064655172413793
RT_BITMAP	0x10f1c4	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0x10f394	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5344827586206896
RT_BITMAP	0x10f564	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0x10f734	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.4870689655172414
RT_ICON	0x10f81c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.5013440860215054
RT_ICON	0x10fb04	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.311841949603691
RT_DIALOG	0x12032c	0x52	data			0.7682926829268293
RT_STRING	0x120380	0xc0	data			0.5260416666666666
RT_STRING	0x120440	0x634	data			0.30289672544080604
RT_STRING	0x120a74	0x358	data			0.3703271028037383
RT_STRING	0x120dcc	0x494	data			0.3796928327645051
RT_STRING	0x121260	0x3e0	data			0.32661290322580644
RT_STRING	0x121640	0x3cc	data			0.411522633744856
RT_STRING	0x121a0c	0x344	data			0.46411483253588515
RT_STRING	0x121d50	0x1d0	data			0.38146551724137934
RT_STRING	0x121f20	0x16c	data			0.532967032967033
RT_STRING	0x12208c	0x1fc	Targa image data - Color 99 x 107 x 32 +68 +111 "z"			0.4744094488188976
RT_STRING	0x122288	0x1f0	data			0.530241935483871
RT_STRING	0x122478	0xec	data			0.597457627118644
RT_STRING	0x122564	0x10c	data			0.5522388059701493
RT_STRING	0x122670	0x470	data			0.3908450704225352
RT_STRING	0x122ae0	0x388	data			0.38827433628318586
RT_STRING	0x122e68	0x358	data			0.34345794392523366
RT_STRING	0x1231c0	0x398	data			0.39456521739130435
RT_STRING	0x123558	0xe4	data			0.5482456140350878
RT_STRING	0x12363c	0xbc	data			0.5691489361702128
RT_STRING	0x1236f8	0x2f4	data			0.4312169312169312
RT_STRING	0x1239ec	0x4b8	data			0.298841059602649
RT_STRING	0x123ea4	0x388	data			0.3661504424778761
RT_STRING	0x12422c	0x2f0	data			0.39095744680851063
RT_RCDATA	0x12451c	0x10	data			1.5
RT_RCDATA	0x12452c	0x10f89c	data	English	United States	0.7984275817871094
RT_RCDATA	0x233dc8	0x658	data			0.6354679802955665
RT_RCDATA	0x234420	0x21b	Delphi compiled form 'Tplfb'			0.62152133580705
RT_GROUP_CURSOR	0x23463c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x234650	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x234664	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x234678	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x23468c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x2346a0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x2346b4	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0x2346c8	0x14	data	English	United States	1.2
RT_GROUP_ICON	0x2346dc	0x14	data	English	United States	1.25

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualAlloc, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetSystemInfo, GetStringTypeExA, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, GetACP, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumCalendarInfoA, EnterCriticalSection, DeleteFileA, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStretchBltMode, GetStockObject, GetPixelFormat, GetPixel, GetPaletteEntries, GetObjectA, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, ExcludeClipRect, DeleteObject, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
ole32.dll	IsEqualGUID, CoTaskMemFree, StringFromCLSID, CoCreateGuid
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayGetElement, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
ole32.dll	CLSIDFromProgID, CoCreateInstance, CoUninitialize, CoInitialize
oleaut32.dll	CreateErrorInfo, GetErrorInfo, SetErrorInfo, SysFreeString
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 29, 2024 01:44:00.178447962 CEST	49731	443	192.168.2.4	149.154.167.99
Jun 29, 2024 01:44:00.178544998 CEST	443	49731	149.154.167.99	192.168.2.4
Jun 29, 2024 01:44:00.178649902 CEST	49731	443	192.168.2.4	149.154.167.99
Jun 29, 2024 01:44:00.190515995 CEST	49731	443	192.168.2.4	149.154.167.99
Jun 29, 2024 01:44:00.190572023 CEST	443	49731	149.154.167.99	192.168.2.4
Jun 29, 2024 01:44:00.819101095 CEST	443	49731	149.154.167.99	192.168.2.4
Jun 29, 2024 01:44:00.819190025 CEST	49731	443	192.168.2.4	149.154.167.99
Jun 29, 2024 01:44:00.885795116 CEST	49731	443	192.168.2.4	149.154.167.99
Jun 29, 2024 01:44:00.885828018 CEST	443	49731	149.154.167.99	192.168.2.4
Jun 29, 2024 01:44:00.886063099 CEST	443	49731	149.154.167.99	192.168.2.4
Jun 29, 2024 01:44:00.886121988 CEST	49731	443	192.168.2.4	149.154.167.99
Jun 29, 2024 01:44:00.888685942 CEST	49731	443	192.168.2.4	149.154.167.99
Jun 29, 2024 01:44:00.936546087 CEST	443	49731	149.154.167.99	192.168.2.4
Jun 29, 2024 01:44:01.074804068 CEST	443	49731	149.154.167.99	192.168.2.4
Jun 29, 2024 01:44:01.074831009 CEST	443	49731	149.154.167.99	192.168.2.4
Jun 29, 2024 01:44:01.074870110 CEST	49731	443	192.168.2.4	149.154.167.99
Jun 29, 2024 01:44:01.074882030 CEST	443	49731	149.154.167.99	192.168.2.4
Jun 29, 2024 01:44:01.074897051 CEST	443	49731	149.154.167.99	192.168.2.4
Jun 29, 2024 01:44:01.074909925 CEST	49731	443	192.168.2.4	149.154.167.99
Jun 29, 2024 01:44:01.074938059 CEST	49731	443	192.168.2.4	149.154.167.99
Jun 29, 2024 01:44:01.077014923 CEST	49731	443	192.168.2.4	149.154.167.99
Jun 29, 2024 01:44:01.077058077 CEST	443	49731	149.154.167.99	192.168.2.4
Jun 29, 2024 01:44:01.097412109 CEST	49732	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:01.102273941 CEST	9000	49732	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:01.102345943 CEST	49732	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:01.103023052 CEST	49732	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:01.107856035 CEST	9000	49732	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:01.782788992 CEST	9000	49732	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:01.782804012 CEST	9000	49732	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:01.782845974 CEST	49732	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:01.782874107 CEST	49732	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:03.712275982 CEST	49732	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:03.717202902 CEST	9000	49732	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:03.909444094 CEST	9000	49732	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:03.909554005 CEST	49732	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:03.910049915 CEST	49732	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:03.914874077 CEST	9000	49732	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:04.358618021 CEST	9000	49732	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:04.358731985 CEST	49732	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:04.361763000 CEST	49734	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:04.366497040 CEST	9000	49734	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:04.366583109 CEST	49734	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:04.366807938 CEST	49734	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:04.371715069 CEST	9000	49734	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:05.018667936 CEST	9000	49734	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:05.018918037 CEST	49734	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:05.019640923 CEST	49734	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:05.022136927 CEST	49734	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:05.024735928 CEST	9000	49734	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:05.026935101 CEST	9000	49734	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:05.643980026 CEST	9000	49734	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:05.644073963 CEST	49734	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:05.646280050 CEST	49732	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:05.646851063 CEST	49735	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:05.651210070 CEST	9000	49732	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:05.651302099 CEST	49732	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:05.651587963 CEST	9000	49735	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:05.651659966 CEST	49735	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:05.651964903 CEST	49735	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:05.656761885 CEST	9000	49735	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:06.323203087 CEST	9000	49735	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:06.323323965 CEST	49735	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:06.325109959 CEST	49735	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:06.329849958 CEST	9000	49735	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:06.330178976 CEST	49735	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:06.334906101 CEST	9000	49735	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:06.956288099 CEST	9000	49735	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:06.956305981 CEST	9000	49735	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:06.956345081 CEST	49735	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:06.956365108 CEST	49735	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:06.969937086 CEST	49734	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:06.970367908 CEST	49736	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:06.975235939 CEST	9000	49734	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:06.975249052 CEST	9000	49736	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:06.975317955 CEST	49734	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:06.975356102 CEST	49736	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:07.002710104 CEST	49736	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:07.007453918 CEST	9000	49736	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:07.621843100 CEST	9000	49736	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:07.621917963 CEST	49736	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:07.657030106 CEST	49736	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:07.658653021 CEST	49736	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:07.661797047 CEST	9000	49736	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:07.663424015 CEST	9000	49736	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:08.293230057 CEST	9000	49736	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:08.293257952 CEST	9000	49736	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:08.293268919 CEST	9000	49736	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:08.293284893 CEST	9000	49736	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:08.293297052 CEST	9000	49736	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:08.293504953 CEST	49736	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:08.295085907 CEST	49735	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:08.295558929 CEST	49737	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:08.300183058 CEST	9000	49735	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:08.300250053 CEST	49735	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:08.300317049 CEST	9000	49737	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:08.300390959 CEST	49737	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:08.300668001 CEST	49737	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:08.305402994 CEST	9000	49737	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:08.952327013 CEST	9000	49737	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:08.952445984 CEST	49737	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:08.952948093 CEST	49737	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:08.954749107 CEST	49737	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:08.958007097 CEST	9000	49737	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:08.959810019 CEST	9000	49737	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:09.588323116 CEST	9000	49737	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:09.588408947 CEST	49737	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:09.672715902 CEST	49736	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:09.673196077 CEST	49738	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:09.678463936 CEST	9000	49736	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:09.678538084 CEST	49736	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:09.678566933 CEST	9000	49738	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:09.678632975 CEST	49738	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:09.678886890 CEST	49738	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:09.683649063 CEST	9000	49738	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:10.334893942 CEST	9000	49738	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:10.335098982 CEST	49738	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:10.335587978 CEST	49738	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:10.337778091 CEST	49738	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:10.337816954 CEST	49738	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:10.340352058 CEST	9000	49738	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:10.342567921 CEST	9000	49738	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:10.342638016 CEST	9000	49738	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:10.342649937 CEST	9000	49738	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:10.342659950 CEST	9000	49738	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:10.342843056 CEST	9000	49738	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:10.342853069 CEST	9000	49738	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:10.989217043 CEST	49737	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:10.989794016 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:10.994338036 CEST	9000	49737	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:10.994395018 CEST	49737	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:10.994585991 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:10.994662046 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:10.995213032 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:11.000037909 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:11.007289886 CEST	9000	49738	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:11.007363081 CEST	49738	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:11.665215969 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:11.665290117 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:11.665631056 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:11.667259932 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:11.670375109 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:11.672022104 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.007647038 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.007699966 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.007719040 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.007730961 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.007742882 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.007864952 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.007877111 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.007886887 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.007899046 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.007904053 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.007904053 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.007911921 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.007929087 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.007958889 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.007978916 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.008007050 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.008055925 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.012792110 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.012809038 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.012850046 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.012876034 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.014137030 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.014192104 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.099889994 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.099900007 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.100193024 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.107400894 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.107412100 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.107420921 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.107486963 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.107547045 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.110887051 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.110897064 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.110903025 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.110965014 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.111006975 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.111054897 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.117866993 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.117878914 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.117888927 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.117928982 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.117978096 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.125137091 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.125204086 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.125231981 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.125237942 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.125277042 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.131880045 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.131928921 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.131941080 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.131970882 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.132035017 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.138926983 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.138947010 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.139024973 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.139050961 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.139060020 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.139060974 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.139112949 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.146102905 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.146115065 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.146125078 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.146167040 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.146193027 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.153019905 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.153039932 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.153068066 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.153104067 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.153134108 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.160176992 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.160188913 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.160200119 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.160237074 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.160263062 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.166954994 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.166975975 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.167040110 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.167061090 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.192467928 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.192502022 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.192513943 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.192585945 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.192632914 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.199932098 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.200011015 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.200026989 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.200079918 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.207638979 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.207691908 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.207703114 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.207720995 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.207755089 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.211126089 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.211174965 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.211184978 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.211199999 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.211225033 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.218257904 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.218305111 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.218316078 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.218323946 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.218348980 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.218352079 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.218381882 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.218409061 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.225182056 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.225202084 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.225214005 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.225235939 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.225285053 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.232273102 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.232335091 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.232342958 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.232348919 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.232378960 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.232403040 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.239595890 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.239653111 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.239653111 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.239665031 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.239711046 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.246157885 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.246177912 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.246187925 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.246233940 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.246259928 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.253340006 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.253360033 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.253371000 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.253393888 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.253427982 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.259311914 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.259362936 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.259372950 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.259376049 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.259432077 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.265099049 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.265116930 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.265126944 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.265192032 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.265233994 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.270683050 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.270740032 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.270771027 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.270824909 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.273662090 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.273696899 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.273708105 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.273715973 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.273749113 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.278734922 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.278820038 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.278820038 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.278830051 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.278875113 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.283886909 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.283905029 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.283915043 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.283946037 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.283970118 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.289030075 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.289099932 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.289108992 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.289124966 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.289159060 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.289184093 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.294037104 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.294095993 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.294117928 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.294127941 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.294168949 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.299390078 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.299452066 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.299465895 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.299484015 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.299518108 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.299544096 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.304296017 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.304315090 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.304325104 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.304347992 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.304375887 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.309217930 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.309274912 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.309279919 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.309292078 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.309338093 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.312494993 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.312526941 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.312539101 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.312597036 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.312623024 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.315463066 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.315481901 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.315491915 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.315519094 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.315546989 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.318418980 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.318428993 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.318483114 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.318526983 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.318536997 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.318583012 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.321520090 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.321528912 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.321578026 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.321614027 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.321624041 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.321666956 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.324579000 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.324652910 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.324656010 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.324704885 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.324719906 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.324729919 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.324767113 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.327642918 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.327665091 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.327697992 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.327732086 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.327740908 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.327743053 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.327783108 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.330691099 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.330709934 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.330719948 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.330748081 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.330787897 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.333617926 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.333643913 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.333655119 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.333692074 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.333718061 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.336668015 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.336688042 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.336749077 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.336762905 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.336774111 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.336776018 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.336812019 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.339839935 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.339849949 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.339868069 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.339876890 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.339896917 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.339926958 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.342799902 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.342844963 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.342855930 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.342856884 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.342905045 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.345895052 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.345957041 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.345959902 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.346003056 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.346023083 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.346055031 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.346076965 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.346132040 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.348831892 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.348839998 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.348851919 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.348905087 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.348932028 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.348946095 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.348982096 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.351970911 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.352024078 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.352091074 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.352102041 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.352111101 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.352142096 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.352180958 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.354955912 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.354974985 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.354984999 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.355010986 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.355031967 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.357965946 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.358023882 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.358083010 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.358102083 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.358136892 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.358164072 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.358191013 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.358236074 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.361049891 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.361063004 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.361073971 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.361131907 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.361345053 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.363955021 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.363976002 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.363986969 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.364012003 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.364038944 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.366967916 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.367019892 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.367022038 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.367032051 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.367067099 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.370003939 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.370037079 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.370068073 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.370076895 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.370093107 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.370110989 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.373349905 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.373390913 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.373399973 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.373429060 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.373461008 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.376055002 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.376111031 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.376178026 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.376188040 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.376197100 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.376231909 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.376270056 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.378988981 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.379008055 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.379017115 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.379048109 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.379076004 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.381966114 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.382016897 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.382023096 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.382035017 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.382069111 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.382096052 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.382122993 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.382149935 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.384968042 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.384989023 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.385030031 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.385046005 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.385070086 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.385092974 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.385094881 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.385137081 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.387747049 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.387765884 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.387775898 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.387803078 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.387828112 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.390686989 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.390733957 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.390743971 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.390744925 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.390788078 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.393505096 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.393517017 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.393526077 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.393567085 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.393593073 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.396179914 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.396245003 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.396255970 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.396256924 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.396289110 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.396317959 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.396378994 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.396434069 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.398926973 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.398978949 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.399020910 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.399060011 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.399070024 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.399070024 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.399120092 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.401633978 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.401652098 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.401662111 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.401705027 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.401765108 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.404416084 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.404434919 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.404460907 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.404484987 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.404529095 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.407074928 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.407084942 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.407126904 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.407146931 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.407155991 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.407186985 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.407218933 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.409563065 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.409571886 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.409622908 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.409724951 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.409734011 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.409781933 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.411670923 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.411689997 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.411700010 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.411725998 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.411761045 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.414047956 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.414057970 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.414067984 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.414108992 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.415654898 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.415672064 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.415682077 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.415721893 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.415750980 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.417773962 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.417785883 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.417793989 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.417874098 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.417927980 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.419660091 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.419673920 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.419684887 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.419738054 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.419758081 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.421574116 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.421622038 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.421632051 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.421642065 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.421684980 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.423367977 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.423410892 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.423430920 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.423468113 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.423469067 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.423480034 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.423521996 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.425334930 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.425353050 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.425383091 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.425421953 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.425451040 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.425460100 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.425508976 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.427102089 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.427158117 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.427258015 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.427268028 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.427314997 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.428936958 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.429013968 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.429048061 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.429069042 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.429079056 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.429100990 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.429128885 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.430615902 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.430676937 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.430686951 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.430720091 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.430766106 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.432533979 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.432545900 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.432555914 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.432606936 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.432640076 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.434288979 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.434299946 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.434309959 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.434366941 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.434411049 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.435856104 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.435904980 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.435915947 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.435930014 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.435961008 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.437578917 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.437633991 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.437669039 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.437680006 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.437727928 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.439209938 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.439243078 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.439254045 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.439295053 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.439344883 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.440789938 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.440799952 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.440819025 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.440828085 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.440853119 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.440881014 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.442296028 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.442317009 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.442347050 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.442373037 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.442382097 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.442398071 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.442425966 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.443861008 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.443871021 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.443922043 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.443947077 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.443969965 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.444000959 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.444036961 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.445417881 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.445436954 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.445477962 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.445499897 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.445518970 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.445566893 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.445584059 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.445621967 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.446957111 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.447026014 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.447107077 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.447160006 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.447169065 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.447175980 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.447218895 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.448529005 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.448595047 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.448604107 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.448637962 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.448646069 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.448678017 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.448709965 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.450010061 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.450056076 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.450066090 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.450098991 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.450141907 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.451500893 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.451545954 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.451555014 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.451555967 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.451597929 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.452877045 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.452887058 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.452935934 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.452965021 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.452974081 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.453016996 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.454508066 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.454547882 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.454557896 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.454557896 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.454600096 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.455857038 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.455868006 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.455878019 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.455915928 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.455944061 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.457299948 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.457315922 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.457326889 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.457365990 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.457401037 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.458643913 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.458669901 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.458698988 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.458717108 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.458724022 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.458767891 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.460086107 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.460097075 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.460107088 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.460163116 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.460184097 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.462661028 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.462723970 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.462757111 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.462768078 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.462780952 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.462816000 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.462846994 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.465933084 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.465998888 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.466011047 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.466104984 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.466116905 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.466120005 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.466129065 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.466150045 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.466161013 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.466216087 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.466660023 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.466726065 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.471771955 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.471829891 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.471841097 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.471857071 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.471885920 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.471920967 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.471931934 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.471942902 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.471973896 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.472003937 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.480853081 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.480911970 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.480922937 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.480931997 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.480966091 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.480997086 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.481008053 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.481018066 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.481043100 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.481082916 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.481225967 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.481277943 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.486751080 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.486785889 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.486798048 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.486810923 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.486821890 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.486826897 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.486834049 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.486849070 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.486893892 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.494474888 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.494496107 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.494505882 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.494535923 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.494574070 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.494577885 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.494617939 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.494648933 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.494661093 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.494704962 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.494735003 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.494746923 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.494780064 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.494817019 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.502509117 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.502592087 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.502593040 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.502604008 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.502638102 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.502665043 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.502840042 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.502891064 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.502899885 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.502902985 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.502914906 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.502939939 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.502969027 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.508297920 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.508342981 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.508358002 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.508369923 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.508407116 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.508419991 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.508431911 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.508469105 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.508497000 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.508547068 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.508570910 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.508580923 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.508591890 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.508620977 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.508657932 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.514565945 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.514607906 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.514619112 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.514626026 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.514683008 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.514766932 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.514811039 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.514818907 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.514822960 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.514834881 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.514863968 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.514903069 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.518843889 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.518865108 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.518891096 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.518904924 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.518938065 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.518973112 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.518985987 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.518996000 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.519009113 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.519031048 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.519064903 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.523472071 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.523483992 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.523494005 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.523524046 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.523528099 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.523555040 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.523591995 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.523592949 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.523612022 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.523624897 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.523636103 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.523638964 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.523669004 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.523706913 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.528877020 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.528939962 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.528951883 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.528963089 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.528987885 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.529016018 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.529050112 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.529102087 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.529136896 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.529154062 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.529165030 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.529175997 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.529186964 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.529223919 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.533654928 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.533665895 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.533677101 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.533713102 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.533739090 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.533767939 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.533780098 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.533790112 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.533801079 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.533828020 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.533869982 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.538059950 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.538100958 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.538117886 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.538121939 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.538144112 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.538167000 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.538211107 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.538288116 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.538336992 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.538345098 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.538350105 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.538361073 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.538388968 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.538427114 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.541291952 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.541359901 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.541380882 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.541393042 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.541420937 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.541431904 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.541450977 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.541486025 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.541589975 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.541642904 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.541659117 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.541711092 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.545610905 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.545622110 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.545633078 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.545665979 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.545703888 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.545726061 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.545747042 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.545758009 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.545778036 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.545813084 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.545819998 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.545831919 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.545867920 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.545902967 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.550069094 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.550080061 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.550091028 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.550133944 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.550146103 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.550158024 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.550168991 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.550172091 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.550215960 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.550365925 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.550422907 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.555295944 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.555360079 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.555370092 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.555386066 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.555402040 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.555443048 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.555479050 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.555557013 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.555608034 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.555614948 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.555624962 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.555664062 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.555696964 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.555732012 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.559433937 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.559488058 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.559500933 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.559504032 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.559540033 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.559655905 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.559675932 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.559706926 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.559745073 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.559745073 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.559758902 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.559771061 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.559792995 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.559829950 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.573144913 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.573210001 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.573210001 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.573221922 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.573262930 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.573290110 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.573301077 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.573348045 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.573491096 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.573539019 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.573575974 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.573625088 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.578994036 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.579004049 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.579050064 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.579087973 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.579144001 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.579150915 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.579163074 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.579196930 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.579221010 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.579263926 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.579276085 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.579287052 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.579320908 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.579351902 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.587373018 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.587435961 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.587436914 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.587460995 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.587497950 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.587529898 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.587529898 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.587543011 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.587569952 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.587577105 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.587600946 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.587625027 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.587946892 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.587994099 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.587999105 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.588038921 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.596060991 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.596082926 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.596118927 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.596120119 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.596146107 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.596169949 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.596179962 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.596194029 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.596230984 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.596267939 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.596281052 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.596291065 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.596327066 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.596345901 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.609045029 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.609056950 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.609067917 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.609113932 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.609136105 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.609148026 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.609164953 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.609201908 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.609824896 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.609868050 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.609875917 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.609914064 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.622823000 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.622843027 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.622904062 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.622912884 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.622939110 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.622961044 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.622968912 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.622972965 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.622983932 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.623012066 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.623054028 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.623075962 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.623125076 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.623722076 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.623775959 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.629749060 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.629765987 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.629786015 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.629796028 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.629806042 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.629806042 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.629817963 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.629854918 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.629868031 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.629879951 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.629925966 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.631103039 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.631120920 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.631130934 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.631165028 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.631182909 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.631201029 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.631247044 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.631268978 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.631280899 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.631325006 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.631364107 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.631373882 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.631426096 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.632205009 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.632214069 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.632224083 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.632256031 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.632281065 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.632349968 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.632360935 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.632369995 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.632380009 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.632405996 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.632441998 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.632783890 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.632833004 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.632838964 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.632844925 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.632885933 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.632951975 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.632963896 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.632973909 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.632986069 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.633018970 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.633049965 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.633630991 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.633673906 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.633685112 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.633687019 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.633728981 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.633749962 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.633811951 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.634120941 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.634170055 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.634181023 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.634183884 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.634207964 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.634226084 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.634263992 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.634542942 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.634598017 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.634602070 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.634609938 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.634645939 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.634665012 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.634675980 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.634712934 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.634720087 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.634772062 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.635335922 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.635395050 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.638273001 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.638283014 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.638328075 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.638336897 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.638380051 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.638405085 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.638417006 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.638427019 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.638458014 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.638489962 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.638505936 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.638542891 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.638767958 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.638817072 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.643140078 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.643161058 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.643189907 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.643223047 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.643265963 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.643299103 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.643311024 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.643332005 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.643343925 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.643352032 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.643369913 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.643402100 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.648080111 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.648137093 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.648144007 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.648145914 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.648190975 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.648195028 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.648212910 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.648224115 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.648236036 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.648250103 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.648283958 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.648293972 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.648297071 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.648336887 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.652112007 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.652122021 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.652132034 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.652179956 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.652219057 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.652410984 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.652426958 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.652436018 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.652446032 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.652456045 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.652470112 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.652507067 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.666110992 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.666138887 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.666145086 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.666160107 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.666168928 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.666243076 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.666251898 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.666281939 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.666309118 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.666313887 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.666326046 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.666359901 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.666378975 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.672188997 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.672200918 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.672207117 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.672216892 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.672254086 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.672282934 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.672290087 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.672297001 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.672328949 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.672358990 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.672378063 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.672389030 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.672427893 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.680116892 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.680174112 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.680183887 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.680198908 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.680231094 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.680241108 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.680248976 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.680249929 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.680293083 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.680320978 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.680430889 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.680449963 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.680479050 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.680497885 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.688801050 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.688860893 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.688870907 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.688889027 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.688926935 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.688957930 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.688968897 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.689009905 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.689013004 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.689059019 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.689065933 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.689116001 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.702186108 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.702258110 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.702267885 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.702281952 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.702315092 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.702318907 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.702330112 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.702338934 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.702349901 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.702368975 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.702403069 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.702574015 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.702620983 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.715585947 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.715651035 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.715660095 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.715660095 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.715706110 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.715718031 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.715717077 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.715739012 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.715764046 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.715790987 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.715802908 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.715811968 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.715838909 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.715857983 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.722145081 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.722193956 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.722203016 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.722207069 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.722232103 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.722251892 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.722255945 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.722265005 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.722275972 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.722296000 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.722320080 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.722479105 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.722498894 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.722524881 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.722563028 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.723716974 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.723737955 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.723747015 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.723772049 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.723800898 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.723836899 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.723853111 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.723864079 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.723892927 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.723936081 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.723965883 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.723978043 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.724013090 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.724061012 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.724664927 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.724684000 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.724714994 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.724725962 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.724744081 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.724765062 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.724773884 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.724817038 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.724910021 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.724921942 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.724939108 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.724962950 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.724992990 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.724996090 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.725006104 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.725049019 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.725131035 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.725181103 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.725184917 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.725193977 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.725227118 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.725250006 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.725265026 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.725279093 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.725313902 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.725337029 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.725349903 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.725398064 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.725630045 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.725677967 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.725764036 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.725815058 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.725827932 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.725866079 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.725996017 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.726069927 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.726080894 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.726093054 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.726125002 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.726133108 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.726161957 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.726200104 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.726217985 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.726674080 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.726725101 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.726730108 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.726742029 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.726783037 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.726815939 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.726826906 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.726869106 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.726901054 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.726912022 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.726923943 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.726958990 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.726978064 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.731021881 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.731070995 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.731082916 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.731082916 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.731122017 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.731154919 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.731165886 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.731178045 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.731190920 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.731204033 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.731235981 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.735997915 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.736052036 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.736063004 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.736093998 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.736133099 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.736135006 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.736146927 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.736185074 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.736215115 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.736224890 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.736268997 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.740660906 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.740679979 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.740715981 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.740725994 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.740751028 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.740755081 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.740766048 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.740772009 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.740798950 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.740817070 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.740833998 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.740880966 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.740897894 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.740910053 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.740919113 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.740955114 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.740988016 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.752120018 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.752165079 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.752176046 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.752218962 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.752247095 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.752276897 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.752289057 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.752300024 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.752312899 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.752331018 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.752355099 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.769732952 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.769783974 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.769793987 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.769804001 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.769826889 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.769834995 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.769875050 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.769881964 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.769897938 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.769932032 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.769965887 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.770061970 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.770073891 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.770083904 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.770096064 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.770112038 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.770149946 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.770209074 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.770219088 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.770227909 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.770236969 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.770256042 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.770281076 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.776253939 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.776279926 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.776289940 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.776305914 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.776335955 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.776441097 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.776452065 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.776460886 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.776474953 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.776500940 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.776514053 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.782607079 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.782651901 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.782665014 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.782676935 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.782726049 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.782802105 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.782813072 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.782824039 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.782835960 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.782850027 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.782883883 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.795166969 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.795176983 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.795186996 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.795234919 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.795284986 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.795288086 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.795300961 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.795310974 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.795339108 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.795362949 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.795377016 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.795428038 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.812666893 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.812724113 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.812732935 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.812736988 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.812769890 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.812797070 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.812815905 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.812829018 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.812869072 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.812890053 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.812901974 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.812907934 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.812944889 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.814991951 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.815012932 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.815054893 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.815080881 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.815093040 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.815093994 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.815130949 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.815155983 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.815171003 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.815184116 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.815218925 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.815227032 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.815238953 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.815274000 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.816601038 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.816634893 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.816646099 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.816653967 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.816680908 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.816704988 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.816746950 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.816759109 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.816771030 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.816793919 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.816823959 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.816854954 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.816903114 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.817397118 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.817426920 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.817439079 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.817447901 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.817481995 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.817506075 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.817543030 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.817557096 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.817594051 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.817600012 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.817605972 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.817617893 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.817645073 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.817673922 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.817830086 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.817846060 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.817857027 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.817867994 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.817889929 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.817924023 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.818039894 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.818052053 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.818063974 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.818074942 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.818089962 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.818116903 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.818154097 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.818906069 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.818924904 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.818939924 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.818962097 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.818989992 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.819089890 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.819099903 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.819111109 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.819120884 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.819139004 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.819171906 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.819454908 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.819464922 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.819475889 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.819542885 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.819571018 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.819581985 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.819591999 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.819591999 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.819605112 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.819622993 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.819664001 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.823858976 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.823869944 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.823879957 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.823909044 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.823945045 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.823996067 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.824074984 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.824184895 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.824196100 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.824206114 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.824233055 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.824260950 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.824342012 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.824389935 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.829093933 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.829104900 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.829114914 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.829124928 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.829165936 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.829214096 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.829267025 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.829277992 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.829287052 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.829317093 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.829340935 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.833929062 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.833940029 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.833950043 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.833960056 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.833978891 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.834017038 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.834088087 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.834100008 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.834108114 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.834161043 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.834184885 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.838094950 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.838150024 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.838385105 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.838395119 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.838403940 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.838413954 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.838423967 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.838433981 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.838437080 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.838466883 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.838515043 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.838558912 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.838608980 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.863008976 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.863029003 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.863039017 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.863049030 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.863058090 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.863068104 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.863079071 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.863084078 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.863089085 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.863094091 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.863097906 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.863110065 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.863111019 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.863121033 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.863132000 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.863281965 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.863281965 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.869023085 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.869064093 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.869075060 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.869103909 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.869165897 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.869187117 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.869199038 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.869208097 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.869218111 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.869246006 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.869270086 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.875216007 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.875255108 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.875266075 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.875329971 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.875339985 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.875365019 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.875375986 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.875411034 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.875426054 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.875437975 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.875447035 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.875477076 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.875510931 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.887861013 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.887871027 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.887877941 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.887979984 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.887990952 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.888053894 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.888062954 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.888062954 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.888065100 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.888130903 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.888169050 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.905467033 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.905528069 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.905535936 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.905538082 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.905572891 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.905602932 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.905661106 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.905672073 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.905682087 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.905697107 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.905713081 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.905767918 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.908003092 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.908031940 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.908041954 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.908054113 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.908088923 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.908091068 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.908138037 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.908179045 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.908190012 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.908199072 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.908231974 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.908256054 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.908266068 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.908305883 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.909802914 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.909840107 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.909849882 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.909898996 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.909929991 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.909931898 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.909949064 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.909959078 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.909980059 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.910008907 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.910024881 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.910065889 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.910151005 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.910202980 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.911191940 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.911243916 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.911247969 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.911259890 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.911299944 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.911314964 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.911326885 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.911365032 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.911396027 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.911401987 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.911416054 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.911449909 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.912230968 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.912250996 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.912261963 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.912287951 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.912312984 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.912323952 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.912331104 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.912369967 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.913042068 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.913053036 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.913068056 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.913105011 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.913134098 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.913666964 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.913688898 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.913698912 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.913726091 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.913755894 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.913770914 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.913783073 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.913794994 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.913815975 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.913858891 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.914323092 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.914335012 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.914351940 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.914380074 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.914412975 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.914424896 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.914426088 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.914438009 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.914450884 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.914472103 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.914498091 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.914529085 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.914541006 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.914571047 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.914612055 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.919461012 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.919512987 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.919523954 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.919537067 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.919559956 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.919724941 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.919735909 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.919745922 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.919756889 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.919780970 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.919807911 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.921578884 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.921633959 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.921643019 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.921674967 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.921716928 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.921727896 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.921739101 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.921741009 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.921750069 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.921789885 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.921818972 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.921853065 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.921904087 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.926590919 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.926634073 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.926645041 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.926656008 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.926688910 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.926748991 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.926759958 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.926770926 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.926780939 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.926800966 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.926826000 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.931108952 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.931121111 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.931132078 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.931142092 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.931153059 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.931162119 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.931173086 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.931194067 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.931236982 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.955050945 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.955096006 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.955106974 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.955107927 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.955152035 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.955183983 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.955194950 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.955205917 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.955251932 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.955306053 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.955346107 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.955355883 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.955363989 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.955368042 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.955384016 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.955404997 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.955447912 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.955588102 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.955600023 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.955610037 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.955621004 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.955637932 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.955663919 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.961704016 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.961719990 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.961740971 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.961754084 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.961764097 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.961766005 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.961786032 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.961795092 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.961801052 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.961844921 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.961870909 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.961955070 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.968029976 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.968080044 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.968108892 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.968121052 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.968158007 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.968175888 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.968197107 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.968209982 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.968220949 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.968234062 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.968242884 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.968262911 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.968296051 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.980624914 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.980670929 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.980671883 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.980684996 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.980711937 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.980730057 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.980731010 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.980830908 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.980839968 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.980843067 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.980854988 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.980871916 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.980882883 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.980902910 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.998131990 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.998187065 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.998306036 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.998317957 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.998333931 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.998344898 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.998353004 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.998357058 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.998369932 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.998379946 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.998394966 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:12.998411894 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:12.998435020 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.000955105 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.000992060 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.000999928 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.001003027 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.001029968 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.001040936 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.001128912 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.001141071 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.001149893 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.001158953 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.001178026 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.001194000 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.002578974 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.002629042 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.002775908 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.002787113 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.002798080 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.002826929 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.002827883 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.002840996 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.002861977 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.002891064 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.002943993 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.002955914 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.002989054 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.003793001 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.003813982 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.003823996 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.003840923 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.003860950 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.003890038 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.003901958 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.003915071 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.003931999 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.003959894 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.004024029 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.004064083 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.004091024 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.004132032 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.004971027 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.004997015 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.005008936 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.005036116 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.005048990 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.005057096 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.005089998 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.005112886 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.005124092 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.005135059 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.005158901 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.005160093 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.005172014 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.005199909 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.006741047 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.006788969 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.006813049 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.006824970 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.006865025 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.006902933 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.006915092 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.006926060 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.006943941 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.006953001 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.006974936 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.006974936 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.007016897 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.007031918 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.007072926 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.007455111 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.007500887 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.007555008 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.007565975 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.007587910 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.007597923 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.007599115 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.007611990 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.007611990 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.007622957 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.007632971 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.007642031 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.007671118 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.007683992 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.012089014 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.012130976 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.012178898 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.012188911 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.012207985 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.012218952 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.012221098 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.012231112 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.012243032 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.012243032 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.012278080 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.012289047 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.012301922 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.012341976 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.014401913 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.014448881 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.014476061 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.014487028 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.014523029 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.014600992 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.014612913 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.014624119 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.014636040 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.014646053 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.014677048 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.019288063 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.019299984 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.019310951 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.019337893 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.019356966 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.019382954 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.019401073 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.019412041 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.019426107 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.019453049 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.019479036 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.019490004 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.019522905 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.023515940 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.023559093 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.023562908 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.023572922 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.023607969 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.023678064 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.023690939 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.023705006 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.023716927 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.023726940 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.023736954 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.023755074 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.023773909 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.053534031 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.053553104 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.053565979 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.053576946 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.053587914 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.053602934 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.053663015 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.053781033 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.053792000 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.053802967 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.053814888 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.053828001 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.053957939 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.053970098 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.054383039 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.054420948 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.054433107 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.054497957 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.054513931 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.054523945 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.054600954 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.054614067 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.056878090 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.060720921 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.060741901 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.060754061 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.060764074 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.060792923 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.060847998 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.060858965 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.060888052 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.060905933 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.060918093 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.060930967 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.060959101 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.060969114 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.073204041 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.073214054 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.073224068 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.073256969 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.073280096 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.073291063 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.073292017 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.073314905 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.073323011 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.073340893 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.073350906 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.073389053 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.073400021 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.073431969 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.073436022 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.073446035 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.073474884 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.090851068 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.090897083 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.090922117 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.090940952 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.090953112 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.090970993 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.090992928 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.091005087 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.091015100 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.091026068 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.091027975 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.091027975 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.091068029 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.093645096 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.093687057 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.093703985 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.093714952 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.093748093 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.093789101 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.093801022 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.093816042 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.093836069 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.093848944 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.093903065 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.093945026 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.095479965 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.095520020 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.095534086 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.095546007 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.095577002 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.095591068 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.095673084 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.095683098 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.095694065 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.095705032 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.095729113 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.095740080 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.096487045 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.096529007 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.096550941 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.096560955 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.096590042 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.096596003 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.096601963 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.096604109 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.096613884 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.096626043 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.096632004 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.096651077 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.096678972 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.096700907 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.096741915 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.097675085 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.097718954 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.097723007 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.097734928 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.097771883 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.097805977 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.097816944 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.097826958 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.097840071 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.097851992 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.097881079 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.098927975 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.098970890 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.099492073 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.099534988 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.099543095 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.099553108 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.099586964 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.099616051 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.099627972 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.099638939 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.099652052 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.099661112 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.099680901 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.099704027 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.099714041 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.099756002 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.100117922 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.100152016 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.100158930 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.100162983 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.100195885 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.100202084 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.100214005 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.100222111 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.100240946 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.100282907 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.100296021 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.100306988 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.100325108 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.100337982 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.100358009 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.104851007 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.104861021 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.104872942 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.104897976 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.104913950 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.104948044 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.104963064 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.104989052 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.105016947 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.105017900 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.105030060 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.105042934 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.105058908 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.105072021 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.105094910 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.107151031 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.107172012 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.107182980 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.107201099 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.107227087 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.107368946 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.107379913 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.107392073 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.107403040 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.107413054 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.107414007 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.107445002 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.107470989 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.112011909 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.112054110 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.112063885 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.112076044 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.112106085 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.112118959 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.112139940 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.112153053 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.112163067 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.112193108 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.112217903 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.112221003 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.112261057 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.116281986 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.116293907 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.116303921 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.116328955 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.116358042 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.116456032 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.116466999 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.116477966 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.116497040 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.116497040 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.116523981 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.116548061 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.145987988 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.146028996 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.146039009 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.146065950 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.146090031 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.146091938 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.146101952 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.146112919 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.146136045 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.146161079 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.146265984 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.146277905 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.146285057 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.146296024 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.146318913 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.146337032 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.146392107 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.146433115 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.146462917 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.146475077 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.146508932 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.146549940 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.146562099 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.146595001 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.147145033 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.147164106 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.147176027 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.147193909 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.147224903 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.147236109 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.147279978 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.147298098 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.147310972 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.147345066 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.147377968 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.147388935 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.147425890 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.153568983 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.153621912 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.153625965 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.153640032 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.153671980 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.153676033 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.153685093 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.153717995 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.153758049 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.153769970 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.153780937 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.153806925 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.153836012 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.165899992 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.165947914 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.165955067 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.165958881 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.165990114 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.166002989 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.166028976 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.166040897 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.166052103 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.166064024 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.166069984 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.166086912 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.166102886 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.166153908 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.166198015 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.183590889 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.183626890 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.183640957 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.183644056 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.183677912 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.183721066 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.183732986 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.183743000 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.183754921 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.183764935 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.183799982 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.183829069 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.183871984 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.186256886 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.186300993 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.186315060 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.186331034 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.186359882 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.186361074 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.186372995 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.186376095 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.186398029 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.186405897 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.186491013 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.186502934 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.186512947 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.186532021 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.186541080 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.186559916 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.188139915 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.188184023 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.188191891 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.188208103 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.188235044 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.188246012 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.188308954 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.188319921 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.188329935 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.188350916 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.188368082 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.188429117 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.188471079 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.189230919 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.189274073 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.189275026 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.189295053 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.189308882 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.189321995 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.189337015 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.189347982 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.189352989 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.189363956 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.189373970 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.189383984 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.189414978 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.189433098 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.190375090 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.190417051 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.190437078 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.190448999 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.190479040 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.190480947 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.190490961 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.190519094 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.190540075 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.190543890 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.190556049 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.190586090 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.192200899 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.192212105 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.192222118 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.192245960 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.192260981 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.192267895 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.192281008 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.192290068 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.192317009 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.192339897 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.192353964 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.192368031 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.192397118 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.192406893 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.192722082 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.192764997 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.192773104 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.192784071 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.192815065 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.192816973 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.192826986 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.192853928 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.192861080 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.192888021 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.192897081 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.192904949 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.192924023 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.192946911 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.192958117 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.197505951 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.197516918 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.197530985 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.197563887 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.197592020 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.197592020 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.197604895 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.197635889 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.197648048 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.197659969 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.197690010 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.197699070 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.197714090 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.197736979 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.199714899 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.199759007 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.199764013 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.199775934 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.199805021 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.199810028 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.199817896 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.199821949 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.199851036 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.199861050 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.199899912 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.199911118 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.199922085 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.199944973 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.199975967 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.204642057 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.204682112 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.204694986 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.204713106 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.204730988 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.204760075 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.204771042 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.204783916 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.204804897 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.204829931 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.204850912 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.204863071 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.204893112 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.204919100 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.208970070 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.208993912 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.209003925 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.209075928 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.209088087 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.209099054 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.209111929 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.209135056 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.209157944 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.209186077 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.209198952 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.238764048 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.238801956 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.238811970 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.238856077 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.238881111 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.238889933 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.238902092 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.238914013 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.238925934 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.238944054 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.238961935 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.238991976 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.239012957 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.239054918 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.239073992 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.239085913 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.239120960 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.239139080 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.239185095 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.239196062 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.239227057 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.239231110 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.239240885 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.239243984 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.239269972 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.239284039 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.239325047 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.239336014 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.239365101 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.239378929 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.239957094 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.240008116 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.240015984 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.240027905 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.240067959 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.240108967 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.240119934 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.240130901 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.240160942 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.240170002 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.240206957 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.240250111 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.246092081 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.246155977 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.246160030 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.246172905 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.246203899 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.246210098 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.246215105 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.246227026 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.246246099 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.246275902 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.246289015 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.246349096 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.246350050 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.246397972 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.258711100 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.258765936 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.258778095 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.258799076 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.258829117 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.258887053 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.258898973 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.258909941 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.258920908 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.258941889 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.258960009 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.276320934 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.276360035 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.276370049 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.276407003 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.276503086 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.276515007 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.276515961 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.276525021 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.276537895 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.276552916 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.276571035 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.279019117 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.279067993 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.279073954 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.279081106 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.279105902 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.279119015 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.279144049 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.279184103 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.279195070 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.279205084 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.279215097 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.279236078 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.279262066 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.280872107 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.280919075 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.280930042 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.280934095 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.280961990 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.280992031 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.281022072 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.281033993 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.281044006 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.281054974 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.281066895 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.281099081 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.281122923 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.281169891 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.281964064 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.281977892 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.281989098 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.282001019 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.282016039 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.282035112 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.282062054 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.282063007 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.282074928 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.282115936 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.282124043 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.282140970 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.282151937 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.282192945 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.282998085 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.283018112 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.283047915 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.283070087 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.283073902 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.283112049 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.283113956 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.283126116 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.283162117 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.283170938 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.283214092 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.283216000 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.283238888 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.283258915 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.283293962 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.284817934 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.284837961 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.284848928 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.284876108 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.284899950 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.284946918 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.284948111 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.284948111 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.284957886 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.284982920 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.284989119 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.285001040 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.285011053 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.285023928 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.285051107 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.285420895 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.285468102 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.285470009 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.285480022 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.285502911 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.285517931 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.285545111 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.285578966 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.285592079 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.285603046 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.285612106 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.285633087 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.285659075 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.290255070 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.290297031 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.290307045 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.290329933 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.290343046 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.290395021 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.290406942 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.290419102 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.290431023 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.290441990 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.290486097 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.290504932 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.290548086 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.292375088 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.292395115 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.292404890 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.292437077 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.292458057 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.292459965 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.292485952 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.292500019 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.292505026 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.292536974 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.292541027 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.292556047 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.292582035 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.292591095 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.292635918 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.297327995 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.297338009 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.297348976 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.297359943 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.297370911 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.297394037 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.297405958 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.297420025 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.297426939 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.297461987 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.297461987 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.297481060 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.297513962 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.297525883 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.301640987 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.301688910 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.301700115 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.301717043 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.301759005 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.301763058 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.301774979 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.301786900 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.301798105 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.301804066 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.301829100 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.301852942 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.301853895 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.301893950 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.331878901 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.331933022 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.331943989 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.332032919 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.332204103 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.332216024 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.332226038 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.332263947 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.332283974 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.332525969 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.332539082 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.332549095 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.332561016 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.332576990 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.332607031 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.332870960 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.332882881 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.332895041 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.332906961 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.332926035 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.332937002 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.332962990 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.333983898 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.334036112 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.334068060 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.334084034 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.334116936 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.334131956 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.335711956 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.335724115 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.335736036 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.335752010 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.335782051 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.335807085 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.339287996 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.339301109 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.339310884 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.339349985 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.339361906 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.339365005 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.339373112 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.339385986 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.339391947 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.339406013 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.339432955 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.351618052 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.351669073 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.351696968 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.351710081 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.351748943 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.351809978 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.351825953 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.351856947 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.351880074 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.351881981 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.351892948 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.351921082 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.351932049 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.369421005 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.369434118 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.369445086 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.369456053 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.369493008 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.369524956 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.369540930 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.369553089 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.369564056 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.369586945 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.369600058 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.371684074 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.371731997 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.371738911 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.371748924 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.371783018 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.371792078 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.371794939 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.371829033 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.371853113 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.371918917 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.371922016 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.371942997 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.371973038 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.372001886 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.373667002 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.373714924 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.373730898 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.373743057 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.373769045 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.373785019 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.373814106 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.373827934 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.373837948 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.373856068 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.373873949 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.373904943 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.373914957 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.373956919 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.374686956 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.374735117 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.374756098 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.374767065 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.374778032 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.374800920 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.374821901 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.374828100 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.374876976 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.374905109 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.374916077 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.374932051 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.374952078 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.374963045 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.375935078 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.375946045 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.375957012 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.376003027 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.376033068 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.376038074 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.376049995 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.376063108 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.376074076 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.376077890 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.376096964 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.376128912 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.377531052 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.377566099 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.377574921 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.377577066 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.377612114 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.377639055 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.377650976 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.377660990 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.377686024 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.377703905 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.377712965 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.377751112 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.377768993 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.377815008 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.378192902 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.378240108 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.378247976 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.378258944 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.378293991 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.378328085 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.378340006 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.378350019 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.378374100 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.378393888 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.378401995 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.378436089 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.383043051 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.383091927 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.383102894 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.383104086 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.383137941 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.383158922 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.383169889 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.383181095 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.383205891 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.383218050 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.383232117 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.383275986 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.385263920 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.385318041 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.385328054 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.385329962 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.385365963 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.385402918 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.385413885 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.385425091 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.385437012 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.385441065 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.385469913 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.385500908 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.390074015 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.390094995 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.390108109 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.390136003 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.390153885 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.390219927 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.390230894 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.390242100 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.390266895 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.390276909 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.390297890 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.390342951 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.394426107 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.394437075 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.394448042 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.394474030 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.394501925 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.394511938 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.394522905 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.394532919 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.394545078 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.394560099 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.394592047 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.424455881 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.424515963 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.424544096 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.424556017 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.424596071 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.424748898 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.424761057 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.424777985 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.424789906 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.424798965 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.424801111 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.424813032 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.424823999 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.424834967 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.424837112 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.424850941 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.424864054 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.424865961 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.424876928 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.424882889 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.424890041 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.424916029 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.424940109 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.427310944 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.427334070 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.427345037 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.427366018 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.427390099 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.427464008 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.427474976 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.427486897 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.427498102 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.427517891 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.427536964 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.432094097 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.432112932 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.432123899 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.432135105 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.432143927 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.432147026 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.432164907 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.432193995 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.432216883 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.432229042 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.432265997 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.444434881 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.444504023 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.444514036 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.444524050 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.444565058 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.444578886 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.444590092 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.444601059 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.444612026 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.444631100 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.444648027 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.444716930 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.444766998 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.462218046 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.462232113 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.462253094 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.462265015 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.462275982 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.462287903 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.462297916 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.462301970 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.462311983 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.462347031 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.462364912 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.464643955 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.464689970 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.464703083 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.464715004 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.464747906 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.464821100 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.464833021 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.464843988 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.464857101 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.464865923 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.464868069 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.464891911 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.464909077 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.466391087 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.466440916 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.466489077 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.466500044 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.466536045 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.466589928 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.466600895 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.466612101 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.466629982 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.466639042 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.466640949 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.466653109 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.466685057 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.467464924 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.467514038 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.467540979 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.467552900 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.467587948 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.467607975 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.467618942 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.467629910 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.467642069 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.467650890 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.467653990 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.467669010 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.467698097 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.468580008 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.468600988 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.468612909 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.468632936 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.468666077 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.468672037 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.468708992 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.468745947 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.468756914 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.468767881 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.468776941 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.468790054 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.468803883 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.468832016 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.470347881 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.470393896 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.470406055 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.470415115 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.470438957 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.470455885 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.470457077 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.470469952 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.470499039 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.470515013 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.470531940 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.470544100 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.470582008 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.470901966 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.470938921 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.470947981 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.470949888 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.470993042 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.471015930 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.471028090 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.471038103 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.471049070 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.471067905 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.471081018 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.471098900 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.471142054 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.475841045 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.475881100 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.475893021 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.475929976 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.475955963 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.476012945 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.476025105 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.476036072 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.476048946 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.476068974 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.476109028 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.478090048 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.478111982 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.478122950 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.478142977 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.478168011 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.478221893 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.478234053 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.478245020 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.478256941 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.478281975 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.478349924 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.478369951 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.478429079 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.482867002 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.482886076 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.482896090 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.482920885 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.482928991 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.482944012 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.482968092 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.482995033 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.483006954 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.483016968 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.483042002 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.483046055 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.483067989 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.483094931 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.487083912 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.487123966 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.487133980 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.487164021 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.487180948 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.487206936 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.487217903 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.487230062 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.487243891 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.487253904 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.487277031 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.487298965 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.517307997 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.517321110 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.517332077 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.517405033 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.517432928 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.517440081 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.517451048 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.517462015 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.517472982 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.517484903 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.517493963 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.517507076 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.517507076 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.517545938 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.517582893 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.517592907 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.517608881 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.517646074 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.517646074 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.517811060 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.517822027 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.517855883 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.517879963 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.517891884 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.517903090 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.517913103 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.517924070 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.517952919 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.519967079 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.520014048 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.520028114 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.520039082 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.520051956 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.520070076 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.520133018 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.520144939 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.520155907 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.520169020 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.520183086 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.520214081 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.524893999 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.524964094 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.524971962 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.524987936 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.525018930 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.525053978 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.525068998 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.525080919 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.525093079 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.525110006 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.525120974 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.525140047 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.525155067 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.525165081 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.525198936 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.537223101 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.537262917 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.537282944 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.537314892 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.537343025 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.537343025 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.537354946 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.537365913 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.537390947 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.537410975 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.537450075 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.537462950 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.537527084 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.555053949 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.555075884 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.555131912 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.555143118 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.555144072 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.555185080 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.555263996 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.555279970 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.555291891 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.555480957 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.557446003 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.557456017 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.557466030 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.557476997 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.557487965 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.557501078 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.557537079 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.557661057 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.557674885 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.557714939 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.557735920 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.557782888 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.559226036 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.559266090 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.559278011 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.559299946 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.559319973 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.559360981 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.559374094 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.559385061 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.559398890 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.559411049 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.559446096 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.559484959 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.559533119 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.560286045 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.560297966 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.560309887 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.560323000 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.560334921 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.560334921 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.560367107 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.560369968 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.560381889 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.560383081 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.560395956 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.560416937 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.560441971 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.561348915 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.561368942 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.561381102 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.561398983 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.561423063 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.561665058 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.561676979 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.561714888 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.561718941 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.561728001 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.561758041 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.561784029 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.563472986 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.563502073 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.563513041 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.563560963 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.563658953 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.563672066 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.563683987 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.563698053 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.563721895 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.563757896 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.563757896 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.564033985 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.564050913 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.564073086 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.564085007 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.564088106 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.564100027 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.564110994 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.564112902 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.564125061 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.564143896 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.564169884 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.568653107 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.568696976 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.568711996 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.568712950 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.568739891 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.568742037 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.568756104 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.568758011 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.568778992 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.568794012 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.568875074 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.568891048 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.568906069 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.568933010 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.568943977 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.570717096 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.570770979 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.570784092 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.570801020 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.570831060 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.570835114 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.570851088 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.570868015 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.570878029 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.570885897 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.570907116 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.570935011 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.570943117 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.570991993 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.575653076 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.575702906 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.575706959 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.575748920 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.575793028 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.575809002 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.575824976 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.575838089 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.575843096 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.575855017 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.575869083 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.575880051 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.575881958 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.575896978 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.575930119 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.575948000 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.579761982 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.579777002 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.579792976 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.579813004 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.579824924 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.579828978 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.579845905 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.579862118 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.579871893 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.579894066 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.579906940 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.579950094 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.579997063 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.610121012 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.610135078 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.610162020 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.610173941 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.610177040 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.610194921 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.610202074 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.610212088 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.610224962 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.610229969 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.610234976 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.610253096 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.610265970 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.610287905 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.610320091 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.610337019 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.610358000 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.610414028 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.610429049 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.610444069 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.610459089 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.610460997 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.610469103 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.610488892 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.610497952 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.610549927 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.610564947 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.610579014 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.610596895 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.610621929 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.612637997 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.612653971 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.612669945 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.612687111 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.612700939 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.612719059 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.612720013 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.612742901 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.612775087 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.612787962 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.612818956 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.612833977 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.612868071 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.612878084 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.617904902 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.617921114 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.617935896 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.617958069 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.617969990 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.618016958 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.618036032 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.618052006 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.618062973 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.618067980 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.618092060 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.618113041 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.629982948 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.630034924 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.630049944 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.630068064 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.630079985 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.630111933 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.630126953 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.630141973 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.630168915 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.630178928 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.630212069 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.630243063 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.630263090 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.630275011 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.647438049 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.647490025 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.647504091 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.647516966 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.647530079 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.647530079 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.647547960 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.647556067 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.647562981 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.647573948 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.647593975 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.647613049 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.648844957 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.648861885 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.648901939 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.650181055 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.650229931 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.650243044 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.650259018 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.650290012 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.650300980 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.650341988 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.650357008 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.650372028 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.650382996 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.650388956 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.650410891 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.650415897 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.650434017 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.651876926 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.651926994 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.651932955 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.651942968 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.651977062 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.652014971 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.652029991 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.652045965 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.652060986 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.652061939 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.652092934 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.652113914 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.652168036 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.652220011 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.653021097 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.653037071 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.653052092 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.653069019 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.653070927 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.653081894 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.653085947 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.653104067 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.653131008 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.653157949 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.653177023 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.653192997 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.653222084 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.653243065 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.653997898 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.654051065 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.654057026 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.654073000 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.654103994 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.654117107 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.654119968 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.654134035 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.654162884 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.654174089 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.654203892 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.654220104 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.654253006 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.654264927 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.656033993 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.656061888 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.656076908 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.656083107 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.656104088 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.656110048 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.656151056 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.656166077 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.656181097 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.656193018 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.656197071 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.656210899 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.656227112 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.656235933 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.656265020 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.656625986 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.656675100 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.656680107 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.656696081 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.656709909 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.656724930 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.656727076 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.656734943 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.656749964 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.656761885 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.656764984 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.656780958 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.656811953 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.656819105 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.656847954 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.656893969 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.656899929 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.656940937 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.661287069 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.661335945 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.661350012 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.661360979 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.661365032 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.661371946 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.661384106 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.661386967 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.661398888 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.661407948 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.661420107 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.661432981 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.661483049 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.661499977 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.661531925 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.663522959 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.663573027 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.663583994 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.663598061 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.663625956 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.663638115 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.663640022 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.663654089 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.663670063 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.663681030 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.663686037 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.663702011 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.663708925 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.663731098 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.663736105 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.663778067 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.668318033 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.668338060 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.668370008 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.668370962 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.668379068 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.668397903 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.668422937 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.668435097 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.668534040 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.668549061 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.668564081 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.668579102 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.668589115 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.668612003 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.668631077 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.672637939 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.672653913 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.672668934 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.672692060 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.672705889 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.672732115 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.672751904 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.672766924 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.672777891 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.672782898 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.672796965 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.672811985 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.672823906 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.702780962 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.702795029 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.702821016 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.702838898 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.702840090 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.702853918 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.702866077 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.702871084 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.702888966 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.702898979 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.702917099 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.702956915 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.702972889 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.703001022 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.703013897 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.703177929 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.703191042 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.703208923 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.703227997 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.703234911 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.703249931 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.703263998 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.703270912 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.703270912 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.703279018 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.703286886 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.703296900 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.703320980 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.703350067 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.706043005 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.706058025 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.706072092 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.706096888 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.706120014 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.706193924 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.706208944 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.706224918 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.706244946 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.706254959 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.706273079 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.706276894 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.706320047 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.710619926 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.710633993 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.710649967 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.710669994 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.710681915 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.710695982 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.710715055 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.710730076 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.710743904 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.710758924 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.710772991 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.710793018 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.710814953 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.722883940 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.722898960 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.722914934 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.722939014 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.722970963 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.722984076 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.723001003 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.723016024 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.723031044 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.723033905 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.723052025 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.723076105 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.740605116 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.740619898 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.740636110 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.740660906 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.740678072 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.740678072 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.740679979 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.740720034 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.740727901 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.740742922 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.740756989 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.740777969 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.740802050 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.741064072 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.741348982 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.743124962 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.743175030 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.743191004 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.743223906 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.743243933 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.743277073 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.743293047 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.743308067 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.743323088 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.743324995 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.743335962 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.743350029 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.743370056 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.744972944 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.744988918 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.745002985 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.745019913 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.745047092 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.745095968 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.745110989 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.745126009 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.745132923 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.745141983 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.745155096 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.745178938 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.745192051 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.745801926 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.745835066 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.745850086 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.745852947 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.745877028 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.745886087 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.745913982 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.745929956 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.745944977 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.745964050 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.745985985 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.746002913 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.746048927 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.746812105 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.746828079 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.746841908 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.746860981 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.746870995 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.746889114 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.746893883 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.746908903 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.746925116 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.746947050 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.746948957 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.746973038 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.746982098 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.746995926 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.747029066 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.748790026 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.748804092 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.748819113 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.748842001 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.748843908 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.748862982 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.748866081 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.748882055 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.748884916 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.748905897 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.748923063 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.749001980 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.749047995 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.749145031 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.749191999 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.749330997 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.749357939 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.749371052 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.749377966 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.749397993 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.749403954 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.749406099 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.749445915 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.749460936 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.749488115 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.749509096 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.749541998 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.749557018 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.749599934 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.754059076 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.754080057 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.754112959 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.754133940 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.754138947 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.754154921 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.754168987 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.754188061 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.754194975 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.754199982 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.754211903 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.754214048 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.754242897 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.754266024 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.754270077 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.754350901 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.756320000 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.756334066 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.756347895 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.756371975 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.756392956 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.756403923 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.756418943 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.756434917 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.756448984 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.756459951 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.756477118 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.756608009 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.756623983 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.756671906 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.761358976 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.761374950 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.761389971 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.761456966 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.761471987 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.761483908 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.761487961 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.761509895 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.761543989 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.761558056 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.761570930 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.761615038 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.765279055 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.765377998 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.765450954 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.765480995 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.765496016 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.765511036 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.765513897 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.765527010 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.765530109 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.765542984 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.765546083 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.765558958 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.765569925 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.765597105 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.795578957 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.795608044 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.795623064 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.795681953 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.795702934 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.795738935 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.795754910 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.795768976 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.795784950 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.795798063 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.795864105 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.795874119 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.795914888 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.795926094 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.795979023 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.795995951 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.796041012 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.796078920 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.796094894 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.796109915 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.796120882 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.796122074 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.796127081 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.796133041 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.796154022 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.796183109 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.799067020 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.799083948 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.799098969 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.799143076 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.799170017 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.799175978 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.799185991 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.799202919 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.799211979 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.799220085 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.799243927 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.799273014 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.803150892 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.803364038 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.803392887 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.803406954 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.803432941 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.803457975 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.803484917 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.803499937 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.803514957 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.803530931 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.803565025 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.803576946 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.803673983 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.807147026 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.815601110 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.815629005 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.815644979 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.815660000 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.815675974 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.815706015 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.815726995 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.815742016 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.815742970 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.815768957 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.815789938 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.834357023 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.834372997 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.834388971 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.834450006 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.834558964 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.834574938 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.834589005 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.834604979 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.834610939 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.834636927 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.834659100 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.836061001 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.836128950 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.836143970 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.836184978 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.836208105 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.836251020 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.836273909 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.836291075 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.836323023 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.836340904 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.836519003 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.838004112 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.838052988 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.838068008 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.838078976 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.838115931 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.838133097 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.838149071 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.838164091 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.838179111 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.838181019 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.838207960 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.838233948 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.839128017 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.839159966 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.839174032 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.839216948 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.839241982 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.839262009 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.839277983 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.839292049 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.839307070 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.839327097 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.839350939 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.839967012 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.840009928 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.840018034 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.840027094 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.840053082 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.840063095 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.840220928 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.840251923 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.840264082 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.840267897 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.840285063 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.840291023 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.840312004 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.840322018 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.842114925 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.842150927 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.842165947 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.842199087 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.842223883 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.842293024 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.842355967 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.842371941 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.842386007 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.842401028 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.842415094 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.842427015 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.842438936 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.842442036 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.842466116 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.842482090 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.842482090 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.842499971 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.842508078 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.842530966 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.842539072 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.842587948 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.842623949 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.847207069 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.847222090 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.847238064 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.847273111 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.847291946 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.847332954 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.847347975 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.847363949 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.847382069 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.847390890 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.847419024 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.849217892 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.849232912 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.849247932 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.849278927 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.849292040 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.849296093 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.849338055 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.849353075 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.849368095 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.849380970 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.849407911 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.854111910 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.854139090 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.854154110 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.854195118 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.854207039 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.854283094 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.854298115 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.854346037 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.854363918 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.854379892 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.854410887 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.854432106 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.857991934 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.858017921 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.858033895 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.858068943 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.858086109 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.858221054 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.858236074 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.858251095 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.858266115 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.858280897 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.858283043 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.858304977 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.858325958 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.888499022 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.888526917 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.888542891 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.888555050 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.888566971 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.888587952 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.888611078 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.888626099 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.888659000 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.888664961 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.888686895 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.888703108 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.888739109 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.888750076 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.888787031 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.888802052 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.888809919 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.888823986 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.888839960 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.888874054 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.889070034 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.889086008 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.889103889 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.889117002 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.889136076 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.889148951 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.892061949 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.892079115 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.892093897 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.892118931 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.892143965 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.892222881 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.892239094 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.892255068 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.892271042 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.892273903 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.892287970 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.892297029 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.892319918 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.892343044 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.896291018 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.896338940 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.896343946 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.896354914 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.896384954 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.896395922 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.896423101 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.896437883 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.896452904 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.896470070 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.896490097 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.896507978 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.908273935 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.908324003 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.908334017 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.908341885 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.908364058 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.908384085 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.908435106 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.908449888 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.908463955 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.908478975 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.908503056 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.908510923 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.908521891 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.908545971 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.926994085 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.927011013 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.927026987 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.927072048 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.927093029 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.927103043 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.927119017 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.927133083 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.927150011 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.927160978 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.927182913 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.927205086 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.929442883 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.929459095 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.929472923 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.929506063 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.929531097 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.929534912 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.929550886 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.929565907 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.929578066 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.929589987 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.929606915 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.929661036 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.929708958 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.930592060 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.930623055 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.930636883 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.930660009 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.930675030 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.930720091 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.930736065 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.930778980 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.930788040 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.930843115 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.930847883 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.930880070 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.930890083 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.930921078 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.931823015 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.931838989 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.931854010 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.931874990 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.931891918 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.931926966 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.931941032 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.931956053 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.931987047 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.932058096 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.932065010 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.932101011 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.935259104 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.935307026 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.935322046 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.935324907 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.935354948 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.935365915 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.935405016 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.935420990 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.935441017 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.935447931 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.935458899 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.935462952 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.935486078 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.935497999 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.935556889 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.935574055 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.935589075 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.935606956 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.935622931 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.935636997 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.935667992 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.935699940 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.935719013 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.935744047 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.935770035 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.935861111 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.935875893 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.935889959 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.935905933 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.935920954 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.935923100 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.935936928 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.935949087 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.935952902 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.935970068 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.936001062 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.939934015 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.939949989 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.939968109 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.939984083 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.940007925 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.940009117 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.940025091 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.940037966 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.940042019 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.940045118 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.940078974 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.940078974 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.942390919 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.942408085 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.942424059 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.942449093 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.942456961 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.942466021 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.942478895 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.942482948 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.942501068 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.942503929 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.942529917 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.942548990 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.946918964 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.946935892 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.946950912 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.946968079 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.946974039 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.946984053 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.946997881 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.947030067 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.947072983 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.947088957 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.947122097 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.951278925 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.951328039 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.951337099 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.951344013 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.951369047 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.951384068 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.951467037 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.951483011 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.951498032 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.951523066 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.951560020 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.951608896 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.951651096 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.981183052 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.981210947 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.981224060 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.981237888 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.981265068 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.981276035 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.981292009 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.981314898 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.981339931 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.981379986 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.981399059 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.981414080 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.981427908 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.981437922 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.981451988 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.981534004 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.981549978 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.981564999 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.981575966 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.981580973 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.981596947 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.981622934 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.981664896 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.981681108 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.981695890 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.981712103 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.981726885 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.981735945 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.981765032 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.984807014 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.984822035 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.984837055 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.984859943 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.984873056 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.984904051 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.984919071 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.984932899 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.984946012 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.984950066 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.984966040 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.984966040 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.984994888 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.985009909 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.989181042 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.989206076 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.989222050 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.989237070 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.989255905 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.989259005 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.989274979 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.989290953 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.989300013 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.989309072 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:13.989330053 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:13.989346981 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.001378059 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.001394987 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.001410007 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.001430035 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.001435995 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.001451969 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.001451969 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.001467943 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.001475096 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.001483917 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.001501083 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.001512051 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.001530886 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.001610041 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.001671076 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.019823074 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.019850969 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.019874096 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.019876003 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.019887924 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.019892931 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.019910097 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.019917965 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.019926071 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.019937038 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.019942045 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.019954920 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.019958019 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.019967079 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.019987106 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.019993067 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.022245884 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.022272110 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.022294998 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.022321939 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.022356987 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.022372961 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.022387981 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.022423029 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.022434950 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.022464037 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.022480011 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.022504091 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.022522926 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.023648024 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.023674965 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.023694038 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.023701906 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.023720026 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.023729086 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.095752954 CEST	49738	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.096271992 CEST	49740	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.101005077 CEST	9000	49738	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.101046085 CEST	9000	49740	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.101058960 CEST	49738	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.101119995 CEST	49740	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.101358891 CEST	49740	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.106085062 CEST	9000	49740	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.756747007 CEST	9000	49740	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.756814957 CEST	49740	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.757179976 CEST	49740	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.759783030 CEST	49740	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.759830952 CEST	49740	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:14.761996031 CEST	9000	49740	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.764740944 CEST	9000	49740	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.764755011 CEST	9000	49740	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.764777899 CEST	9000	49740	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.764791012 CEST	9000	49740	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:14.764802933 CEST	9000	49740	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:15.261215925 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:15.262058020 CEST	49742	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:15.266593933 CEST	9000	49739	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:15.266674995 CEST	49739	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:15.267421961 CEST	9000	49742	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:15.267519951 CEST	49742	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:15.268600941 CEST	49742	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:15.273406029 CEST	9000	49742	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:15.381690025 CEST	9000	49740	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:15.381841898 CEST	49740	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:15.915311098 CEST	9000	49742	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:15.915529966 CEST	49742	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:15.916507959 CEST	49742	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:15.918154955 CEST	49742	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:15.918304920 CEST	49742	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:15.921253920 CEST	9000	49742	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:15.922960997 CEST	9000	49742	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:15.923089981 CEST	9000	49742	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:15.923199892 CEST	9000	49742	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:16.304888010 CEST	49740	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:16.305341005 CEST	49746	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:16.309973955 CEST	9000	49740	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:16.310041904 CEST	49740	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:16.310117006 CEST	9000	49746	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:16.310178995 CEST	49746	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:16.310412884 CEST	49746	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:16.315146923 CEST	9000	49746	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:16.627547026 CEST	9000	49742	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:16.629265070 CEST	49742	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:16.960505962 CEST	9000	49746	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:16.960588932 CEST	49746	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:16.961000919 CEST	49746	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:16.965723038 CEST	9000	49746	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:17.173235893 CEST	49746	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:17.178066015 CEST	9000	49746	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:17.447875023 CEST	49742	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:17.448240042 CEST	49748	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:17.453097105 CEST	9000	49748	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:17.453193903 CEST	49748	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:17.453361988 CEST	49748	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:17.453427076 CEST	9000	49742	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:17.453484058 CEST	49742	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:17.458060980 CEST	9000	49748	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:17.813400030 CEST	9000	49746	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:17.813488960 CEST	49746	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:18.120338917 CEST	9000	49748	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:18.120398045 CEST	49748	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:18.120728970 CEST	49748	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:18.125507116 CEST	9000	49748	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:18.192358971 CEST	49748	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:18.200508118 CEST	9000	49748	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:18.542844057 CEST	49746	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:18.543474913 CEST	49750	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:18.547943115 CEST	9000	49746	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:18.548316956 CEST	9000	49750	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:18.548381090 CEST	49746	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:18.548424006 CEST	49750	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:18.548659086 CEST	49750	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:18.553426027 CEST	9000	49750	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:18.872060061 CEST	9000	49748	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:18.872119904 CEST	49748	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:19.208962917 CEST	9000	49750	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:19.209069014 CEST	49750	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:19.209372997 CEST	49750	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:19.214168072 CEST	9000	49750	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:19.214363098 CEST	49750	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:19.219542980 CEST	9000	49750	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:19.219603062 CEST	49750	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:19.271799088 CEST	49751	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:19.276598930 CEST	9000	49751	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:19.276675940 CEST	49751	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:19.276869059 CEST	49751	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:19.281596899 CEST	9000	49751	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:19.937246084 CEST	9000	49751	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:19.937496901 CEST	49751	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:19.937792063 CEST	49751	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:19.939446926 CEST	49751	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:19.941597939 CEST	49752	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:19.943504095 CEST	9000	49751	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:19.944447994 CEST	9000	49751	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:19.944518089 CEST	49751	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:19.946726084 CEST	9000	49752	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:19.946819067 CEST	49752	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:19.947022915 CEST	49752	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:19.951888084 CEST	9000	49752	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:20.608787060 CEST	9000	49752	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:20.608855963 CEST	49752	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:20.609172106 CEST	49752	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:20.610860109 CEST	49752	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:20.612339020 CEST	49753	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:20.613948107 CEST	9000	49752	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:20.616164923 CEST	9000	49752	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:20.616206884 CEST	49752	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:20.617165089 CEST	9000	49753	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:20.617234945 CEST	49753	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:20.617491961 CEST	49753	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:20.622200012 CEST	9000	49753	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:21.332870007 CEST	9000	49753	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:21.333048105 CEST	49753	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:21.333379030 CEST	49753	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:21.335129976 CEST	49753	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:21.336931944 CEST	49754	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:21.338099957 CEST	9000	49753	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:21.340090990 CEST	9000	49753	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:21.340146065 CEST	49753	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:21.341787100 CEST	9000	49754	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:21.341881037 CEST	49754	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:21.342086077 CEST	49754	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:21.346977949 CEST	9000	49754	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:21.991122007 CEST	9000	49754	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:21.991195917 CEST	49754	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:21.991520882 CEST	49754	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:21.993071079 CEST	49754	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:21.994864941 CEST	49755	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:21.996247053 CEST	9000	49754	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:21.998127937 CEST	9000	49754	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:21.998184919 CEST	49754	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:22.000072956 CEST	9000	49755	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:22.000142097 CEST	49755	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:22.000348091 CEST	49755	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:22.005146980 CEST	9000	49755	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:22.650186062 CEST	9000	49755	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:22.650254965 CEST	49755	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:22.652055025 CEST	49755	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:22.657960892 CEST	9000	49755	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:22.662259102 CEST	49755	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:44:22.668709040 CEST	9000	49755	195.201.251.214	192.168.2.4
Jun 29, 2024 01:44:22.668773890 CEST	49755	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:45:28.873023033 CEST	9000	49748	195.201.251.214	192.168.2.4
Jun 29, 2024 01:45:28.873162031 CEST	9000	49748	195.201.251.214	192.168.2.4
Jun 29, 2024 01:45:28.873205900 CEST	49748	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:45:28.873315096 CEST	49748	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:45:50.135163069 CEST	49748	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:45:50.135214090 CEST	49748	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 01:45:50.139971972 CEST	9000	49748	195.201.251.214	192.168.2.4
Jun 29, 2024 01:45:50.140036106 CEST	49748	9000	192.168.2.4	195.201.251.214

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 29, 2024 01:44:00.167197943 CEST	59403	53	192.168.2.4	1.1.1.1
Jun 29, 2024 01:44:00.173998117 CEST	53	59403	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 29, 2024 01:44:00.167197943 CEST	192.168.2.4	1.1.1.1	0xf802	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jun 29, 2024 01:44:00.173998117 CEST	1.1.1.1	192.168.2.4	0xf802	No error (0)	t.me	149.154.167.99	A (IP address)	IN (0x0001)	false
Jun 29, 2024 01:44:01.842216015 CEST	1.1.1.1	192.168.2.4	0x6eda	No error (0)	windowsupdatebg.s.llnwi.net	178.79.238.0	A (IP address)	IN (0x0001)	false
Jun 29, 2024 01:44:01.842216015 CEST	1.1.1.1	192.168.2.4	0x6eda	No error (0)	windowsupdatebg.s.llnwi.net	178.79.238.128	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

t.me

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	149.154.167.99	443	6332	C:\Users\user\AppData\Local\Temp\kat6899.tmp

Timestamp	Bytes transferred	Direction	Data
2024-06-28 23:44:00 UTC	84	OUT	GET /g067n HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-06-28 23:44:01 UTC	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 28 Jun 2024 23:44:00 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12310 Connection: close Set-Cookie: stel_ssid=d4465ef7a3c90bc955_2306776722752321718; expires=Sat, 29 Jun 2024 23:44:00 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-06-28 23:44:01 UTC	12310	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 67 30 36 37 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 2e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @g067n</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.parent.

Target ID:	0
Start time:	19:43:54
Start date:	28/06/2024
Path:	C:\Users\user\Desktop\5IRIk4f1PO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5IRIk4f1PO.exe"
Imagebase:	0x400000
File size:	2'288'128 bytes
MD5 hash:	9F3205479A5FF3ACD9EAFDB8EAA629E9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Crypt, Description: Yara detected CryptOne packer, Source: 00000000.00000002.1652012877.0000000002ADB000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1651789610.0000000002420000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1652197583.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.1652012877.00000000029D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	19:43:55
Start date:	28/06/2024
Path:	C:\Users\user\AppData\Local\Temp\kat6899.tmp
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\kat6899.tmp
Imagebase:	0x400000
File size:	881'664 bytes
MD5 hash:	66064DBDB70A5EB15EBF3BF65ABA254B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000002.2912988617.0000000000445000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 4%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	50.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	64.1%
Total number of Nodes:	39
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02ADBEF0 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 317
threadmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,?,00003000,00000004), ref: 02ADBF61
GetTempFileNameA.KERNELBASE(?,kate,00000000,?), ref: 02ADC114
CreateFileA.KERNELBASE(?,00000003,00000000,00000000,00000004,00000002,00000000), ref: 02ADC142
WriteFile.KERNELBASE(00000000,?,000D7400,00000000,00000000), ref: 02ADC16C
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,00000000,00000000), ref: 02ADC1B6
NtUnmapViewOfSection.NTDLL(00000000,00400000), ref: 02ADC1D0
VirtualAllocEx.KERNELBASE(00000000,00400000,?,00003000,00000040), ref: 02ADC1FB
WriteProcessMemory.KERNELBASE(00000000,00400000,00000000,?,00000000), ref: 02ADC21F
WriteProcessMemory.KERNELBASE(00000000,00000000,00000000,00000000,00000000), ref: 02ADC281
Wow64GetThreadContext.KERNEL32(?,00010002), ref: 02ADC2AF
Wow64SetThreadContext.KERNEL32(?,00010002), ref: 02ADC2DA
ResumeThread.KERNELBASE(?), ref: 02ADC2EC
ExitProcess.KERNEL32(00000000), ref: 02ADC2F9

Strings

kate, xrefs: 02ADC100, 02ADC103

Memory Dump Source

Source File: 00000000.00000002.1652012877.0000000002ADB000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ADB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2adb000_5IRIk4f1PO.jbxd

Yara matches

Similarity

API ID: Process$FileMemoryThreadWrite$ContextCreateVirtualWow64$AllocAllocateExitNameResumeSectionTempUnmapView
String ID: kate
API String ID: 1984375786-4076676908
Opcode ID: 8bdce1911b773aa4c5a77b11a59fe6ead0f340a8c12956d4af66eaabf161a0bb
Instruction ID: 06e38b2d74e3d549259a5a6163e8e771abe4a8f0e2cb9554e23a4b77d8b21d68
Opcode Fuzzy Hash: 8bdce1911b773aa4c5a77b11a59fe6ead0f340a8c12956d4af66eaabf161a0bb
Instruction Fuzzy Hash: E8E1DA75A00208AFDB54CF84C895FEEB7B5BF88314F108199E609AB391D771AE85CF94

Function 02ADB250 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02ADB9B0: VirtualAlloc.KERNELBASE(00000000,02ADB30F,00003000,00000040), ref: 02ADBA34

NtCreateFile.NTDLL(00000000,00120089,00000018,?,00000000,00000080,00000001,00000001,00000040,00000000,00000000), ref: 02ADB41B
FindCloseChangeNotification.KERNELBASE(00000000), ref: 02ADB4CC

Strings

@, xrefs: 02ADB39D

Memory Dump Source

Source File: 00000000.00000002.1652012877.0000000002ADB000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ADB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2adb000_5IRIk4f1PO.jbxd

Yara matches

Similarity

API ID: AllocChangeCloseCreateFileFindNotificationVirtual
String ID: @
API String ID: 482251274-2766056989
Opcode ID: 1eb9ea2caabc7391b7229261c1d9bf95df83910e65e6df0dd8a40b88344f7981
Instruction ID: 7896311300c58dd89638da6f1cca1d19a2211d20752fd330360b540f3bc198e0
Opcode Fuzzy Hash: 1eb9ea2caabc7391b7229261c1d9bf95df83910e65e6df0dd8a40b88344f7981
Instruction Fuzzy Hash: C281FD71A40218EFDB24DF54CC95FDAB3B5AF48704F1485A9EA09AB290DB706A84CF94

Function 02ADB510 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

.tex, xrefs: 02ADB5D4

Memory Dump Source

Source File: 00000000.00000002.1652012877.0000000002ADB000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ADB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2adb000_5IRIk4f1PO.jbxd

Yara matches

Similarity

API ID:
String ID: .tex
API String ID: 0-1946526065
Opcode ID: 86473fe90031cc0144bf05fc695b61ac0536840d3e25b293d5c37be5d6457d6f
Instruction ID: 3d2d6def2a709f5200f84fd5d542b5876392225d02d769436237cfbaad3d3efe
Opcode Fuzzy Hash: 86473fe90031cc0144bf05fc695b61ac0536840d3e25b293d5c37be5d6457d6f
Instruction Fuzzy Hash: CD5107B4D00109EFCF04CF84C894BEEFBB5FB48318F258559D516AB280D735AA85CBA0

Function 02ADB9B0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 46
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,02ADB30F,00003000,00000040), ref: 02ADBA34

Strings

VirtualAlloc, xrefs: 02ADBA19, 02ADBA1C

Memory Dump Source

Source File: 00000000.00000002.1652012877.0000000002ADB000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ADB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2adb000_5IRIk4f1PO.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: VirtualAlloc
API String ID: 4275171209-164498762
Opcode ID: c42a450ca02fa363a87eb9b6114333d3fd783ad335b2bc0464273431a807ed53
Instruction ID: 56411c5216e63e197e6da460323f13f85c2fc25168e91842ce90eb5b17823c80
Opcode Fuzzy Hash: c42a450ca02fa363a87eb9b6114333d3fd783ad335b2bc0464273431a807ed53
Instruction Fuzzy Hash: B6113D60D082CDEEEF01DBE88409BEEBFB55F11708F044098D5856A282D6BA57588BB6

Non-executed Functions

Function 02ADC510 Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1652012877.0000000002ADB000.00000040.00001000.00020000.00000000.sdmp, Offset: 02ADB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2adb000_5IRIk4f1PO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a568a7dc076fac4237d36aa73511bb81ae5ea1128cbd7157671a2a4345687388
Instruction ID: 57db17d1c43ea8c6e882c49407a7bd31ce2f87072222303adbd4113acaf9a7d1
Opcode Fuzzy Hash: a568a7dc076fac4237d36aa73511bb81ae5ea1128cbd7157671a2a4345687388
Instruction Fuzzy Hash: 19419171D1051C9BDF48CFADC991AEEBBF2AF88201F948299D516AB345D730AB41DB80

Analysis Process: kat6899.tmpPID: 6332, Parent PID: 6328COMMON

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	14
Total number of Limit Nodes:	5

Executed Functions

Function 20104CF0 Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 461
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,-00000003,04000102,00000000), ref: 20104EE1

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 20104FB5
winOpen, xrefs: 20105110
psow, xrefs: 201051F5
exclusive, xrefs: 20104E81

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID: CreateFile
String ID: delayed %dms for lock/sharing conflict at line %d$exclusive$psow$winOpen
API String ID: 823142352-3829269058
Opcode ID: 9d5a0d3157c918bd3bf6ad049a57775d690ef638b8cdba467a451ecad5475b2e
Instruction ID: 2513e3ae7ec8157cd93ea7bbe78ed28444a6db9ea525de3e48c943b2587fa177
Opcode Fuzzy Hash: 9d5a0d3157c918bd3bf6ad049a57775d690ef638b8cdba467a451ecad5475b2e
Instruction Fuzzy Hash: 79F1B2B1A087019FD7158FA8DDC6B5B77E9BF84304F000929FE85C62A1D739DA48DB92

Function 200FFD40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 134
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32(?,?,?,?,?), ref: 200FFE03

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 200FFE78
winRead, xrefs: 200FFE3D

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID: FileRead
String ID: delayed %dms for lock/sharing conflict at line %d$winRead
API String ID: 2738559852-1843600136
Opcode ID: 848660248580ee949e2bf746b9e78dbb032c9ae4a78ba75d1ba92454973dea2f
Instruction ID: e1430d87fba4395c520503b609ea12f19c372b3efe55597a62c47fab8f22edf0
Opcode Fuzzy Hash: 848660248580ee949e2bf746b9e78dbb032c9ae4a78ba75d1ba92454973dea2f
Instruction Fuzzy Hash: C0412B726043096BD300DFA4CD89A6BB7E9FF84214F88093DF544C7651EB35ED189BA2

Function 201204D0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

failed to allocate %u bytes of memory, xrefs: 201204E7

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: failed to allocate %u bytes of memory
API String ID: 0-1168259600
Opcode ID: 0506c84e566a7442c57d5a4f69b18622c5e2ad930a1acb0d9647de14488666fc
Instruction ID: 4330b4a851afc4b74315f986e5692116fe1d8dfbf6549875b5bc893750d16239
Opcode Fuzzy Hash: 0506c84e566a7442c57d5a4f69b18622c5e2ad930a1acb0d9647de14488666fc
Instruction Fuzzy Hash: 2BD02222D8863123D22221C0BC0ABCA3D416BA01A0F054034FD4C19226DA218E9093C2

Non-executed Functions

Function 20230480 Relevance: 30.2, APIs: 8, Strings: 9, Instructions: 476COMMON

Download Yara Rule

Strings

no such vfs: %s, xrefs: 2023099A
mode, xrefs: 20230867
lhos, xrefs: 202305A1
loca, xrefs: 20230598
file, xrefs: 202304DA
%s mode not allowed: %s, xrefs: 202309EC
cach, xrefs: 2023082B
no such %s mode: %s, xrefs: 20230922
invalid uri authority: %.*s, xrefs: 202305C2

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s mode not allowed: %s$cach$file$invalid uri authority: %.*s$lhos$loca$mode$no such %s mode: %s$no such vfs: %s
API String ID: 0-1127695371
Opcode ID: 28a33d8e5a900e0582a095d4257fc4de1a44fcb809acbf4c1cf221a2a6a3c15e
Instruction ID: 3cb741584ae51d760b83dabd4ed8b74900c2751d94aef9058c035d06e311d2e6
Opcode Fuzzy Hash: 28a33d8e5a900e0582a095d4257fc4de1a44fcb809acbf4c1cf221a2a6a3c15e
Instruction Fuzzy Hash: 8EF145F0D083424FE7118F94C8F075ABBE2AF86714F54065EE9D40B243D776AA65CB62

Function 20118680 Relevance: 28.6, APIs: 9, Strings: 7, Instructions: 550COMMON

Download Yara Rule

Strings

parse error in rank function: %s, xrefs: 201197FF
recursively defined fts5 content table, xrefs: 201186C5
, xrefs: 20119848
%s: table does not support scanning, xrefs: 20119979
DESC, xrefs: 201198C2, 201198D6
ASC, xrefs: 201198BA
SELECT rowid, rank FROM %Q.%Q ORDER BY %s("%w"%s%s) %s, xrefs: 201198F1

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: $%s: table does not support scanning$ASC$DESC$SELECT rowid, rank FROM %Q.%Q ORDER BY %s("%w"%s%s) %s$parse error in rank function: %s$recursively defined fts5 content table
API String ID: 0-2381147695
Opcode ID: 6674cac9e69cb01fdbaa3f881f248a7f4db24ab5052b31b5ca5688d557e60ef9
Instruction ID: ca6127dced3d5f94fef831c0fd5e00439b9100e10393e9afeb75748919044544
Opcode Fuzzy Hash: 6674cac9e69cb01fdbaa3f881f248a7f4db24ab5052b31b5ca5688d557e60ef9
Instruction Fuzzy Hash: EE221DB1904700CFCB09CFA4C881BAABBF5BF48304F04453AF9659B255E739EA85CB91

Function 2021D9E0 Relevance: 23.3, APIs: 8, Strings: 5, Instructions: 564COMMON

Download Yara Rule

Strings

API called with finalized prepared statement, xrefs: 2021DAB0, 2021DE13
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2021DACC, 2021DE2F
misuse, xrefs: 2021DAD6, 2021DE39
%s at line %d of [%.10s], xrefs: 2021DADB, 2021DE3E
API called with NULL prepared statement, xrefs: 2021DA9B, 2021DDFE

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-860711957
Opcode ID: 931d9f3c9717782779c6f67a578bb944352380b33ba22cefbde622677bda98c3
Instruction ID: 0dc4bc4f5d108b9aa8989b1a803b7025631333ddbfd57bf8408a179dc640b4da
Opcode Fuzzy Hash: 931d9f3c9717782779c6f67a578bb944352380b33ba22cefbde622677bda98c3
Instruction Fuzzy Hash: 891207B1904701DBE7208FA4CC45B47B7E4FF55308F04092EF99A96243E775EAA9CB92

Function 201066C0 Relevance: 23.2, APIs: 12, Strings: 1, Instructions: 416COMMON

Download Yara Rule

Strings

_shape does not contain a valid polygon, xrefs: 20106816

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: _shape does not contain a valid polygon
API String ID: 0-1814939628
Opcode ID: 1a999f39dcb19b1e53009db04912203375310929d6ceb494fe06eac2514fe293
Instruction ID: 4a4a49c7eaea055cfc36ee8985c69227378abe847ed424a41bc5b5e7fb46ceb6
Opcode Fuzzy Hash: 1a999f39dcb19b1e53009db04912203375310929d6ceb494fe06eac2514fe293
Instruction Fuzzy Hash: 3AE1BDB19083149FC311DFA4C881A5BBBEAAF98314F04492DFDD997212E735DE45CB92

Function 2011B400 Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 367COMMON

Download Yara Rule

Strings

SELECT %s ORDER BY rowid %s, xrefs: 2011B665
DESC, xrefs: 2011B656, 2011B65E, 2011B67D, 2011B685
SELECT %s WHERE rowid BETWEEN %lld AND %lld ORDER BY rowid %s, xrefs: 2011B696
ASC, xrefs: 2011B651, 2011B678

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: ASC$DESC$SELECT %s ORDER BY rowid %s$SELECT %s WHERE rowid BETWEEN %lld AND %lld ORDER BY rowid %s
API String ID: 0-3496276579
Opcode ID: 33fa9425ecba5ba95c787e82057c96c4603795b75af9a7c7a9fc94dd08ad1b2c
Instruction ID: 12a34ce2443c2978effe2239fe93cca59f9f11101cfd08b3fbc60210fcd18c38
Opcode Fuzzy Hash: 33fa9425ecba5ba95c787e82057c96c4603795b75af9a7c7a9fc94dd08ad1b2c
Instruction Fuzzy Hash: D9C133715007049BD7158FA8D8817A7F7F1FF98310F14493EE8858A682E73AEB99CB91

Function 2016DB10 Relevance: 18.3, APIs: 12, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cce94ec81c653b7f442026fa29fb6957133eed4063784fa69eed1edff44bf9f
Instruction ID: 0f9689e946075df1fd72628bd3b626379a1d5c7a314888c3beb32d8141f2c97c
Opcode Fuzzy Hash: 8cce94ec81c653b7f442026fa29fb6957133eed4063784fa69eed1edff44bf9f
Instruction Fuzzy Hash: DE81D471A04305ABE310DFA9CC81B6BB3E9EF94314F44082CF945D7251EA75EA25CB92

Function 202114D0 Relevance: 17.9, APIs: 4, Strings: 6, Instructions: 360COMMON

Download Yara Rule

Strings

API called with finalized prepared statement, xrefs: 20211586
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 202115A2
misuse, xrefs: 202115AC
%s at line %d of [%.10s], xrefs: 202115B1
API called with NULL prepared statement, xrefs: 20211571
o:! , xrefs: 202114D5

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$o:!
API String ID: 0-1525868299
Opcode ID: 1cf4e959451d9b93a6e92001b2af6f6b8969e7197fe9459f831b6d5d9207f7b0
Instruction ID: 383fff2181a1edb1641dfca661f191253186b959322968946a2512bbccac628f
Opcode Fuzzy Hash: 1cf4e959451d9b93a6e92001b2af6f6b8969e7197fe9459f831b6d5d9207f7b0
Instruction Fuzzy Hash: 0BC158B09007219BE7208FA4DC45B57F7E9BF50314F04052EE88687383E776E9A9CB92

Function 20120FB0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

e, xrefs: 2012115A

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: e
API String ID: 0-4024072794
Opcode ID: 36bf8875baaf085edaede92fcfbfd96a80b42455c8294c9340591cc07f665f1e
Instruction ID: 1c3cee1954cc1dd5fb35f2d5bfa47eab1894480d041c72618605c0899d5c81d2
Opcode Fuzzy Hash: 36bf8875baaf085edaede92fcfbfd96a80b42455c8294c9340591cc07f665f1e
Instruction Fuzzy Hash: 225156722043519FE715CF68EC84BA7B7E0FFA5211F10056EF88186152EB32EE54DBA1

Function 2016DFC0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

%lld %lld, xrefs: 2016E055

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %lld %lld
API String ID: 0-3794783949
Opcode ID: c24307fc8750d0478854ed59848f8ef9bbfa4fe68b033df9cccb0e9cc274fd86
Instruction ID: c3dd20c715d1f8f9bc1f3cb4f9c91cce4c09b09a486376f9bc1b72f7efef453f
Opcode Fuzzy Hash: c24307fc8750d0478854ed59848f8ef9bbfa4fe68b033df9cccb0e9cc274fd86
Instruction Fuzzy Hash: 9C3107716046007BE7115BE88C0AF9BB7FEEFD5710F104518F64192292EBB6DE219BA2

Function 2021D4F0 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 310COMMON

Download Yara Rule

Strings

API called with finalized prepared statement, xrefs: 2021D5C1
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2021D5DD
misuse, xrefs: 2021D5E7
%s at line %d of [%.10s], xrefs: 2021D5EC
API called with NULL prepared statement, xrefs: 2021D5AC

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-860711957
Opcode ID: d755784c81013af9d5e45453599b66b1b680cb6d07a7b640aca1ad8dbd0085b8
Instruction ID: 0673f77732fce9cf45d014dd59c330c09c0bbee7882d088d5ec2d6671d8047b3
Opcode Fuzzy Hash: d755784c81013af9d5e45453599b66b1b680cb6d07a7b640aca1ad8dbd0085b8
Instruction Fuzzy Hash: CFB19FB0904701DBE3118FA4DC85B57F7E4FF54308F04452AE99987283E775E9AACB92

Function 201D4D40 Relevance: 14.0, APIs: 9, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 392cd801773f4e66ed7bc05f705d967df824bdb3888f9afad01e7415e2e1c62d
Instruction ID: 22778f6ca318814eb31acfdb474bf1f27ec8baeeca37b141e0e835968ae52504
Opcode Fuzzy Hash: 392cd801773f4e66ed7bc05f705d967df824bdb3888f9afad01e7415e2e1c62d
Instruction Fuzzy Hash: 95F101B2504B019BD3159FA8CC85A6B77F8FF91314F040628F90582352EB79EB49DBE2

Function 20168200 Relevance: 14.0, APIs: 9, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2f9e895a299bef029413d452215d060dc88f101f4e87a5b0ed7e1d8f6b72eb
Instruction ID: 86d198adfc760377416e55e51bd1e35a47fac4b13543be387222248ed655cf96
Opcode Fuzzy Hash: 6e2f9e895a299bef029413d452215d060dc88f101f4e87a5b0ed7e1d8f6b72eb
Instruction Fuzzy Hash: F402B172904701AFD7118FA4CC80B9BB7E8BF88350F040A29FA4997661D739DE64DF92

Function 201A5940 Relevance: 12.4, APIs: 8, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b49b32d2148dd1e2f9e1c42988690dfe84f887826efdf89ef131623e3c23a090
Instruction ID: 4416162c969e0ea112257d8da93c07bd5238d8ca2046ab10640ca24e9bb7e558
Opcode Fuzzy Hash: b49b32d2148dd1e2f9e1c42988690dfe84f887826efdf89ef131623e3c23a090
Instruction Fuzzy Hash: 05C16B7AE5C3005FE7009A98CC82BDB7795EF92320F98052DF48587257E1299B49D792

Function 201951D0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 141COMMON

Download Yara Rule

Strings

REPLACE INTO '%q'.'%q_data'(id, block) VALUES(?,?), xrefs: 20195264
, xrefs: 20195334

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: $REPLACE INTO '%q'.'%q_data'(id, block) VALUES(?,?)
API String ID: 0-69911113
Opcode ID: 1e23b49e1324d61c2cb73c2ee847c75fdf7205ec47cc74fb6777d92f5fc88609
Instruction ID: a3a3e8d84efa0f8847c8f32e9b88c049839ae6193871ffaee86ec59500b93cbc
Opcode Fuzzy Hash: 1e23b49e1324d61c2cb73c2ee847c75fdf7205ec47cc74fb6777d92f5fc88609
Instruction Fuzzy Hash: C041BEB1904205EFD700DFA9DC80B5AB7E9FF98344F044528F984A7212D771EE50CB92

Function 201CD610 Relevance: 10.6, APIs: 7, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd5a444f62547b55e1c478906cffc6cc5e8d8fd97acf4dcf33dab7dbce9423b
Instruction ID: c1cecb2337af47cf16a43f2228152d8be71a01a781d48df5fde52de8419634ef
Opcode Fuzzy Hash: 8fd5a444f62547b55e1c478906cffc6cc5e8d8fd97acf4dcf33dab7dbce9423b
Instruction Fuzzy Hash: 3641D2B1500701ABDB009FA5CC81B9BB7E8FF65314F00462CF95886251EB71EB15DBA2

Function 20154760 Relevance: 9.4, APIs: 6, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b04e09514c5db73abc55061f83ddd8d3bc159e813d5d4fa123488df69980312e
Instruction ID: 77e14af33cced2403c20aa6ff6fee9b8574a994f3a26b3322ca808121b306592
Opcode Fuzzy Hash: b04e09514c5db73abc55061f83ddd8d3bc159e813d5d4fa123488df69980312e
Instruction Fuzzy Hash: 9AF1C4709097419FD304CFA4C885A5BBBE4FF88308F04492DF9A5EB211E735EA58CB92

Function 20104820 Relevance: 9.3, APIs: 6, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe796770b0d215a50a796f3c5ddb9cf694da876bb18b48b263fc1d030eacbd7d
Instruction ID: 7f1062f8848691deac9001040f1d0d508bf9e84b0d109b02822a5d38acd48b0d
Opcode Fuzzy Hash: fe796770b0d215a50a796f3c5ddb9cf694da876bb18b48b263fc1d030eacbd7d
Instruction Fuzzy Hash: 39B1BFB0904705AFD300CF65C886B5BB7F9BF99304F008A19F99597241E779EA98CF92

Function 20105C70 Relevance: 9.1, APIs: 6, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43830c2c14d87b3ae716c7a1980d3d4f048575f12cac28b556fe9d979f0dcba0
Instruction ID: 1e7a5c9d0eae593a4341dcfb2d6e83a8b3f7826a6375c786118a4aa4abf8bcdd
Opcode Fuzzy Hash: 43830c2c14d87b3ae716c7a1980d3d4f048575f12cac28b556fe9d979f0dcba0
Instruction Fuzzy Hash: 3441F2752043059FEB04DF94C884FA7B7E6FF98310F10446AF98187692EB62EE54DB60

Function 20189090 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcaf65022f84ff58585c758ddc8a46fc1346f6d2d0930389a89cf774c341a33f
Instruction ID: ac47b0cfd8662bd9f2969d55ad7f9b6afe725bea258e0726ffe177036d8b2323
Opcode Fuzzy Hash: dcaf65022f84ff58585c758ddc8a46fc1346f6d2d0930389a89cf774c341a33f
Instruction Fuzzy Hash: 0331D3712002019FE350CFA8D88DEA6B3E5FF44365B1945B9E9428F267DB22EE51DF90

Function 2015E200 Relevance: 9.1, APIs: 6, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c274081494f6a1a728d1213fba23c75bbb8b5e5e50c5d2d9b4b840f39037541
Instruction ID: 855245297be8d46442ee986489c33f7b1c644ce6f219ff2b4e2e7864cc6463e0
Opcode Fuzzy Hash: 9c274081494f6a1a728d1213fba23c75bbb8b5e5e50c5d2d9b4b840f39037541
Instruction Fuzzy Hash: 971136B22053086FE7045AE0EC82FDBB7ECEF68321F10043AF60556141EB76AA1557E1

Function 201406E0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

VUUU, xrefs: 2014083A

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: VUUU
API String ID: 0-2040033107
Opcode ID: ec0a6920fbea2b7ea341b8e173d1b9953de5ec45e9a51519555249f1cb87446a
Instruction ID: 2e9afe791f59559b701296a9baa1c8c8990b7f635ba492774e0cc0639ca76490
Opcode Fuzzy Hash: ec0a6920fbea2b7ea341b8e173d1b9953de5ec45e9a51519555249f1cb87446a
Instruction Fuzzy Hash: D181D5B19043458FD715DFA9C881A6BFBE4FF98201F144A6DF88987252E770EE44CB92

Function 2015E090 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

0:! , xrefs: 2015E0E7

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: 0:!
API String ID: 0-1331851984
Opcode ID: b43d58bf3b8df8cfd904a2d357e4a8ad3cac8a3c6aac4c0ff94576c2e06cc672
Instruction ID: f3d634f14e35756b9533c50875a4484454405fb56a05ba7c510e1beab33183cf
Opcode Fuzzy Hash: b43d58bf3b8df8cfd904a2d357e4a8ad3cac8a3c6aac4c0ff94576c2e06cc672
Instruction Fuzzy Hash: 9631E2716006009FD714CF44EC81BB7BBE5AB89314F05849AF8908F252D736ED9BCB91

Function 20171FE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

REPLACE INTO '%q'.'%q_data'(id, block) VALUES(?,?), xrefs: 20172001

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: REPLACE INTO '%q'.'%q_data'(id, block) VALUES(?,?)
API String ID: 0-914542581
Opcode ID: 450138c81e5a8348aeb39f4fc9b54cfc38f6fb13f6f9111e462e57f0985bc932
Instruction ID: 86c4ed187d52187b40265d60b1696d08836c6a4c07e5939ccf5edc7c8e498fed
Opcode Fuzzy Hash: 450138c81e5a8348aeb39f4fc9b54cfc38f6fb13f6f9111e462e57f0985bc932
Instruction Fuzzy Hash: F921CE71500204AFEB11ABA9DC85F9677BDFF24354F048418F54497222D772EA61CBA1

Function 202E3300 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,00000000,?,?,?,202E3688,?,00000000), ref: 202E3399
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,?,202E3688,?,00000000), ref: 202E33C2
GetACP.KERNEL32(?,?,202E3688,?,00000000), ref: 202E33D7

Strings

OCP, xrefs: 202E3354
ACP, xrefs: 202E331E

Memory Dump Source

Source File: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 4b39938f5993b76c88c6d57e3c1892180c2f1222a5aea45443f06b0893fadb85
Instruction ID: 19a571464d19fcfbf52c3b96af2489fbaf6c8a784ddbe64fba09ac906d0a11f5
Opcode Fuzzy Hash: 4b39938f5993b76c88c6d57e3c1892180c2f1222a5aea45443f06b0893fadb85
Instruction Fuzzy Hash: D6219532784102ABD7118F96CE89E8773A6AF50A62BD644A6E90DD7105EF32FE50D3D0

Function 200F3AA3 Relevance: 7.7, APIs: 5, Instructions: 183COMMON

Download Yara Rule

APIs

GetUserDefaultLCID.KERNEL32 ref: 202E365A
IsValidCodePage.KERNEL32(00000000), ref: 202E3698
IsValidLocale.KERNEL32(?,00000001), ref: 202E36AB
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040), ref: 202E36F3
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 202E370E

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID: Locale$InfoValid$CodeDefaultPageUser
String ID:
API String ID: 3475089800-0
Opcode ID: 4f25f5fca8ed218d7b09191fe9d7d48dc74866bfe7bdd8b3c56b44431af494f0
Instruction ID: ad6841b7f030736c6fe57b543ef24124e7b05bb04c238edc83b45a803b00d93e
Opcode Fuzzy Hash: 4f25f5fca8ed218d7b09191fe9d7d48dc74866bfe7bdd8b3c56b44431af494f0
Instruction Fuzzy Hash: DC5186B194060AAFEB01DFE6CDC9BAE73B8FF54701F90046AE609D7250D774A914DB50

Function 2016A6F0 Relevance: 7.6, APIs: 5, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ee22e84bb74fc748aa13dd12083fbe46cfefc5cafaddd145f121ae13f2b3728
Instruction ID: d56f45aaf17a29c1475c878688e58f2fd6093013b467146c1a9fd7f52a3c7fa7
Opcode Fuzzy Hash: 9ee22e84bb74fc748aa13dd12083fbe46cfefc5cafaddd145f121ae13f2b3728
Instruction Fuzzy Hash: 9F6132B81093858FC338CF95C880A8BFBE1BB89340F914E1CE5985B351CBB19995CF92

Function 20148550 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3966a2d936edd45f59b6e0deb058351046a11c26772725d757917f5ea545eae4
Instruction ID: 3cd01bd5d91c71bf9c3753a88545ff5249741eeffda3cc6f1d0636b5ccc9f528
Opcode Fuzzy Hash: 3966a2d936edd45f59b6e0deb058351046a11c26772725d757917f5ea545eae4
Instruction Fuzzy Hash: 8E01D1B1A00301ABEA109F94ED06B9A77A5AFE5715F14046CF90066251DB32ED29DBE2

Function 200F2C8E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 202948A7
IsDebuggerPresent.KERNEL32 ref: 20294973
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 20294993
UnhandledExceptionFilter.KERNEL32(?), ref: 2029499D

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 391012c2969b47130be9ecb46923f5d3b6a519e9674f0e3fca029dc70e2e8319
Instruction ID: 4f09f7ba0e0e8f226309def2a25057621c750a998992378b469df649a55cb67e
Opcode Fuzzy Hash: 391012c2969b47130be9ecb46923f5d3b6a519e9674f0e3fca029dc70e2e8319
Instruction Fuzzy Hash: 833114B5D0561D9BEB11DFA4CD89BCDBBB8BF08300F1041AAE40CAB250EB749A859F45

Function 2014EF30 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf41f3b5669224c1154e9b2a92fe1b82126ef762f8275621b626f57154db146f
Instruction ID: 9fd82dc27965039feb166abcd14c1960eecf7bdf0374aec9ce8c7b5f4d0dd09d
Opcode Fuzzy Hash: bf41f3b5669224c1154e9b2a92fe1b82126ef762f8275621b626f57154db146f
Instruction Fuzzy Hash: 3B114431C04921ABE7128BA8D844B87F7E0BF18330F044228FC489BA62C721FD64CBC1

Function 201B3770 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ccdf9b743d75f8252b2851f4553c50142fb9d6052622b86404dbf4ff0d5e94
Instruction ID: 929f93c0a64b6b7ad0a7cf20e6871757c2d9e8b739f2913bcc44dd0700d2ca47
Opcode Fuzzy Hash: f4ccdf9b743d75f8252b2851f4553c50142fb9d6052622b86404dbf4ff0d5e94
Instruction Fuzzy Hash: 14E0B632044704ABDA226F90DE4BF8BBFA6BF58750F040C18F5C521671CB729C64BB81

Function 201D37E0 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 163b20eed04c21f543b465dbf508e26d1b36e382aec2e71a79acdea727c2a907
Instruction ID: 9b5a6da2a92b094cdc51209cb6e495f3d008d928cb2a4996f52f772cbf9dbfb8
Opcode Fuzzy Hash: 163b20eed04c21f543b465dbf508e26d1b36e382aec2e71a79acdea727c2a907
Instruction Fuzzy Hash: A2E0B632044784ABDB226F91DD4AF8BBFA6AF58354F040C18F58561471CBB29CA5BB81

Function 20195910 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

INSERT INTO '%q'.'%q_idx'(segid,term,pgno) VALUES(?,?,?), xrefs: 2019597E

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: INSERT INTO '%q'.'%q_idx'(segid,term,pgno) VALUES(?,?,?)
API String ID: 0-143322027
Opcode ID: 7b4d193a179604c64c4eff4d3d90ea1e5c3ce59e362d551935f4195432f11110
Instruction ID: 5f788082b0845e804ff69ba8d61c6751bb7adb4ed19a0c3d1b7d3dd71bed4c85
Opcode Fuzzy Hash: 7b4d193a179604c64c4eff4d3d90ea1e5c3ce59e362d551935f4195432f11110
Instruction Fuzzy Hash: B7116DB1500209BFE7109F94CC85F86FBEDFF55328F004145F5089B252C7B2A5A4CBA0

Function 201AD3B0 Relevance: 4.6, APIs: 3, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 086edaa6fb3e30ff7c1433584a481e097986649d541fc464a39c340445884dff
Instruction ID: 66d67d815d97683e4655875488043fc8e849fa17f6d114332cef16126cde5edf
Opcode Fuzzy Hash: 086edaa6fb3e30ff7c1433584a481e097986649d541fc464a39c340445884dff
Instruction Fuzzy Hash: C8318FB4600A04ABE704DFA9DC85F96B3E9FF58214F008528F949C3651EB75FE10CBA1

Function 201955B0 Relevance: 4.6, APIs: 3, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 090aba110629c1a526cb031972be97f02ad7aa51b23e88f0b7628e4dab59d0fa
Instruction ID: fbeff286de28c6ac35108241252439b13c76741e1d4502f177447dceb9d1870c
Opcode Fuzzy Hash: 090aba110629c1a526cb031972be97f02ad7aa51b23e88f0b7628e4dab59d0fa
Instruction Fuzzy Hash: 8531BAB1500308AFEB108FAADC85B5B77F9EF94314F104829F945AA262E771EA50CF61

Function 2016E170 Relevance: 4.6, APIs: 3, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7b1bc1bd45edd2a28ce550db97599cb17786c6148cef4a3a41ba191b2804bc0
Instruction ID: 18f019641fd5e7ffe4bc12f511b1bfe4884ab2ee2ad647a9ebe0335a7699c390
Opcode Fuzzy Hash: c7b1bc1bd45edd2a28ce550db97599cb17786c6148cef4a3a41ba191b2804bc0
Instruction Fuzzy Hash: 1511B4756002006BE6019BA98D46F9B77EEEFD4754F04092CF544D3252FA72EA21DBE2

Function 202E2D38 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(202E2EA6,00000001,00000000,?,?,?,202E362E,00000000), ref: 202E2DAA

Strings

.6. , xrefs: 202E2D7F

Memory Dump Source

Source File: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID: EnumLocalesSystem
String ID: .6.
API String ID: 2099609381-1898362839
Opcode ID: aa8dcd85685423d9d6ad421be7860c9bed7245e463a62f8d2bdff60e238d6cff
Instruction ID: c5a1c4398a5c5d9e2733a11a5a600ebbdee4fc05a566e68dd121ca3289d3c13f
Opcode Fuzzy Hash: aa8dcd85685423d9d6ad421be7860c9bed7245e463a62f8d2bdff60e238d6cff
Instruction Fuzzy Hash: 6F11483B2007059FDB089FBACC916AAB791FF80368B58442DEA4B87B01D775B916CB40

Function 200F2112 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

GetEnabledXStateFeatures, xrefs: 202D0C61

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: GetEnabledXStateFeatures
API String ID: 0-1068256093
Opcode ID: 148ffda63a26ab8aa1bdecb616c3b33121821a9a5f9a5d6f3cdf37a8616220fb
Instruction ID: 1e3b0312c75db10525f157da998e28396d751f16117ef2a59d6a81a48fb50a8d
Opcode Fuzzy Hash: 148ffda63a26ab8aa1bdecb616c3b33121821a9a5f9a5d6f3cdf37a8616220fb
Instruction Fuzzy Hash: C3F0F63291152877CB162FE0DC88F9E3E05AF84724F010013FD0926334DB398C71AAC5

Function 202D4A46 Relevance: 2.2, APIs: 1, Instructions: 660timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,202D4F85,00000000,00000000,00000000), ref: 202D4DEE

Memory Dump Source

Source File: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID: InformationTimeZone
String ID:
API String ID: 565725191-0
Opcode ID: 0ba676cebcbc05910eccd62b2974394563818f718ceac02ffda758388353f886
Instruction ID: 25eb3486edf9259d5ada01ed9d5155ba499ea0728ff4649d15f173b7865bfade
Opcode Fuzzy Hash: 0ba676cebcbc05910eccd62b2974394563818f718ceac02ffda758388353f886
Instruction Fuzzy Hash: 8ED1067390021AABDB15AFE48C46BAE77A9EF14710F144157F901EB291EB748E50EBD0

Function 202E2DF9 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(202E318D,00000001,?,?,?,?,202E35F6,?), ref: 202E2E43

Memory Dump Source

Source File: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 56bedc59426a9d13f55cf29b6ed06fbcf681f4e64158f96e54218aa0137ea4ba
Instruction ID: 8fd3959c92e458119dcaccd762efc07a1c0cef01a27766ef120fa3776bee8d67
Opcode Fuzzy Hash: 56bedc59426a9d13f55cf29b6ed06fbcf681f4e64158f96e54218aa0137ea4ba
Instruction Fuzzy Hash: 59F046362003041FD7144FB68CC0B6A7B94FF80368F48442EF90A4B681C671BC02CA90

Function 202CFF17 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(202CFF01,00000001,2032D298,0000000C,202D0A92,?), ref: 202CFF4F

Memory Dump Source

Source File: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 0826b52ffe0556b8c9f8fb1eff9f3b1afd4b227394c68b59660e593b9393ad5d
Instruction ID: 4a81e487d7db12204cd3d3c548e4e5e9fdfe3e1cf9bd03d1702e060c86cec469
Opcode Fuzzy Hash: 0826b52ffe0556b8c9f8fb1eff9f3b1afd4b227394c68b59660e593b9393ad5d
Instruction Fuzzy Hash: 1DF04472A04604DFE701DFA8D886B9C7BB0FB19724F10416AF412DB6E0CB799904EF80

Function 202E2CB6 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(202E2BE6,00000001,?,?,?,202E3650,?), ref: 202E2CED

Memory Dump Source

Source File: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: a6ac7bea8e79c15590b5d9219559e9c4d213ea281841c7bd2530d3dc95206187
Instruction ID: 06ef5c57f166493385f4aa4bc420544621205ebdafe13f3762705f887e09c72e
Opcode Fuzzy Hash: a6ac7bea8e79c15590b5d9219559e9c4d213ea281841c7bd2530d3dc95206187
Instruction Fuzzy Hash: D7F0AB3A30020A57D7049FBACC8576ABF94FFC1324F5B005EEE0ACB251C635AA46D790

Function 200F42AF Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00004214), ref: 20294A98

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ff1f2716b08ef162e90df4e8906b900cc574532eacb3ac725c2324d5235415f8
Instruction ID: 388262da90c744c6ff9cd7ea771068c65f72c3c6cd41662611d209c45c519637
Opcode Fuzzy Hash: ff1f2716b08ef162e90df4e8906b900cc574532eacb3ac725c2324d5235415f8
Instruction Fuzzy Hash: 799002A099490A5B5D4197D1DE9DC0466247695605B600071B50D54418491C0251B776

Function 200F46A6 Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 202CEFF3

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: ef5385abac2e3aab8c85a27dc3125c21a151ef3b532b03a042a7dd24bd779b93
Instruction ID: 7c026d53e82585d3ddc0858628dfb0e3ef55b09ef3560189ffbce7d806c73d03
Opcode Fuzzy Hash: ef5385abac2e3aab8c85a27dc3125c21a151ef3b532b03a042a7dd24bd779b93
Instruction Fuzzy Hash: 06B01230505B01CF57814F7A4D4870D35EC7B14190B11801AD000C0560D63D40507F52

Function 201D5660 Relevance: 56.5, APIs: 26, Strings: 6, Instructions: 452
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D$1 , xrefs: 201D56A3
CREATE TABLE x(%.*s INT, xrefs: 201D57CA
Auxiliary rtree columns must be last, xrefs: 201D56B3, 201D58B3
p$1 , xrefs: 201D56AB
_node, xrefs: 201D579E
,%.*s, xrefs: 201D5804, 201D5835

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: ,%.*s$Auxiliary rtree columns must be last$CREATE TABLE x(%.*s INT$D$1 $_node$p$1
API String ID: 0-930471721
Opcode ID: c2ca209dc6a4751254baf09db9626ad031dffc5af5b6714f0c56232e2ce7b871
Instruction ID: ec9c3f457a1106eb5c53efe7b15578a3d7de8ae3cc0089f53bc02688da52db67
Opcode Fuzzy Hash: c2ca209dc6a4751254baf09db9626ad031dffc5af5b6714f0c56232e2ce7b871
Instruction Fuzzy Hash: 32F122725087049FD7018FA8CC85B9BB7E9FF58304F040529F94A87312DB39EA59DBA2

Function 2011CC80 Relevance: 47.7, APIs: 15, Strings: 12, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

u, xrefs: 2011D16D
%04d, xrefs: 2011D1CE
%04d-%02d-%02d, xrefs: 2011CE82
%2d, xrefs: 2011CE27
%.3f, xrefs: 2011D0BF
%lld, xrefs: 2011D0EE
%02d:%02d:%02d, xrefs: 2011D12E
%03d, xrefs: 2011CF81, 2011CF8B
%.16g, xrefs: 2011CFB3
%02d:%02d, xrefs: 2011D080
%06.3f, xrefs: 2011CE5F
%02d, xrefs: 2011CE2C, 2011CE34, 2011CF27, 2011CF6F, 2011CFCE, 2011CFE9, 2011D10A

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %.16g$%.3f$%02d$%02d:%02d$%02d:%02d:%02d$%03d$%04d$%04d-%02d-%02d$%06.3f$%2d$%lld$u
API String ID: 0-1613945299
Opcode ID: 938617df41724acbf823619418b7c9c4213200a0ff306f7f638ef452ab09fc45
Instruction ID: 46af43b5031d65f874c04cacafa6a2eeb6d87ddcd1fae2e682f20762b561b51e
Opcode Fuzzy Hash: 938617df41724acbf823619418b7c9c4213200a0ff306f7f638ef452ab09fc45
Instruction Fuzzy Hash: D8F12A719087049FE704CBE4DC41F9BF7EABF95304F444A2DF98596241EB39EA888752

Function 20199120 Relevance: 45.9, APIs: 23, Strings: 3, Instructions: 355
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CREATE TABLE x(_shape, xrefs: 20199268
_node, xrefs: 20199202
,%s, xrefs: 20199297

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: ,%s$CREATE TABLE x(_shape$_node
API String ID: 0-1242591684
Opcode ID: 8f0997d2603ff6be963af5e91288092bc8854bd30fbae6860048fa1c5658ce70
Instruction ID: 404dc16195441de779ed13d180428c91b0f6e8a862cfcb9a27d44ec5b47d88b0
Opcode Fuzzy Hash: 8f0997d2603ff6be963af5e91288092bc8854bd30fbae6860048fa1c5658ce70
Instruction Fuzzy Hash: 72C138705047089BE7028FA8DCC9B5777B8FF54308F040528F94986226DB3AEA19DBE1

Function 2024B050 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 251
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%.18s-%s, xrefs: 2024B192
k(%d, xrefs: 2024B0A5
vtab:%p, xrefs: 2024B283
%c%u, xrefs: 2024B2C3
%lld, xrefs: 2024B1DA, 2024B24C
NULL, xrefs: 2024B267, 2024B324, 2024B325
%.16g, xrefs: 2024B217
(blob), xrefs: 2024B26C
%s(%d), xrefs: 2024B1B3
BINARY, xrefs: 2024B0D3
,%s%s%s, xrefs: 2024B137
program, xrefs: 2024B2FB

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %.16g$%.18s-%s$%c%u$%lld$%s(%d)$(blob)$,%s%s%s$BINARY$NULL$k(%d$program$vtab:%p
API String ID: 0-900822179
Opcode ID: ba165e8816fce3f6e7e8623517f575af76ae473d7561bfde987c774aadf3c782
Instruction ID: e045ff294835fedb794e1dea1fbb33dd39e6da8329f3de245e30ac376fcaf6f0
Opcode Fuzzy Hash: ba165e8816fce3f6e7e8623517f575af76ae473d7561bfde987c774aadf3c782
Instruction Fuzzy Hash: ED91E7749083059BD709CF95CC84FAB7BF6BF85304F14489AF9848B253E736D9268B51

Function 2010D820 Relevance: 35.2, APIs: 8, Strings: 12, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fts3_tokenizer, xrefs: 2010D921
snippet, xrefs: 2010D93C
fts4aux, xrefs: 2010D840
fts3tokenize, xrefs: 2010DA27
fts4, xrefs: 2010D9F0
unicode61, xrefs: 2010D90B
offsets, xrefs: 2010D956
optimize, xrefs: 2010D9A4
matchinfo, xrefs: 2010D970, 2010D98A
fts3, xrefs: 2010D9CA
simple, xrefs: 2010D8A9
porter, xrefs: 2010D8EE

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 0-449611708
Opcode ID: f4ab9b38a6bfb4a7c2e2acecfcc2d561c57cee0ff62617fdb26efc4e2d5b7525
Instruction ID: fe1672ef0217ef7eee41590d6e16fad766d5438d276f2e770114f03412e2f1da
Opcode Fuzzy Hash: f4ab9b38a6bfb4a7c2e2acecfcc2d561c57cee0ff62617fdb26efc4e2d5b7525
Instruction Fuzzy Hash: 2F513970B08704A7E3116BE56CC5F9B7699BF1461CF040034FD44A3247EBAAEB5982D2

Function 20287FB0 Relevance: 33.6, APIs: 14, Strings: 5, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

winGetTempname2, xrefs: 20288094
winGetTempname5, xrefs: 20288233
winGetTempname4, xrefs: 20288355
etilqs_, xrefs: 2028824C
winGetTempname1, xrefs: 2028817B

Memory Dump Source

Source File: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 0-2933911573
Opcode ID: c38ff5dbbf7e74a01bf0db41a96b4894695d3be2a0686bdd87962059c3cceeb1
Instruction ID: 38b974b53c36692ff7cf44ba572e982b2671892ed1823f75e6c91b245d736c38
Opcode Fuzzy Hash: c38ff5dbbf7e74a01bf0db41a96b4894695d3be2a0686bdd87962059c3cceeb1
Instruction Fuzzy Hash: 93A1DF756003465BE3004FA4AC86BAA7799EF41311F480176FD889B5C3EA2B952FD7F1

Function 20112BE0 Relevance: 31.8, APIs: 8, Strings: 10, Instructions: 346
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 20112E69
misuse, xrefs: 20112E73
ORDER BY name, xrefs: 20112DCC
%s at line %d of [%.10s], xrefs: 20112E78
invalid, xrefs: 20112E4E
unopened, xrefs: 20112E55
NULL, xrefs: 20112E38
SELECT * FROM (SELECT 'sqlite_schema' AS name,1 AS rootpage,'table' AS type UNION ALL SELECT name,rootpage,type FROM "%w".sqlite_schema WHERE rootpage!=0), xrefs: 20112DA4
API call with %s database connection pointer, xrefs: 20112E5A
WHERE name=%Q, xrefs: 20112DB7

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: ORDER BY name$%s at line %d of [%.10s]$API call with %s database connection pointer$NULL$SELECT * FROM (SELECT 'sqlite_schema' AS name,1 AS rootpage,'table' AS type UNION ALL SELECT name,rootpage,type FROM "%w".sqlite_schema WHERE rootpage!=0)$WHERE name=%Q$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse$unopened
API String ID: 0-1179878930
Opcode ID: 73d944993ae92403e2d045e489e1531b6cf7487b7458c9525510dbfa5210ba9a
Instruction ID: 95209bedc56062bafa999f94c676f4bede2810d38f42fdd9cd6ce1fba764ae2a
Opcode Fuzzy Hash: 73d944993ae92403e2d045e489e1531b6cf7487b7458c9525510dbfa5210ba9a
Instruction Fuzzy Hash: 37C130705047048BE71C8FD4DC85B8BB7A4AF50354F144438FE599B242E739EBAA9FA2

Function 2018EF60 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 192COMMON

Download Yara Rule

Strings

,origin, xrefs: 2018F0D6, 2018F0DE
(W1 , xrefs: 2018EFE0
\W1 , xrefs: 2018EFE8
dV1 , xrefs: 2018F0F3
U1 , xrefs: 2018EFA8
<V1 , xrefs: 2018EFB0

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: (W1 $,origin$<V1 $\W1 $dV1 $U1
API String ID: 0-3421156695
Opcode ID: 000aae1de7416477345d45f4ea4734f39b664edc83f70dfb90d6b5fbd781a69f
Instruction ID: 239e72cf27394cfdb0a707846a8a20d8c9caf29e31db363832a6f6ddf9ecb94c
Opcode Fuzzy Hash: 000aae1de7416477345d45f4ea4734f39b664edc83f70dfb90d6b5fbd781a69f
Instruction Fuzzy Hash: 2271AB75508300DFE7259F98CC85A5AB7F6FF88300F10492CF98586261DB76EA54EF82

Function 20215D70 Relevance: 28.3, APIs: 8, Strings: 8, Instructions: 266COMMON

Download Yara Rule

Strings

rank, xrefs: 20215FBB
secure-delete, xrefs: 20216031
hashsize, xrefs: 20215DF0
automerge, xrefs: 20215E59
usermerge, xrefs: 20215EAD
crisismerge, xrefs: 20215EF7
pgsz, xrefs: 20215D81
deletemerge, xrefs: 20215F64

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: automerge$crisismerge$deletemerge$hashsize$pgsz$rank$secure-delete$usermerge
API String ID: 0-3330941169
Opcode ID: adc30a0a5221e3a4832d310f46d02bb4ab6fb651dac703de433f92fdcf559573
Instruction ID: 6625e2d5bb7c7c60bf6d642f0fff47f40dc386f534d1f3e7331dfd1fced37760
Opcode Fuzzy Hash: adc30a0a5221e3a4832d310f46d02bb4ab6fb651dac703de433f92fdcf559573
Instruction Fuzzy Hash: 51713DB6F0022157C6049FD5BC4165FBBD5AF99212F0404BFF941C7203EB25EAAA87E2

Function 20105E20 Relevance: 26.7, APIs: 8, Strings: 7, Instructions: 496COMMON

Download Yara Rule

Strings

API called with finalized prepared statement, xrefs: 20105F1F, 20106247, 20106379
SELECT t.%Q FROM %Q.%Q AS t WHERE t.%Q MATCH '*id', xrefs: 20105E6F
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 20105F2B, 20106253, 20106385
misuse, xrefs: 20105F35, 2010625D, 2010638F
%s at line %d of [%.10s], xrefs: 20105F3A, 20106262, 20106394
recursive definition for %s.%s, xrefs: 20105E4C
no such fts5 table: %s.%s, xrefs: 201062EA

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$SELECT t.%Q FROM %Q.%Q AS t WHERE t.%Q MATCH '*id'$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$no such fts5 table: %s.%s$recursive definition for %s.%s
API String ID: 0-1070437968
Opcode ID: deb7051ad881485702f3152ae52fca4554684902af144879a25c7dc5d49f32b8
Instruction ID: 2ceb76fd8fb0b614e94b33699ad3f452343b6431d087fa8bee0dd7dddff05c52
Opcode Fuzzy Hash: deb7051ad881485702f3152ae52fca4554684902af144879a25c7dc5d49f32b8
Instruction Fuzzy Hash: 4A0225B09047159FD7118FA4CC85B9BB7EABF94318F044428FD8997202EB75EB58CB92

Function 20179980 Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 429COMMON

Download Yara Rule

Strings

API called with finalized prepared statement, xrefs: 20179A19, 20179D84
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 20179A35, 20179D90
no such function: %s, xrefs: 20179E8C
misuse, xrefs: 20179A3F, 20179D9A
%s at line %d of [%.10s], xrefs: 20179A44, 20179D9F
API called with NULL prepared statement, xrefs: 20179A04
SELECT %s, xrefs: 201799B1

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$SELECT %s$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$no such function: %s
API String ID: 0-3900766660
Opcode ID: e31b42cd08a1525c68c562bd1c7b62e5ad155203ec0fc6c40ff2188ee33d8838
Instruction ID: 48f92be7ba6ee99dfa47f9a45f38ff51b24c061e260a38d3c4fbf6b0d20e390e
Opcode Fuzzy Hash: e31b42cd08a1525c68c562bd1c7b62e5ad155203ec0fc6c40ff2188ee33d8838
Instruction Fuzzy Hash: D6E103B09047049BD711CFA4D881B9B77F4BF98314F04842CE9499B266EB35EA4DCBA2

Function 20133800 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 184COMMON

Download Yara Rule

Strings

API called with finalized prepared statement, xrefs: 20133924
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 20133930
real, xrefs: 20133895, 201338EC
misuse, xrefs: 2013393A
%s at line %d of [%.10s], xrefs: 2013393F
cannot open value of type %s, xrefs: 201338ED
no such rowid: %lld, xrefs: 201339F8
null, xrefs: 201338E7
integer, xrefs: 2013389A

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$cannot open value of type %s$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$integer$misuse$no such rowid: %lld$null$real
API String ID: 0-1477268580
Opcode ID: 13cf7f0645f8bef8277e599cb334e51c48e5a9138b55e925bd06f819937b8e5a
Instruction ID: c744a701cbcb0dacc3fdf4d4f108b58203888e30bb03308ecd6b301d1891bb8f
Opcode Fuzzy Hash: 13cf7f0645f8bef8277e599cb334e51c48e5a9138b55e925bd06f819937b8e5a
Instruction Fuzzy Hash: 4B51EEB1A047049FE7109FA8DC80B56B3F4FF94318F044A6DF9468B642EB71EA548BA5

Function 2021A150 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 226COMMON

Download Yara Rule

Strings

%s_data, xrefs: 2021A1BC
data, xrefs: 2021A1E4
idx, xrefs: 2021A200
id INTEGER PRIMARY KEY, block BLOB, xrefs: 2021A1DF
segid, term, pgno, PRIMARY KEY(segid, term), xrefs: 2021A1FB

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s_data$data$id INTEGER PRIMARY KEY, block BLOB$idx$segid, term, pgno, PRIMARY KEY(segid, term)
API String ID: 0-1009905541
Opcode ID: 400790ea404262e72c3b102f495059b72b349412dfa6c026d55cb814e551031c
Instruction ID: e3de60ca03bf0485e75e7f3f68b6503b865c775e3a62cfa059da1c40d0d0cd97
Opcode Fuzzy Hash: 400790ea404262e72c3b102f495059b72b349412dfa6c026d55cb814e551031c
Instruction Fuzzy Hash: 37717071508B019BD7025FA4DC89B07B7ECBF04345F000526FE0696662DB79E9A8EBB1

Function 2021F370 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 196COMMON

Download Yara Rule

Strings

, c%d, xrefs: 2021F469
id INTEGER PRIMARY KEY, sz BLOB, origin INTEGER, xrefs: 2021F51C
id INTEGER PRIMARY KEY, xrefs: 2021F43E
config, xrefs: 2021F549
id INTEGER PRIMARY KEY, sz BLOB, xrefs: 2021F524, 2021F52C
content, xrefs: 2021F49D
k PRIMARY KEY, v, xrefs: 2021F544
docsize, xrefs: 2021F52D
version, xrefs: 2021F560

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: , c%d$config$content$docsize$id INTEGER PRIMARY KEY$id INTEGER PRIMARY KEY, sz BLOB$id INTEGER PRIMARY KEY, sz BLOB, origin INTEGER$k PRIMARY KEY, v$version
API String ID: 0-3918257174
Opcode ID: 4a08c7a82c1cb1fee47d896bd89c9994e50ef2a2d7f876bda414558a8265f443
Instruction ID: 51306fdbbe445436a349452ea730174cf009cc1866ac050859908ebbe100536d
Opcode Fuzzy Hash: 4a08c7a82c1cb1fee47d896bd89c9994e50ef2a2d7f876bda414558a8265f443
Instruction Fuzzy Hash: 16510331900201ABC310DFA4DC85B5BB7E9FB44765F440226FD589B202D739EEA9DBE1

Function 200FA6C0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 195COMMON

Download Yara Rule

Strings

></polyline>, xrefs: 200FA845
<polyline points=, xrefs: 200FA74B
%s, xrefs: 200FA82E
%g,%g', xrefs: 200FA7D1
%c%g,%g, xrefs: 200FA78E

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %g,%g'$ %s$%c%g,%g$<polyline points=$></polyline>
API String ID: 0-3443809342
Opcode ID: 9ebd709b3f4556f654fdeb17d5fad2d1dd5e9b53375f895a702b9751432abc9a
Instruction ID: 5283b1fc9568dc993eb9120075c91c87265b8f60eed8d93cea6e29e7441f00c3
Opcode Fuzzy Hash: 9ebd709b3f4556f654fdeb17d5fad2d1dd5e9b53375f895a702b9751432abc9a
Instruction Fuzzy Hash: A96158B09047089BE7019FA6CC89B5673E5BF42340F044538F8099A261EF79ED9ADBD2

Function 20238F40 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 177COMMON

Download Yara Rule

Strings

%lld, xrefs: 2023900C
%!.20e, xrefs: 20238FF1
NULL, xrefs: 2023912E
NULL, xrefs: 20239148
%!.15g, xrefs: 20238F83

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %!.15g$%!.20e$%lld$NULL$NULL
API String ID: 0-2115304644
Opcode ID: 5c2c5a1539ae41b9d02e9ffbb2409bda7df954e5841d3a946a40fcd7a31740c1
Instruction ID: 904c1b6fe020929351a49176d16ab1ced69fe727ba14e311221a1b95d9fd1ec5
Opcode Fuzzy Hash: 5c2c5a1539ae41b9d02e9ffbb2409bda7df954e5841d3a946a40fcd7a31740c1
Instruction Fuzzy Hash: 785177B19047115BD714DF98CC42B9BB7E5EF92304F04499EFC9877202E33AEA1A8792

Function 20103420 Relevance: 21.4, APIs: 6, Strings: 6, Instructions: 392COMMON

Download Yara Rule

Strings

API called with finalized prepared statement, xrefs: 2010352C, 20103588
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 20103548, 20103594
misuse, xrefs: 20103552, 2010359E
%s at line %d of [%.10s], xrefs: 20103557, 201035A3
API called with NULL prepared statement, xrefs: 20103517
ATTACH x AS %Q, xrefs: 2010346F

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ATTACH x AS %Q$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-2988319395
Opcode ID: 5eadd479fb0093a53d2ade1b0838c66278e6577130f2ecf53aed20d7a5481a33
Instruction ID: aaab144388421ca209998656953ad8b4f651ca46feff541aa9513b6e3e43e8f3
Opcode Fuzzy Hash: 5eadd479fb0093a53d2ade1b0838c66278e6577130f2ecf53aed20d7a5481a33
Instruction Fuzzy Hash: 6DD1F3B09087419BD7018FA4DCC5B9B77EEBF54304F044529FD8986252E739EB48DBA2

Function 201D4B10 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 156COMMON

Download Yara Rule

Strings

API called with finalized prepared statement, xrefs: 201D4C1E
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 201D4C2A
misuse, xrefs: 201D4C34
%s at line %d of [%.10s], xrefs: 201D4C39
rtree constraint failed: %s.(%s<=%s), xrefs: 201D4BF9
UNIQUE constraint failed: %s.%s, xrefs: 201D4BC9
SELECT * FROM %Q.%Q, xrefs: 201D4B25

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$SELECT * FROM %Q.%Q$UNIQUE constraint failed: %s.%s$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$rtree constraint failed: %s.(%s<=%s)
API String ID: 0-2013246442
Opcode ID: f93e867a055e3c75ce0ca03810784f27609bd412e9d598001df216d14a97bea9
Instruction ID: a25272e0abddf5f6df63e1f5a713be967c17ba9c89c1e0e190dea02480b89cfa
Opcode Fuzzy Hash: f93e867a055e3c75ce0ca03810784f27609bd412e9d598001df216d14a97bea9
Instruction Fuzzy Hash: FF415772905604AFE7055FE59CC7F9B37ACFF60218F000529FD0492301EB75AA5496E2

Function 20287C10 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 150COMMON

Download Yara Rule

Strings

winFullPathname1, xrefs: 20287CC9
%s%c%s, xrefs: 20287C7A
winFullPathname2, xrefs: 20287D35

Memory Dump Source

Source File: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s%c%s$winFullPathname1$winFullPathname2
API String ID: 0-2846052723
Opcode ID: f60efd7ce61f7ad6e92f7d2c81c8653b4616d77b9fe1be3e30ead1219daa9028
Instruction ID: b8d57b9ad9d634dc282322d22df9466f68d4a70ba218d42465aca46ba201dffa
Opcode Fuzzy Hash: f60efd7ce61f7ad6e92f7d2c81c8653b4616d77b9fe1be3e30ead1219daa9028
Instruction Fuzzy Hash: E741CB766053062BF3119FE0BC86F673BAAAF45215F08407FF58A560C2DB16D916C2B2

Function 2027AAD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 130COMMON

Download Yara Rule

Strings

API called with finalized prepared statement, xrefs: 2027AAEF
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2027AB0B, 2027AB4C, 2027ABA0
misuse, xrefs: 2027AB15, 2027AB56, 2027ABAA
%s at line %d of [%.10s], xrefs: 2027AB1A, 2027AB5B, 2027ABAF
bind on a busy prepared statement: [%s], xrefs: 2027AB94
API called with NULL prepared statement, xrefs: 2027AAD9

Memory Dump Source

Source File: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$bind on a busy prepared statement: [%s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3679126755
Opcode ID: 63ef209a431a0e42596a66d42ddcfc719646fd7e7b31ce2619c9692c4dfd791f
Instruction ID: bb2a3be38706d26ed050acb57d8b853b836e68ef42d28f430a625feb380155ae
Opcode Fuzzy Hash: 63ef209a431a0e42596a66d42ddcfc719646fd7e7b31ce2619c9692c4dfd791f
Instruction Fuzzy Hash: 2F41E530610709ABE7108FE8DC86FC673A47FA4329F04442AFA55AB296EB74D990D791

Function 2021ECF0 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 335COMMON

Download Yara Rule

Strings

content, xrefs: 2021EFDF
docsize, xrefs: 2021F020

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: content$docsize
API String ID: 0-1024698521
Opcode ID: 88c6800f950275ea6f7443efb44ce992d3af887bf06b90dfdf6346e7fa0e6cea
Instruction ID: 78533096dd1f8c319970cd4185738e5b478015935388633a0af4007fdca22d7f
Opcode Fuzzy Hash: 88c6800f950275ea6f7443efb44ce992d3af887bf06b90dfdf6346e7fa0e6cea
Instruction Fuzzy Hash: 52C1DE71904302ABDB11CF94CC81B5BB3E4AF98364F14052AFD549B213D7B5EEA68BD2

Function 201A5470 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 225COMMON

Download Yara Rule

Strings

%!0.15g, xrefs: 201A54D2
%lld, xrefs: 201A550D
JSON cannot hold BLOB values, xrefs: 201A5697

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %!0.15g$%lld$JSON cannot hold BLOB values
API String ID: 0-1047910854
Opcode ID: 48f73998b21a2d0cf84396e97ba67a832fcff21075795e7e91101ab811e498fa
Instruction ID: 44e031c683ebaf9f5bf402cad069871e52d4ec20066934350a4a7711bd20fd9f
Opcode Fuzzy Hash: 48f73998b21a2d0cf84396e97ba67a832fcff21075795e7e91101ab811e498fa
Instruction Fuzzy Hash: 2B51E27A5082006AE3105BD8DC42FFB77A6EFA2334F24015DFA4547683EB6B9755C2A1

Function 20122B70 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 183COMMON

Download Yara Rule

Strings

ABLE x, xrefs: 20122BB6
("%s", xrefs: 20122C4A
%c"%s", xrefs: 20122C1B
,arg HIDDEN, xrefs: 20122C7A
,schema HIDDEN, xrefs: 20122CD2

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %c"%s"$("%s"$,arg HIDDEN$,schema HIDDEN$ABLE x
API String ID: 0-1763475469
Opcode ID: 83d5b6aaaa8be98998003ac4e0a807747fdf87a79e63b289da08f1542164ff09
Instruction ID: 88950e64f7f939fdaf6d9f65924e9d63679f98a97b1e159dae5e761b93e9f211
Opcode Fuzzy Hash: 83d5b6aaaa8be98998003ac4e0a807747fdf87a79e63b289da08f1542164ff09
Instruction Fuzzy Hash: AE71DF709087859FD314CFA4D840B9EBBE5FF98304F008A5EF89897251E779D649CB92

Function 2019AA40 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 334COMMON

Download Yara Rule

Strings

API called with finalized prepared statement, xrefs: 2019AA9C, 2019AD76
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2019AAB8, 2019AD82
misuse, xrefs: 2019AAC2, 2019AD8C
%s at line %d of [%.10s], xrefs: 2019AAC7, 2019AD91
API called with NULL prepared statement, xrefs: 2019AA87

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-860711957
Opcode ID: 6296d0a8ac5891fe111db357e6b8957872639ca024c1d25c566a1fda05583fc7
Instruction ID: 1d7f5a9206e07563e8ac6cf033563e858f55acb9bfce609afee5d6e91b03a248
Opcode Fuzzy Hash: 6296d0a8ac5891fe111db357e6b8957872639ca024c1d25c566a1fda05583fc7
Instruction Fuzzy Hash: E8B104B1A007089BE7109FE49C45B9777D8BF50319F440428F9969B2C2EB75EB5C87E2

Function 2011A170 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 286COMMON

Download Yara Rule

Strings

malformed JSON, xrefs: 2011A283
JSON path error near '%q', xrefs: 2011A3D7

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: JSON path error near '%q'$malformed JSON
API String ID: 0-560895927
Opcode ID: 3270fb318219897ecf384fcf53a58ab8af1f1b0dbf7b93a99b3dc595054327c4
Instruction ID: cf1a362f12f28b51961e4afcfb862b9613a7a79a5a82811d6dc06839d6c442d1
Opcode Fuzzy Hash: 3270fb318219897ecf384fcf53a58ab8af1f1b0dbf7b93a99b3dc595054327c4
Instruction Fuzzy Hash: F1A129B15003008BD718CFA4D845BA6FBE4EF90314F58453DE5858B683E776EB89CBA1

Function 20123D20 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 223COMMON

Download Yara Rule

Strings

PRAGMA , xrefs: 20123DC5
=%Q, xrefs: 20123E7F
%Q., xrefs: 20123E11

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %Q.$=%Q$PRAGMA
API String ID: 0-2099833060
Opcode ID: c6e7b3f531bda0f483a07631d9e7b551fe9d7d40ee97d17d89f4a3462c6a97d9
Instruction ID: 362af7e8a1535ae70ea99ad1a52e07612bd865e9e9cd027122d977c45c9cd028
Opcode Fuzzy Hash: c6e7b3f531bda0f483a07631d9e7b551fe9d7d40ee97d17d89f4a3462c6a97d9
Instruction Fuzzy Hash: BA711F71A087109FD700CFA8ECC5B9BB7E8BF54304F050529F9449B252E739EA098BE2

Function 2010B980 Relevance: 16.7, APIs: 11, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b9c19dcad31e3fe35eb01cb9815812e287a0b1cfc4ab3dc83c154e38eccd315
Instruction ID: f5320aeeb744bb240107198f68e454912abbe852e4e8a7fb84d5e30dcb596366
Opcode Fuzzy Hash: 2b9c19dcad31e3fe35eb01cb9815812e287a0b1cfc4ab3dc83c154e38eccd315
Instruction Fuzzy Hash: AB8151719083499BE7008FA088C1BAABBF2AF91204F540969FDD41731AFB75DF95C792

Function 2014F600 Relevance: 16.7, APIs: 11, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a70c7127cf5330d89c7d45b3115e672d80e76ffd15e8db3879d2d7a1d690e5da
Instruction ID: ed394a5572acaea79d1364742dc78659131399cdf3414e456a0adf41cac3922a
Opcode Fuzzy Hash: a70c7127cf5330d89c7d45b3115e672d80e76ffd15e8db3879d2d7a1d690e5da
Instruction Fuzzy Hash: 0551E071A043056BE700DE94DC81BAFB7E8EFA8314F40052DF94496352EB25AF598BE2

Function 20171940 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 345COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 20171B17
block, xrefs: 20171A90
misuse, xrefs: 20171B21
%s at line %d of [%.10s], xrefs: 20171B26

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$block$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-4016964285
Opcode ID: 5cb0d5e0c13a6565b717117c82a2fdb07bff24ea75e18e2882bf8fd56470c0cc
Instruction ID: 6726f78309d785701ef3ee39765d160541c88218eadbb66825d23c10d0c673b4
Opcode Fuzzy Hash: 5cb0d5e0c13a6565b717117c82a2fdb07bff24ea75e18e2882bf8fd56470c0cc
Instruction Fuzzy Hash: 2DC1EDB1904244DFDB11CFA8CC84A9A7BB8FF04314F058569FD499B226E735DB54CB92

Function 2011FED0 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 257COMMON

Download Yara Rule

Strings

%llu, xrefs: 2011FFF7
no more rows available, xrefs: 2012006F
abort due to ROLLBACK, xrefs: 20120068
unknown error, xrefs: 2012003E
another row available, xrefs: 20120076, 20120081
%llu, xrefs: 2011FF3C

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %llu$%llu$abort due to ROLLBACK$another row available$no more rows available$unknown error
API String ID: 0-1539118790
Opcode ID: a05ab5e6728d32de5d84df2296d7f8aea53135d44b65d200094603b425801365
Instruction ID: 6fdfad25cce687d0c15dbe300a20b787985d94396ad53a925be15b044fc3661f
Opcode Fuzzy Hash: a05ab5e6728d32de5d84df2296d7f8aea53135d44b65d200094603b425801365
Instruction Fuzzy Hash: C89113316047109FD7098F58DC84BEAB7E1FF85358F04066DF9499B292D73AEA46CB82

Function 202270B0 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 227COMMON

Download Yara Rule

Strings

API called with finalized prepared statement, xrefs: 20227201
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2022720D
invalid rootpage, xrefs: 2022715C, 2022730E
misuse, xrefs: 20227217
%s at line %d of [%.10s], xrefs: 2022721C
orphan index, xrefs: 202272C2

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid rootpage$misuse$orphan index
API String ID: 0-165706444
Opcode ID: db02d5743d662a1b31f202e943aa8a48bce1d94034bcfcfee35edd7cc7684ec9
Instruction ID: 623323e7eb116c80ce94e81e8bb9fe8f306f82f83fc127330ac10a8023e83d35
Opcode Fuzzy Hash: db02d5743d662a1b31f202e943aa8a48bce1d94034bcfcfee35edd7cc7684ec9
Instruction Fuzzy Hash: 19615871A08B41AFEB218FE0BC81B5777D9AFA1215F1404ABFD0486142E731EA74C7A2

Function 20113A50 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 172COMMON

Download Yara Rule

Strings

no such schema, xrefs: 20113BEA
bad page value, xrefs: 20113BDC
cannot delete, xrefs: 20113A82
cannot insert, xrefs: 20113BF1, 20113C52
read-only, xrefs: 20113A71
bad page number, xrefs: 20113BE3

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: bad page number$bad page value$cannot delete$cannot insert$no such schema$read-only
API String ID: 0-1499782803
Opcode ID: 42d50442ecfad7ce6b0009917cc9b73abbea7d2def218719e210e4e65492bfe0
Instruction ID: f85e47b354df9ede2546d9861065b69cd492a782cfe3c50d13389cb6ceffac69
Opcode Fuzzy Hash: 42d50442ecfad7ce6b0009917cc9b73abbea7d2def218719e210e4e65492bfe0
Instruction Fuzzy Hash: 38513571A082009BDF188B98DCC5F96B7A8AF40224F144479FD458B216E73AEEC5D7A6

Function 2022B0E0 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 117COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2022B108
misuse, xrefs: 2022B112
%s at line %d of [%.10s], xrefs: 2022B117
invalid, xrefs: 2022B13E
NULL, xrefs: 2022B0F4
unopened, xrefs: 2022B145
API call with %s database connection pointer, xrefs: 2022B0F9

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$NULL$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse$unopened
API String ID: 0-538076154
Opcode ID: dbb0ad516e9ee622d5b7619c8462fa0c3c97e85a965c5538c895aa895c4d141d
Instruction ID: 89caa320b5b3f30ccb0edc2028938dce02b8ac80489509fd1a662cfe953410fa
Opcode Fuzzy Hash: dbb0ad516e9ee622d5b7619c8462fa0c3c97e85a965c5538c895aa895c4d141d
Instruction Fuzzy Hash: EE314471504B0AAFD7134FF47C90B8B77B5AF55328F00052AF9A862103EB64EA358792

Function 20126F30 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 83COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 20126F60
misuse, xrefs: 20126F6A
%s at line %d of [%.10s], xrefs: 20126F6F
invalid, xrefs: 20126F4F
bad parameter or other API misuse, xrefs: 20126F7E
out of memory, xrefs: 20126F39, 20126FA0
API call with %s database connection pointer, xrefs: 20126F54

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$bad parameter or other API misuse$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse$out of memory
API String ID: 0-2911740470
Opcode ID: ebf189450fca255c237851d8333b4ef9833c2d6d67949457cb0fe0c4ebb41b5d
Instruction ID: 5f6fa70afe787faec29a8e883d5579c8be9f1a2cb8d81b4fc4bf1890275a1f24
Opcode Fuzzy Hash: ebf189450fca255c237851d8333b4ef9833c2d6d67949457cb0fe0c4ebb41b5d
Instruction Fuzzy Hash: 6D214271204F309FEF2543D8BDA1BD763A37BC0318F298429F5955628AD635EE8A9281

Function 201106F0 Relevance: 15.2, APIs: 10, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0b94bd775ee0602e23e57e2c13a515e582db30c7af77fe4b6443f3ca20ad438
Instruction ID: aef6d983caa0c89b05678323efe75381fa0a23fb3e9c0e29bad8ff5fbe12f3d3
Opcode Fuzzy Hash: a0b94bd775ee0602e23e57e2c13a515e582db30c7af77fe4b6443f3ca20ad438
Instruction Fuzzy Hash: 577106B1D043048BE709DF94C881B9AB3E5AF94214F14017DED85AB243E7B6EF99CB91

Function 201D6380 Relevance: 15.1, APIs: 10, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d5d52a9ac807013b7aa700f93c6eb5d0a7670092ba2093ab9fc4344f3b15413
Instruction ID: 89189a0b360ee23a94c48102e1f1ec4f0952499dc01bf6ee184c1ea5e3114c39
Opcode Fuzzy Hash: 7d5d52a9ac807013b7aa700f93c6eb5d0a7670092ba2093ab9fc4344f3b15413
Instruction Fuzzy Hash: 2341A071408B00AFD7125FA9DC89B5777BCBF10218F000528FD0692632EB79EA58EBE1

Function 2014F4B0 Relevance: 15.1, APIs: 10, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d47789057f54d3d5d235375a09c406a209fee87bea1c44866fc0f5d3bf2f426b
Instruction ID: 869d4e9d0e011b8e95fd92865947df7e7077daf1e2ad9ba268a4d3935dc948fb
Opcode Fuzzy Hash: d47789057f54d3d5d235375a09c406a209fee87bea1c44866fc0f5d3bf2f426b
Instruction Fuzzy Hash: 4621E2B2D0021536F302AEE09D06FEF729C9F65246F48446DFE14A6252FB34DB5986E3

Function 2010E170 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 445COMMON

Download Yara Rule

Strings

snippet, xrefs: 20181200
fts5vocab, xrefs: 20181340
1 , xrefs: 20181281, 2018130F
fts5, xrefs: 20181053, 20181395, 201813E7
unable to delete/modify user-function due to active statements, xrefs: 201813BF, 201814B8
1 , xrefs: 201812BF
fts5_source_id, xrefs: 2018148D, 201814E0

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: fts5$fts5_source_id$fts5vocab$snippet$unable to delete/modify user-function due to active statements$1 $1
API String ID: 0-945938692
Opcode ID: 14fed352dcb63adebd22400731852021528cf8fd4e8abf8af9dd85d4a71a40ef
Instruction ID: cfd13c026392ea580ce8385806ec6d6e5e30bdbd7dae3f39ea24077c787a917a
Opcode Fuzzy Hash: 14fed352dcb63adebd22400731852021528cf8fd4e8abf8af9dd85d4a71a40ef
Instruction Fuzzy Hash: 88F1A0B1904B019BE7158FA4DCC9B4BBBADBF40344F104528F90596252E7B9EB54CFD2

Function 2020FB30 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 324COMMON

Download Yara Rule

Strings

API called with finalized prepared statement, xrefs: 2020FB7A
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2020FB96
misuse, xrefs: 2020FBA0
%s at line %d of [%.10s], xrefs: 2020FBA5
API called with NULL prepared statement, xrefs: 2020FB65

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-860711957
Opcode ID: a075509846da3b0fb81d89022dee166c8d4e84eed5bf737451e0fc8054a1a7c2
Instruction ID: 860a83d0f39b6672a881d197e3e2de88bb51d0780f5df2aa8e75f42417340d56
Opcode Fuzzy Hash: a075509846da3b0fb81d89022dee166c8d4e84eed5bf737451e0fc8054a1a7c2
Instruction Fuzzy Hash: 82B125B09447058FE760CFB4DC45B1777E6BF64308F04052EE98987A42E779E929CB92

Function 20181710 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 235COMMON

Download Yara Rule

Strings

rank, xrefs: 20181824
%z%s%Q, xrefs: 2018180D
%z, %Q HIDDEN, %s HIDDEN), xrefs: 20181831
CREATE TABLE x(, xrefs: 201817D9

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %z%s%Q$%z, %Q HIDDEN, %s HIDDEN)$CREATE TABLE x($rank
API String ID: 0-3324442540
Opcode ID: 9e5f7c342c5d57e772faba1b993139e3175bec50f1a0423a0f52ffbd8fd5394a
Instruction ID: a84e1b5b83de92f63c564564890eb64420178c7213dc7fb105bd5778b269acad
Opcode Fuzzy Hash: 9e5f7c342c5d57e772faba1b993139e3175bec50f1a0423a0f52ffbd8fd5394a
Instruction Fuzzy Hash: 5281B072A04200ABEB018FA4DC85B9AB7ECFF55259F040629FD44E7221D739DA64DBD2

Function 2014E320 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 177COMMON

Download Yara Rule

Strings

API called with finalized prepared statement, xrefs: 2014E36A
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2014E376
misuse, xrefs: 2014E380
%s at line %d of [%.10s], xrefs: 2014E385

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3620335220
Opcode ID: aad7b439c5c9ac557da093ec2c15fe30b39ca8ce58e6cab63b229935f0bcf98b
Instruction ID: ef7ada3ef0d649a58b19c2d0486e402c04797f1fa83566f2a1e0d207106eeba5
Opcode Fuzzy Hash: aad7b439c5c9ac557da093ec2c15fe30b39ca8ce58e6cab63b229935f0bcf98b
Instruction Fuzzy Hash: 5D51A571D04A44DBE7029FA4DC89B9B37E8BF00359F044025FE05D6261D779EA58EBE2

Function 201F74A0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 175COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 201F74CD
misuse, xrefs: 201F74D7
unable to close due to unfinalized statements or unfinished backups, xrefs: 201F75D1
%s at line %d of [%.10s], xrefs: 201F74DC
invalid, xrefs: 201F74BC
API call with %s database connection pointer, xrefs: 201F74C1

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 0-3800776574
Opcode ID: 4fa75376c9e606b6433f49f9298e91c0e24d130e2828ed90bf85ba0f28056f08
Instruction ID: 0f6ec65bf3122709c2566c3884436b33044c1cd844d380abb581c3b4f6fc52a9
Opcode Fuzzy Hash: 4fa75376c9e606b6433f49f9298e91c0e24d130e2828ed90bf85ba0f28056f08
Instruction Fuzzy Hash: 7C512771904B04ABE3119BF8AC8DBDB77A9BF50714F040428F959D3211EB34FB96C6A6

Function 2019BCF0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 103COMMON

Download Yara Rule

Strings

undersize RTree blobs in "%q_node", xrefs: 2019BDA1
SELECT length(data) FROM '%q'.'%q_node' WHERE nodeno = 1, xrefs: 2019BD67
PRAGMA %Q.page_size, xrefs: 2019BD03

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: PRAGMA %Q.page_size$SELECT length(data) FROM '%q'.'%q_node' WHERE nodeno = 1$undersize RTree blobs in "%q_node"
API String ID: 0-3485589083
Opcode ID: b160a3dc0d1e0c10dd7a4831a4d8b5dc66f95aaebf847ef406a4c0f8f8ee9454
Instruction ID: 36c5b025e6ecca42ee22883ffae71bc47bbeeade1b7b044c0026d51dfe1bd9d9
Opcode Fuzzy Hash: b160a3dc0d1e0c10dd7a4831a4d8b5dc66f95aaebf847ef406a4c0f8f8ee9454
Instruction Fuzzy Hash: E83125B1A04609ABD3058BE4CEC4A9AB3FCFB54219F040525FD05D2211D77DEA58DBE1

Function 201F32F0 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 464COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 201F36B8, 201F36FD, 201F375D, 201F380E
%s at line %d of [%.10s], xrefs: 201F36C7, 201F370C, 201F376C, 201F381D
database corruption, xrefs: 201F36C2, 201F3707, 201F3767, 201F3818

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 44566c3a58e4a3d198c97f0d6a550a5f69003326bc7fbf68597dfa378f967535
Instruction ID: e24fe72cec10076b4a730b5794262cbdfcfe1c33e1af5619583f9840d7d4a849
Opcode Fuzzy Hash: 44566c3a58e4a3d198c97f0d6a550a5f69003326bc7fbf68597dfa378f967535
Instruction Fuzzy Hash: BFF17870A047459FD304DFA8C8C8BA6BBE0FF44314F444259E944CB252E739EA9ADBE1

Function 2011E420 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 380COMMON

Download Yara Rule

Strings

no more rows available, xrefs: 2011E79C
d, xrefs: 2011E71D
abort due to ROLLBACK, xrefs: 2011E795
unknown error, xrefs: 2011E76B
%c%04d-%02d-%02d %02d:%02d:%06.3f, xrefs: 2011E717
another row available, xrefs: 2011E7A3, 2011E7AE

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %c%04d-%02d-%02d %02d:%02d:%06.3f$abort due to ROLLBACK$another row available$d$no more rows available$unknown error
API String ID: 0-322231948
Opcode ID: f14666b20b2e7cc27ed8513aa0de3225ecac0951c20eba3f928c577cb778220f
Instruction ID: ff2a01239b9e1c4b8001f2f0dddebd5b35c948d13678a474e5fe873499f78fc2
Opcode Fuzzy Hash: f14666b20b2e7cc27ed8513aa0de3225ecac0951c20eba3f928c577cb778220f
Instruction Fuzzy Hash: EEE1CC716083409FD748CBE8C884B9BF7E5BF98304F54492DF98597241E3B6EA85CB92

Function 201228E5 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 346COMMON

Download Yara Rule

Strings

unable to validate the inverted index for FTS5 table %s.%s: %s, xrefs: 20122AA0
malformed inverted index for FTS5 table %s.%s, xrefs: 20122A8A
INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');, xrefs: 201229F1

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');$malformed inverted index for FTS5 table %s.%s$unable to validate the inverted index for FTS5 table %s.%s: %s
API String ID: 0-3572959941
Opcode ID: 7e63f2abcb803378093129d03b8db5eb5762bcb8d2f24ea7d1493ba5ea783a1e
Instruction ID: 38ae9893f6f35b134e36c653dcdf8e257e23b655328b0b4f2c0dbd370e1f81ef
Opcode Fuzzy Hash: 7e63f2abcb803378093129d03b8db5eb5762bcb8d2f24ea7d1493ba5ea783a1e
Instruction Fuzzy Hash: 85413971909A10AFD3198FA8ECC8EAB77ACFF44255F040529F905C2521D739D748DBE2

Function 20109700 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 277COMMON

Download Yara Rule

Strings

(FK), xrefs: 201098D3

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: (FK)
API String ID: 0-1642768157
Opcode ID: b56abf4646723de29c9eaf2b0f00cf01322ae41bab15fb4d8fd53eec1d2ebdd1
Instruction ID: cbc7e66486b9010ae747b8e6747ca6a774e0d26cb600197dfce138e2e8ec3ee3
Opcode Fuzzy Hash: b56abf4646723de29c9eaf2b0f00cf01322ae41bab15fb4d8fd53eec1d2ebdd1
Instruction Fuzzy Hash: C081C7777152009FE7109F98EC40B56F3A2FB95335F20466EF589876A1E732EA10DB50

Function 20288D80 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 271COMMON

Download Yara Rule

Strings

readonly_shm, xrefs: 20288F52
%s-shm, xrefs: 20288DF2
winOpenShm, xrefs: 20288FB9

Memory Dump Source

Source File: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s-shm$readonly_shm$winOpenShm
API String ID: 0-2815843928
Opcode ID: 84f91c6bf771bd26922c619bf00aeab026bb42cfd8ccc4a43b8805bbdb0580e6
Instruction ID: 697df8290e4b3d5c73a01a89e06ea02cd72a1ad9ebb717820a859f9d57e9f5e9
Opcode Fuzzy Hash: 84f91c6bf771bd26922c619bf00aeab026bb42cfd8ccc4a43b8805bbdb0580e6
Instruction Fuzzy Hash: DE911274908B429BD7019FA4DC85B1777ACBF10304F04052AFE45D7A91E739E928EBE2

Function 2011EB00 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 187COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2011ECCB
%s at line %d of [%.10s], xrefs: 2011ECDA
database corruption, xrefs: 2011ECD5
%.*s%s, xrefs: 2011EC88

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %.*s%s$%s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-894757972
Opcode ID: aa18d17b684ab46a9fa0b4d175429820a582d683594766a84814f26b93aa49f5
Instruction ID: 839e35e23b2684a45252f9348350a52f7c1e606c6bb2df479f657776fb5561c4
Opcode Fuzzy Hash: aa18d17b684ab46a9fa0b4d175429820a582d683594766a84814f26b93aa49f5
Instruction Fuzzy Hash: BF61AD71A043058BD718CFA4C881B9AF7E2AF88314F04497DE8499B351E775EE85CB92

Function 20111120 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 169COMMON

Download Yara Rule

Strings

XD3 , xrefs: 20111253
main, xrefs: 201111A6
rbu_memory, xrefs: 201111F5

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: XD3 $main$rbu_memory
API String ID: 0-2895593074
Opcode ID: de0e6ab7271e877df9af8385dc027a45ec8171e94718b0053e892609d0dddcc0
Instruction ID: de6571d2de7eccec37d07c49565e3426a2c832a3f075399acddb1323886d052f
Opcode Fuzzy Hash: de0e6ab7271e877df9af8385dc027a45ec8171e94718b0053e892609d0dddcc0
Instruction Fuzzy Hash: 4B51DF716047019FDB09CFA9DC80B9AF3E8BB55214F204439FA45D7611EB39EA89CB91

Function 200F9DA0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 160COMMON

Download Yara Rule

Strings

[%!g,%!g],, xrefs: 200F9E7E
[%!g,%!g]], xrefs: 200F9EC0

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: [%!g,%!g],$[%!g,%!g]]
API String ID: 0-3388633204
Opcode ID: d76e92d307eb85b8dcd3fc83346c4ed66aad2fb7addc63450b3c6fc9a897488b
Instruction ID: 190ed69a254301de6b84c82c6e41458fbc663dd9b24395a34a9f75bb0ab42f5f
Opcode Fuzzy Hash: d76e92d307eb85b8dcd3fc83346c4ed66aad2fb7addc63450b3c6fc9a897488b
Instruction Fuzzy Hash: EC510530D04B098BE711DFA9CCC9B1BB7B4BF55304F004639F8099A251EB75A999EBD2

Function 2011F330 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 126COMMON

Download Yara Rule

Strings

malformed inverted index for FTS%d table %s.%s, xrefs: 2011F3F3
unable to validate the inverted index for FTS%d table %s.%s: %s, xrefs: 2011F418
INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');, xrefs: 2011F33F

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');$malformed inverted index for FTS%d table %s.%s$unable to validate the inverted index for FTS%d table %s.%s: %s
API String ID: 0-2809892521
Opcode ID: 3cd3752d6b7f206b7b93ca2380b0379a166718e93d453dcc49138521ee260e06
Instruction ID: bbbabda9c69ca0d642b54b14a6513f706de350a35a6d1cf073d0b1deb34b5af6
Opcode Fuzzy Hash: 3cd3752d6b7f206b7b93ca2380b0379a166718e93d453dcc49138521ee260e06
Instruction Fuzzy Hash: 78411571909A419BE3099FA8EC88F9BB7ACFF40255F040539FD01C2121D7399699EBE2

Function 20126E30 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 30COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 20126E58
misuse, xrefs: 20126E62
%s at line %d of [%.10s], xrefs: 20126E67
invalid, xrefs: 20126E47
API call with %s database connection pointer, xrefs: 20126E4C

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse
API String ID: 0-3670841456
Opcode ID: 836acf589800dbaac8dc3a9feb07339f7018ba04c40aad695db4d907f04cd6a6
Instruction ID: db426fabc2c3bb446a38cc474f171ab2140424436ec4d9f4bbe28cfded2cafc5
Opcode Fuzzy Hash: 836acf589800dbaac8dc3a9feb07339f7018ba04c40aad695db4d907f04cd6a6
Instruction Fuzzy Hash: 2BF05528600948EFFB1CD2C4ECC2BE97B923B94B0DF81004CF3506E1CBC65A8D835240

Function 20126EB0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 29COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 20126EDB
misuse, xrefs: 20126EE5
%s at line %d of [%.10s], xrefs: 20126EEA
invalid, xrefs: 20126ECA
API call with %s database connection pointer, xrefs: 20126ECF

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse
API String ID: 0-3670841456
Opcode ID: 39b2d6c7a1cf8591cbb961568667df3c69c4f11ed1cb0191539bdc733f4c7fcd
Instruction ID: f2e5d8c9d7a902bc7a38466c862bbda5559e18c0ddc83cba32a7c4f3c6363158
Opcode Fuzzy Hash: 39b2d6c7a1cf8591cbb961568667df3c69c4f11ed1cb0191539bdc733f4c7fcd
Instruction Fuzzy Hash: 46F0E520704D58AFFB1082D1FDE1FD666C63790706F8110A4F710AE1EAEA548D805201

Function 201130F0 Relevance: 12.2, APIs: 8, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af1bf0cb4f33a17cf4f277a36c5cf68c556654094956b2179fd046522591d547
Instruction ID: aa0f83463bd5c4229fad09dd606bd8622e2821ef3dcdca23ee67d2d55e709dca
Opcode Fuzzy Hash: af1bf0cb4f33a17cf4f277a36c5cf68c556654094956b2179fd046522591d547
Instruction Fuzzy Hash: 55517171608200AFDB40EB64FC45FDA7BE2AF95320F0945B8F158872B6E631DD519B41

Function 2010B6E0 Relevance: 12.1, APIs: 8, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f400f5f84f4695c5234106c0ecaa40a2322bf7433f692480c49db7fb3f3a6e3
Instruction ID: 55dc46445608fd62d7e55c8edee012ca9e1367bb17696969040d9018b712b43b
Opcode Fuzzy Hash: 1f400f5f84f4695c5234106c0ecaa40a2322bf7433f692480c49db7fb3f3a6e3
Instruction Fuzzy Hash: 5811ECF58041047FE6049B50DC45FAB777AEFE1610F440464FC4587162FB36DE19A2A2

Function 202273E0 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 369COMMON

Download Yara Rule

Strings

sqlite_master, xrefs: 202273FD
sqlite_temp_master, xrefs: 202273F2
00 , xrefs: 20227464
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 2022776D
ase, xrefs: 2022768D

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: 00 $SELECT*FROM"%w".%s ORDER BY rowid$ase$sqlite_master$sqlite_temp_master
API String ID: 0-4077678746
Opcode ID: c906639e9a3838183a53266c991dbe362c0ecf431b44026739c0c5b08c48112d
Instruction ID: afdbda812ffef597e129d6e0fefe902059b31a39519d6d529a76821b59dd3add
Opcode Fuzzy Hash: c906639e9a3838183a53266c991dbe362c0ecf431b44026739c0c5b08c48112d
Instruction Fuzzy Hash: EBE105B0A08B429FD311CFE4DC80B6ABBE4BFA5304F04452EF94497252E775E964CB92

Function 20167920 Relevance: 10.8, APIs: 7, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c0a64c567377825aa826e38cd61e7aab24cd6bc2d57a6723dcf8eefeade29f
Instruction ID: afa15f6a2f4e4fba22eadc9246681089d43f14f4c37f568487fde4a49cb5c801
Opcode Fuzzy Hash: d7c0a64c567377825aa826e38cd61e7aab24cd6bc2d57a6723dcf8eefeade29f
Instruction Fuzzy Hash: 17B1D0B1A04702AFD704DFA8CC81B5ABBE5FF88214F48452DF949D3712E735EA648B91

Function 2010E260 Relevance: 10.8, APIs: 7, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63ba91eb21d3db8aaa893d3d92b599102540b93a5e279c7dddff0ea02403ae36
Instruction ID: 5a00e36146651f6edf80d63e1301c87383a4dfa5d0634fda106c689bde907759
Opcode Fuzzy Hash: 63ba91eb21d3db8aaa893d3d92b599102540b93a5e279c7dddff0ea02403ae36
Instruction Fuzzy Hash: C3A137756143108FD704CFA9C89179ABBF2AF84218F044A6DFDD4DB252E735DE458B42

Function 20105930 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 234COMMON

Download Yara Rule

Strings

unknown tokenizer: %s, xrefs: 20105B28
CREATE TABLE x(input, token, start, end, position), xrefs: 20105933
simple, xrefs: 20105A38, 20105A84, 20105A95, 20105B27

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: CREATE TABLE x(input, token, start, end, position)$simple$unknown tokenizer: %s
API String ID: 0-2679805236
Opcode ID: 46949a94f8c1aaced14108ffd1920016943fb7f36ba1bfc85102efe03471cc4b
Instruction ID: 1d80ab08150300468aecff2f2cc3ca8d44a26731e30c1b409b73a35c432775d5
Opcode Fuzzy Hash: 46949a94f8c1aaced14108ffd1920016943fb7f36ba1bfc85102efe03471cc4b
Instruction Fuzzy Hash: 1671E471A043068FD704CFA8CC84A97B7EAFF84254F044529ED89D7212EB75EB49CB92

Function 2020F0E0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 216COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2020F1DC, 2020F31D
misuse, xrefs: 2020F1E6, 2020F327
%s at line %d of [%.10s], xrefs: 2020F1EB, 2020F32C
unable to delete/modify user-function due to active statements, xrefs: 2020F157, 2020F298

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$unable to delete/modify user-function due to active statements
API String ID: 0-3864549341
Opcode ID: 9c65f552228dd7663d276489761fc35f7b290ea411aa2ca97cfc625b3edbe899
Instruction ID: 4f8846ceb296dacb30745de1b71adeff6686e20ea8fcee27da7c89c83fa2be6c
Opcode Fuzzy Hash: 9c65f552228dd7663d276489761fc35f7b290ea411aa2ca97cfc625b3edbe899
Instruction Fuzzy Hash: 3E616C71680B42ABE351CFA0CC85F97B7A6BF61304F00412AF91856AC3E7B5E67487E1

Function 201944F0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 208COMMON

Download Yara Rule

Strings

instance, xrefs: 201946BF
col, xrefs: 20194679
row, xrefs: 201946A1
fts5vocab: unknown table type: %Q, xrefs: 201946DE

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: col$fts5vocab: unknown table type: %Q$instance$row
API String ID: 0-195232091
Opcode ID: dff255b7e9a9b780d759da9e72aa1c4a73f570ebc5c0eed1d6e86846f147d08d
Instruction ID: 9ad6e39b42affa09aeb96bb8cda0423947f71e0a746b5d7c4bd26ad7eedf2d1b
Opcode Fuzzy Hash: dff255b7e9a9b780d759da9e72aa1c4a73f570ebc5c0eed1d6e86846f147d08d
Instruction Fuzzy Hash: 1A6128B1909B089BD7069FE8ACC6E8B3798BB45309F010534ED05D3211E738AB59DBE6

Function 201209C2 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

cannot UPDATE a subset of columns on fts5 contentless-delete table: %s, xrefs: 20120B3B

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: cannot UPDATE a subset of columns on fts5 contentless-delete table: %s
API String ID: 0-2869280805
Opcode ID: 37f4f039078a510347c65a7ef776d4ecc9dc07d704caa34e1b19d59f937a4761
Instruction ID: 4b5bfc9f6999bd8285a4f3cb84556c7528e7c48d262a7adde0531846ae094bd9
Opcode Fuzzy Hash: 37f4f039078a510347c65a7ef776d4ecc9dc07d704caa34e1b19d59f937a4761
Instruction Fuzzy Hash: 1641CE766017159FD7119F98EC80AA6F3E4FF98325B004ABAF60487622E772EE54C790

Function 20113F30 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 169COMMON

Download Yara Rule

Strings

remove_diacritics=1, xrefs: 20113FA2
remove_diacritics=2, xrefs: 20114021
tokenchars=, xrefs: 2011406A
separators=, xrefs: 201140A3
remove_diacritics=0, xrefs: 20113FE1

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: remove_diacritics=0$remove_diacritics=1$remove_diacritics=2$separators=$tokenchars=
API String ID: 0-131617836
Opcode ID: 24c795dce354df5929a600a71855fae681d5b827998b2c4c1c34d73367537e67
Instruction ID: 83fd24630d9e5626904e29691ceadef0d03be7bd04a4a466bd5bcac9d46b86dc
Opcode Fuzzy Hash: 24c795dce354df5929a600a71855fae681d5b827998b2c4c1c34d73367537e67
Instruction Fuzzy Hash: 3B512576A041028BD308CF95D481BE6F7B1BB4AB24F9541B8F9864B206D732EFC6CB51

Function 20104CE0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 160COMMON

Download Yara Rule

Strings

X[1 , xrefs: 20193F69
temp, xrefs: 20193F91
,[1 , xrefs: 20193F61
wrong number of vtable arguments, xrefs: 20193FA9

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: ,[1 $X[1 $temp$wrong number of vtable arguments
API String ID: 0-2874922790
Opcode ID: 0c01e2ed66d40cf8c9ee9a60498e2c8ebcedc808aa7033013f463a8e6cbe82a7
Instruction ID: 58df2ef602c876924dd8cded2f5c10abea3db3f9102b05fd50c821aabf697fae
Opcode Fuzzy Hash: 0c01e2ed66d40cf8c9ee9a60498e2c8ebcedc808aa7033013f463a8e6cbe82a7
Instruction Fuzzy Hash: 7651B0B59043098FC714CF98D48199AFBF1BF89304F444A6DF58597312D732EA4ACB92

Function 20108C40 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 20108D35
winAccess, xrefs: 20108D60

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 0-1873940834
Opcode ID: ddbce7c76454d58f32be55545dcc50d33cd0c2b573f6c65e5a5f31971fd912f4
Instruction ID: 6431e539cdcd5b46dc1196f50bdedad50ce7ef92230a39f17b2fd2cc341645f6
Opcode Fuzzy Hash: ddbce7c76454d58f32be55545dcc50d33cd0c2b573f6c65e5a5f31971fd912f4
Instruction Fuzzy Hash: E7414B7290D7019BD3009FE88C86A9AFBE6BFA4350F450B29FDD5526E1D730DA84D782

Function 20219350 Relevance: 10.6, APIs: 7, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f301a0ead1c06e7695e74a1f27da31574b64075d1874b11e2b608354c13d9587
Instruction ID: 97c5a67048093dfcb176bb273aa098cc706759f902f418e0f9fb8b154e414697
Opcode Fuzzy Hash: f301a0ead1c06e7695e74a1f27da31574b64075d1874b11e2b608354c13d9587
Instruction Fuzzy Hash: 92516E70908A419BD7065FB8DDC8A1777FCBF10249F000525FD06E2522DB39E5A9FAE2

Function 201A15C0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 135COMMON

Download Yara Rule

Strings

%!0.15g, xrefs: 201A160A
JSON cannot hold BLOB values, xrefs: 201A16D9
null, xrefs: 201A15EE

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %!0.15g$JSON cannot hold BLOB values$null
API String ID: 0-3074873597
Opcode ID: d5f1f10a892a50caf01fa1432133259b97e0420cb5270d6b26083f6eb3c04fe0
Instruction ID: 542b7d837fabf7c667dd0b19e1e272e94d477a54918fda0f3dde91b203049445
Opcode Fuzzy Hash: d5f1f10a892a50caf01fa1432133259b97e0420cb5270d6b26083f6eb3c04fe0
Instruction Fuzzy Hash: 2F41ABBD600700ABE3105BD4EC86BEB77A4DB61329F18052AF554C15C3D3E99B98D7E1

Function 20111D50 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 132COMMON

Download Yara Rule

Strings

CREATE TABLE x( name TEXT, path TEXT, pageno INTEGER, pagetype TEXT, ncell INTEGER, payload INTEGER, unused INTEGER, mx_payload INTEGER, pgoffset INTEGER, pgsize INTEGER, schema TEXT HIDDEN, aggregate BOOLEAN HIDDEN), xrefs: 20111E2C
no such database: %s, xrefs: 20111E05

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: CREATE TABLE x( name TEXT, path TEXT, pageno INTEGER, pagetype TEXT, ncell INTEGER, payload INTEGER, unused INTEGER, mx_payload INTEGER, pgoffset INTEGER, pgsize INTEGER, schema TEXT HIDDEN, aggregate BOOLEAN HIDDEN)$no such database: %s
API String ID: 0-1404816483
Opcode ID: 707f6f28d26d820153550a67d4ba8376913ae5ea93e9ba295bdfdc05e6b60b93
Instruction ID: 3d2ddf1d4d498a1f00790449251307c142d7f2df6666c39babeb1e9d6a9d9808
Opcode Fuzzy Hash: 707f6f28d26d820153550a67d4ba8376913ae5ea93e9ba295bdfdc05e6b60b93
Instruction Fuzzy Hash: 873157716003096BC3105FE9DC41BABF7D8FF95225F010179FD489B241EA7AEA018BE1

Function 2017C650 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

PRAGMA %Q.data_version, xrefs: 2017C67C

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: PRAGMA %Q.data_version
API String ID: 0-2870853266
Opcode ID: 0de6db4e25b3f816fbfd2376856c27ead62be3660b8de1b720d0a6fe17e2f955
Instruction ID: 1163ff5d81f6e85a79c91d773cd7609fc5c5386af940791d746c3e9510047280
Opcode Fuzzy Hash: 0de6db4e25b3f816fbfd2376856c27ead62be3660b8de1b720d0a6fe17e2f955
Instruction Fuzzy Hash: 4211D876B003044FE700EE59FC41697F7E5EF98222F544539F90482711EB36AA5E9BB2

Function 202D05B4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,?,?,?,579822A2,?,202D06F5,?,?), ref: 202D0675

Strings

api-ms-, xrefs: 202D060B
ext-ms-, xrefs: 202D061F

Memory Dump Source

Source File: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 3706fcddc056e1687592ff0c4a9112f7f93a5064be1e769c4508818952fead5d
Instruction ID: 3691c49e90b8773b564e34995abc3ca42c060fc077dcf12ca7b31768906cc15d
Opcode Fuzzy Hash: 3706fcddc056e1687592ff0c4a9112f7f93a5064be1e769c4508818952fead5d
Instruction Fuzzy Hash: BA21A533A05612ABD7129FA5DCC4B8E775CAF81770F100122EE05A73E1DA38EE24DAD4

Function 201A31F0 Relevance: 9.5, APIs: 6, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f106483b3a70603a9d97fd45cc81e5f7020271583cd65cdbae31b82314d6bbc
Instruction ID: 9fa2e0560991627e349803f61c0c05ef81ad075f8e7d14e494fe1f30efdb021e
Opcode Fuzzy Hash: 2f106483b3a70603a9d97fd45cc81e5f7020271583cd65cdbae31b82314d6bbc
Instruction Fuzzy Hash: 65F1F379A083019FD701CFA8D8C07AABBE0BF45224F14466DF99997242D735EF46CB91

Function 20124E00 Relevance: 9.2, APIs: 6, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aa7b4f284aa0a7aceae794a110f59fd3edb0512ddcf5eac4399453e742c36fa
Instruction ID: 293aa83fc99d79756284b5feb626dc9f3d368e0addcbce58906d517141233945
Opcode Fuzzy Hash: 6aa7b4f284aa0a7aceae794a110f59fd3edb0512ddcf5eac4399453e742c36fa
Instruction Fuzzy Hash: 4F81A071A08B108FE701DF98ED85B5A77E8FF80319F440429FA4497261D739EA58DBD2

Function 20116DA0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 364COMMON

Download Yara Rule

Strings

recursively defined fts5 content table, xrefs: 20116DE2

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: recursively defined fts5 content table
API String ID: 0-437020801
Opcode ID: bb9b20de29c2732d623b3eec71e247099b057af7a6fcb4f9439ba3164ea41106
Instruction ID: d5fc8ea17dc091eeeaa97386fbd094b448500e4c8946f84b9186a75859e0b9ca
Opcode Fuzzy Hash: bb9b20de29c2732d623b3eec71e247099b057af7a6fcb4f9439ba3164ea41106
Instruction Fuzzy Hash: A6D1CD75908301CFD709CF59D880796F7F0EF89324F554A6EE8848B242D77ADA86CB92

Function 20196180 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 335COMMON

Download Yara Rule

Strings

expected integer, got "%.*s", xrefs: 2019648D
NEAR, xrefs: 2019642A
fts5: syntax error near "%.*s", xrefs: 20196436
fts5 expression tree is too large (maximum depth %d), xrefs: 20196349

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: NEAR$expected integer, got "%.*s"$fts5 expression tree is too large (maximum depth %d)$fts5: syntax error near "%.*s"
API String ID: 0-2846580575
Opcode ID: bd38addb47975a77bda023ddedbb3e24bf885b575c91071cf6e6e5936ee19004
Instruction ID: 7874328ddc1289c56daa59ede4f814ccd5d91f9def98a3422826506fc9afd358
Opcode Fuzzy Hash: bd38addb47975a77bda023ddedbb3e24bf885b575c91071cf6e6e5936ee19004
Instruction Fuzzy Hash: B2C19BB590428AAFC7128FE4CC41B5AF7B8FF18314F154959E9499B242E375FA60CBB0

Function 2012C0F0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 276COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2012C115, 2012C160
%s at line %d of [%.10s], xrefs: 2012C124, 2012C16F
database corruption, xrefs: 2012C11F, 2012C16A

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: ba89163d60b44902b45b8b061988e6d82b9209e1e9c6955b872f8371c10e70b6
Instruction ID: 29c81a8aa979fd36208656cfdfb25be5fe4245764748cc0149b46459924232a0
Opcode Fuzzy Hash: ba89163d60b44902b45b8b061988e6d82b9209e1e9c6955b872f8371c10e70b6
Instruction Fuzzy Hash: 01A1A0756043119FC704DFA8DC80AAABBE1FFD8214F44496DFA4897316E731EA15CB92

Function 201FABF0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 204COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 201FAE0E
misuse, xrefs: 201FAE18
%s at line %d of [%.10s], xrefs: 201FAE1D
unable to delete/modify user-function due to active statements, xrefs: 201FAD61

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$unable to delete/modify user-function due to active statements
API String ID: 0-3864549341
Opcode ID: 67c32d4e9abeb5fc1e1b758c7b6391556be14775e5850b0623e590e1ca2088d4
Instruction ID: 0378257da4ad8509ac004c47292cbbe90864d40f4d92301693e18217967007d7
Opcode Fuzzy Hash: 67c32d4e9abeb5fc1e1b758c7b6391556be14775e5850b0623e590e1ca2088d4
Instruction Fuzzy Hash: 985125B2204308AFD7148F90DC84B6FB7F4FF89355F44492DF686966A2D336DA408B62

Function 200FA230 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 201COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 200FA45F, 200FA49D
misuse, xrefs: 200FA469, 200FA4A7
%s at line %d of [%.10s], xrefs: 200FA46E, 200FA4AC

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: 20836c6f2f793a0595b4c8f445255b827d27f154021079cd94ad55ea3b907f5e
Instruction ID: 5698cff934085b3d536b94ec14aff653a0099436383cd94562e0aa896294b715
Opcode Fuzzy Hash: 20836c6f2f793a0595b4c8f445255b827d27f154021079cd94ad55ea3b907f5e
Instruction Fuzzy Hash: C97159B06047489FE711CFA5C889B9BB7E4BF86308F04443CF94987252EB75EA45DB92

Function 2010A860 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 180COMMON

Download Yara Rule

Strings

bytecode, xrefs: 2010A96E
argument to %s() is not a valid SQL statement, xrefs: 2010A97C
stmt-pointer, xrefs: 2010A928
tables_used, xrefs: 2010A973, 2010A97B

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: argument to %s() is not a valid SQL statement$bytecode$stmt-pointer$tables_used
API String ID: 0-361449301
Opcode ID: 01e80b02b7d76b4e3a4638bd3007a565589ef3ebe133d863c375fc41be73af77
Instruction ID: d57245c3c5f940e44137f4fc8004e5a87f0e145bf61b7ea9aef66b7147531ece
Opcode Fuzzy Hash: 01e80b02b7d76b4e3a4638bd3007a565589ef3ebe133d863c375fc41be73af77
Instruction Fuzzy Hash: 3961CE716047018FE7108FA4D885B92B7E9FF44308F414929EDC687292E77AEA48CB91

Function 2021BF00 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 156COMMON

Download Yara Rule

Strings

NEAR, xrefs: 2021C03A
fts5: %s queries are not supported (detail!=full), xrefs: 2021C043
phrase, xrefs: 2021C035, 2021C042
fts5 expression tree is too large (maximum depth %d), xrefs: 2021C070

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: NEAR$fts5 expression tree is too large (maximum depth %d)$fts5: %s queries are not supported (detail!=full)$phrase
API String ID: 0-593389478
Opcode ID: aa44434763a19cd0ff6921b2109ba8487e5177ea3ed24a30748240f17fdc3e7d
Instruction ID: b4c065c42fe0860e950233181deb513bf464bcc4d74b705620c8d40322ea1da7
Opcode Fuzzy Hash: aa44434763a19cd0ff6921b2109ba8487e5177ea3ed24a30748240f17fdc3e7d
Instruction Fuzzy Hash: 1B41CF356002029BD7198EA8CC80B1AF3F4EF99264F20456BF84587613D776EDE6DB91

Function 201223D0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 150COMMON

Download Yara Rule

Strings

main, xrefs: 20122491
cannot detach database %s, xrefs: 201224C3, 20122547
database %s is locked, xrefs: 20122541
no such database: %s, xrefs: 201224B4

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: cannot detach database %s$database %s is locked$main$no such database: %s
API String ID: 0-3838832555
Opcode ID: 7f89d6af3cc31eed28f47a48b70d4b4d7ac9b5f8da2997639a255bafc0fd2b89
Instruction ID: 2843e0e83cc4ee307e0c25c278cb5670aee4f378d9d68170af3aa1dab8f73de0
Opcode Fuzzy Hash: 7f89d6af3cc31eed28f47a48b70d4b4d7ac9b5f8da2997639a255bafc0fd2b89
Instruction Fuzzy Hash: F6510471600610AFD71CDF85E890F9AB3E5BF98314F11855DE8588B392DB35EE41CBA1

Function 20124C00 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 143COMMON

Download Yara Rule

Strings

CREATE TABLE x(term, col, documents, occurrences, languageid HIDDEN), xrefs: 20124CCB
temp, xrefs: 20124C3E
invalid arguments to fts4aux constructor, xrefs: 20124C9E

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: CREATE TABLE x(term, col, documents, occurrences, languageid HIDDEN)$invalid arguments to fts4aux constructor$temp
API String ID: 0-537686372
Opcode ID: 6bd819fc731b34b90b240e478426292d5a105de2b19169fd367429cbe359b8ce
Instruction ID: 7cfb5884eaac4925053eb5f41a8f4ea6a0c5e7946d2349d95685f381cff2fed2
Opcode Fuzzy Hash: 6bd819fc731b34b90b240e478426292d5a105de2b19169fd367429cbe359b8ce
Instruction Fuzzy Hash: 294146761016249FC7148F98E881AE67BE1EF55224F1484A9FDD98B202D632DE269B60

Function 2013F490 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 143COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2013F4B0
misuse, xrefs: 2013F4BA
%s at line %d of [%.10s], xrefs: 2013F4BF
unable to delete/modify collation sequence due to active statements, xrefs: 2013F533

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 0-3348720253
Opcode ID: 185c8b4cf4750ab7d9b932fbf024cd1a79e2e16a4199ed5fee861863b4bed860
Instruction ID: 7e15326b6022c832d6463851be03de193815260b6e45d31b46e3c1b62e8f3cd2
Opcode Fuzzy Hash: 185c8b4cf4750ab7d9b932fbf024cd1a79e2e16a4199ed5fee861863b4bed860
Instruction Fuzzy Hash: CA4159722003049BD7008FA8EC80BEAF7E4EF85329F14456EF6549B282E376EB55CB51

Function 2010C2B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

%!.*f, xrefs: 2010C3AE

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %!.*f
API String ID: 0-786758813
Opcode ID: 903d4b404f15984da2cd4f2e4339035f02ea18de61958ceea93a235993b01b61
Instruction ID: d53aba3026c742c5f8d8845972d6a01b6dd60531f9b9d59276e89b8ee20c480d
Opcode Fuzzy Hash: 903d4b404f15984da2cd4f2e4339035f02ea18de61958ceea93a235993b01b61
Instruction Fuzzy Hash: 00317C32904E1487D302ABB8D81369BB3967F96280F05C365FCC56E013EB399A5FD6D2

Function 201CEBD0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 201CEC42
%s at line %d of [%.10s], xrefs: 201CEC51
database corruption, xrefs: 201CEC4C
CREATE , xrefs: 201CEBFF

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$CREATE $database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-1360532505
Opcode ID: df2b4ee42fd7aff3d46169166d4fd2d39af76a4b34752798b4264e3ed0c760c8
Instruction ID: ecc16697a985f4bf90e74749ba24f2c5ab0be03777b7e4dd83e632e556d3fd00
Opcode Fuzzy Hash: df2b4ee42fd7aff3d46169166d4fd2d39af76a4b34752798b4264e3ed0c760c8
Instruction Fuzzy Hash: 01316CA25083C55ED7200AD99C80BD27FD5AB66229F1400BBF9C54E143E726DB94CB37

Function 20127050 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 98COMMON

Download Yara Rule

Strings

out of memory, xrefs: 20127059, 201270A2
invalid, xrefs: 2012706F
bad parameter or other API misuse, xrefs: 20127083
API call with %s database connection pointer, xrefs: 20127074

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: API call with %s database connection pointer$bad parameter or other API misuse$invalid$out of memory
API String ID: 0-453588374
Opcode ID: 6f67ef18d234814e9c0067ae41329466fe9be168e28f3d27a713974128e2323f
Instruction ID: abda88e3364423ed33a191b77968014395b7a4eaebdd1f3197e83e43cbf9679e
Opcode Fuzzy Hash: 6f67ef18d234814e9c0067ae41329466fe9be168e28f3d27a713974128e2323f
Instruction Fuzzy Hash: 583139B1900F308FE72547A4BC46BDB2397AF81314F294429F4459B247E229DF5B8395

Function 201A93A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 93COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 201A9446, 201A948A
%s at line %d of [%.10s], xrefs: 201A9455, 201A9499
database corruption, xrefs: 201A9450, 201A9494

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: ac2d6bec41fc12b774724d6f05d7877aae7086f83f5a97cfce15d488651ae8cc
Instruction ID: 3871480cb092254f1e567bb8f929d103b5b0ee222533af276e5685c2c1fa6b9f
Opcode Fuzzy Hash: ac2d6bec41fc12b774724d6f05d7877aae7086f83f5a97cfce15d488651ae8cc
Instruction Fuzzy Hash: 53315C396007504BD318DFA9C9D0AF3BBF2AF99705B54845DE6C24B74AD732E982CB50

Function 20134F40 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 91COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 20134F62, 20134FF3
%s at line %d of [%.10s], xrefs: 20134F71, 20135002
database corruption, xrefs: 20134F6C, 20134FFD

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 83d6e7df5a98932b15979ff829d7df19ee6b0b00b11d90114b1ca5d7cec19e51
Instruction ID: fadea84067885598fefd457f2e35d7ee395fd82ba9e4323b29dab5491320f4e0
Opcode Fuzzy Hash: 83d6e7df5a98932b15979ff829d7df19ee6b0b00b11d90114b1ca5d7cec19e51
Instruction Fuzzy Hash: 3F3156762001456BC3049F69D9C1BE5FFE0FF59315F084266F558DBA82E325EAA0DBE0

Function 20101C60 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 88COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 20101D3C
misuse, xrefs: 20101D46
%s at line %d of [%.10s], xrefs: 20101D4B
unknown database: %s, xrefs: 20101CBD

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$unknown database: %s
API String ID: 0-142545749
Opcode ID: f0479d4001e599101f615855d29ed921aeafc7590d78202dd90d995b7be4c75e
Instruction ID: 37b4d759b2b1879f4bf9bef623d708fa24d15e2a69c1ed7711f64238b5d41994
Opcode Fuzzy Hash: f0479d4001e599101f615855d29ed921aeafc7590d78202dd90d995b7be4c75e
Instruction Fuzzy Hash: 66217BB15007446BE7119FA5DC88FD7779EAFE1358F00012CFD9456282D778DB048762

Function 20133FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 85COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2013407D, 201340A8
%s at line %d of [%.10s], xrefs: 2013408C, 201340B7
database corruption, xrefs: 20134087, 201340B2

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: d72d3b90ade5eb1913112adc58b63e778ad349eaa7a1f94b08aef6bf433d0d9c
Instruction ID: ca203fb89aacd19cb4563cea4ed371eb98822f2d6180cbc54b1bcef64129fe49
Opcode Fuzzy Hash: d72d3b90ade5eb1913112adc58b63e778ad349eaa7a1f94b08aef6bf433d0d9c
Instruction Fuzzy Hash: D221F1B3A002155BC704DF98DCC2AEBBBD0FB98611F414126FE44E7205E735EA8987E2

Function 2022C6F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

Strings

an index, xrefs: 2022C71D
a generated column, xrefs: 2022C722
non-deterministic use of %s() in %s, xrefs: 2022C732
a CHECK constraint, xrefs: 2022C714, 2022C72B

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s
API String ID: 0-3705377941
Opcode ID: 8af66b7b160deaefaff6c3dca9a21d1029f997e5e5c45199faa5f894c9f923dc
Instruction ID: 5ff34bcaec4aa723995071cc191a8c4527747e5b3b441c72e8eed48785652dd1
Opcode Fuzzy Hash: 8af66b7b160deaefaff6c3dca9a21d1029f997e5e5c45199faa5f894c9f923dc
Instruction Fuzzy Hash: 5F2132706089129FDB019FA8ECC4E9677ADBF02364F100326F904D22A0DB39E8A5DBD1

Function 201A9290 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 201A929C, 201A932A
%s at line %d of [%.10s], xrefs: 201A92AB, 201A9339
database corruption, xrefs: 201A92A6, 201A9334

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 9e1909eca7654d599129e5badcfc868024f8517a79b89076810be2c834b6b857
Instruction ID: b7b8cf6c8142f35d85e97df5d465ac215eae8298a47f0c93b0e1111679b50c0c
Opcode Fuzzy Hash: 9e1909eca7654d599129e5badcfc868024f8517a79b89076810be2c834b6b857
Instruction Fuzzy Hash: 3F214925504B905BC7219FB888C0AE7FBF1BF65300B44449DE6D69779AE232E9C1CB90

Function 201133C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

CREATE TABLE x(pgno INTEGER PRIMARY KEY, data BLOB, schema HIDDEN), xrefs: 201133D6

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: CREATE TABLE x(pgno INTEGER PRIMARY KEY, data BLOB, schema HIDDEN)
API String ID: 0-1935849370
Opcode ID: 9f099f9ccc6ded733d0f5ed83bb434e092a1f65dae612fb0029690743c01d6c4
Instruction ID: df64b053eaf934951c8aa491e10cfaf2fb7819b558d0ad6122764f57dbc86653
Opcode Fuzzy Hash: 9f099f9ccc6ded733d0f5ed83bb434e092a1f65dae612fb0029690743c01d6c4
Instruction Fuzzy Hash: 4B0128357042164BE701DF69E841BCBF3E5EFD5321F048176F6008B244EBB4A9878BA1

Function 202A5BC1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,579822A2,?,?,00000000,202FD1CB,000000FF,?,202A5B30,?,?,202A5ADF,?), ref: 202A5BF6
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 202A5C08
FreeLibrary.KERNEL32(00000000,?,?,00000000,202FD1CB,000000FF,?,202A5B30,?,?,202A5ADF,?), ref: 202A5C2A

Strings

mscoree.dll, xrefs: 202A5BEF
CorExitProcess, xrefs: 202A5C00

Memory Dump Source

Source File: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 19b6ba15066ed1a78d46284971d497f8d9a671771ae1ab82cf886b7567c8cc68
Instruction ID: 9cc5101bc7de906b7e23bf77809c70bca03a8928d727f92eefab41d780adc15c
Opcode Fuzzy Hash: 19b6ba15066ed1a78d46284971d497f8d9a671771ae1ab82cf886b7567c8cc68
Instruction Fuzzy Hash: 24016731914A29AFDB169F90CD84BAFF7BDFB08725F000926F811A2294DB7D9940DA90

Function 20216A20 Relevance: 8.0, APIs: 5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 027a295d697952211ab3f0403fd12cbb6c8f5703fe532d1d6d178cfba0e3e363
Instruction ID: 5e6306f8ab00a4a783ab42da86750f50bc0a975ff50c41d31ca8b7caa3ed6f8c
Opcode Fuzzy Hash: 027a295d697952211ab3f0403fd12cbb6c8f5703fe532d1d6d178cfba0e3e363
Instruction Fuzzy Hash: 88028FB09087468FD301DFA4DC88B1AB7E8BF44304F04462EF94597252D778EAA8DBD2

Function 2017AF80 Relevance: 7.8, APIs: 5, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b21c75f53e09d5dbfbfdfd35163b36998bd147f6e31877bfc5f59d41ecbb277
Instruction ID: 6c79220d834c19024fa703ad5a854f4116d6f88c6039ac1aa302726eadeaf2ea
Opcode Fuzzy Hash: 2b21c75f53e09d5dbfbfdfd35163b36998bd147f6e31877bfc5f59d41ecbb277
Instruction Fuzzy Hash: 71A15970909A409BD7069FA4DDC8B5B337CBF00249F048124FE0596631DB3CEA68EBE6

Function 202173C0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

fts5: syntax error near "%.*s", xrefs: 2021751C

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: fts5: syntax error near "%.*s"
API String ID: 0-498961494
Opcode ID: d8ca178c266b06888a068eb02896ad3c02d0019b2b38651db22e31041fa13785
Instruction ID: 10fab320138fc15f0bb048ebe9fe148792dbf2575b09f378af1c3af66e12ef00
Opcode Fuzzy Hash: d8ca178c266b06888a068eb02896ad3c02d0019b2b38651db22e31041fa13785
Instruction Fuzzy Hash: 65B1AD705087419FD3118FA4CC80B5AFBF8BF84348F54481EF8858B252D778EA96DB96

Function 2010F7F0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

integer overflow, xrefs: 2010F8ED

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: integer overflow
API String ID: 0-1678498654
Opcode ID: c089ba6dd6a21e11c9441b81fb4044a511caec4dcc6cc3bf572343b9e01b8d29
Instruction ID: 08712533bd85d5f203bff83901b5acd9503e57d47d046865ae2d33f23614e8e0
Opcode Fuzzy Hash: c089ba6dd6a21e11c9441b81fb4044a511caec4dcc6cc3bf572343b9e01b8d29
Instruction Fuzzy Hash: 4511E6718047146EDB41AFA4BC06BC637E26F26328F05439EF8945A5E2E77086D4D7D2

Function 201182E0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

[%d], xrefs: 201184C7

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: [%d]
API String ID: 0-394612830
Opcode ID: 9b6c86a7e9837dfd4e09a92ccc572c471114dee2dc9cd4d4a9cdda1bffb183b6
Instruction ID: f95db716005efe93d8bc8c2c4a11f8fd80715b06c72fa386f8fddefcd71c6e2d
Opcode Fuzzy Hash: 9b6c86a7e9837dfd4e09a92ccc572c471114dee2dc9cd4d4a9cdda1bffb183b6
Instruction Fuzzy Hash: E87128B5908300AFD724CBA0DC81FA7F7E9EF95704F54892DF58482982E734EB498762

Function 201F6180 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 216COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 201F6387
%s at line %d of [%.10s], xrefs: 201F6396
database corruption, xrefs: 201F6391

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: af4ef52364996433e316c78ff39c2152a64726ccc017f1276b0eb3f071750d1c
Instruction ID: 1ae495a177303f290349788ee320a6d61a1881b78a959c9a44d1214968e2b708
Opcode Fuzzy Hash: af4ef52364996433e316c78ff39c2152a64726ccc017f1276b0eb3f071750d1c
Instruction Fuzzy Hash: 4071B0726083088BDB00DF94D8C5BEA7BE0FB59314F940999E889CB252E735DE85C792

Function 20107D30 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 199COMMON

Download Yara Rule

Strings

winShmMap1, xrefs: 20107DC5
winShmMap2, xrefs: 20107E1F
winShmMap3, xrefs: 20107F1D

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: winShmMap1$winShmMap2$winShmMap3
API String ID: 0-3826999013
Opcode ID: 429cfe4a0f52b3c39a39fbf87514df30e6b7c97da1f7bb33aae6c809942ef420
Instruction ID: b3ccbb26d711cb85a92ad2a8440498bffd556e15c5bb92881aeec6d77f126c96
Opcode Fuzzy Hash: 429cfe4a0f52b3c39a39fbf87514df30e6b7c97da1f7bb33aae6c809942ef420
Instruction Fuzzy Hash: 2061DD719047429FD714CFA4CC81B67B7EAAF94744F00486DFE8697291EB34EA14CB92

Function 202A0FC2 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 202A0FE7
CatchIt.LIBVCRUNTIME ref: 202A10CD

Strings

RCC, xrefs: 202A1001
MOC, xrefs: 202A0FF9

Memory Dump Source

Source File: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 6881f89504afc1b6613eeb01103f86c198abff7e00e132e2a36233e5cf00e2c3
Instruction ID: 4e6e8ecf94640adc8d31fb5b328eb0000928475dd3e3e4175f4122a1ddfcc1fe
Opcode Fuzzy Hash: 6881f89504afc1b6613eeb01103f86c198abff7e00e132e2a36233e5cf00e2c3
Instruction Fuzzy Hash: 9C41497190025AEFDF05CFD4CD81AAEBBB5FF48310F15809AFA0467261DB359AA0DB90

Function 201335E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 201335EA
misuse, xrefs: 201335F4
%s at line %d of [%.10s], xrefs: 201335F9

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: 3ca8ea26342b5196a13477f36283a04b96856020daf6e403d14ea6f22111108d
Instruction ID: 9a51ab8c7c347a2d3d62f3d7bb887a0043d139bde1c6f2ff679cbb26727720b6
Opcode Fuzzy Hash: 3ca8ea26342b5196a13477f36283a04b96856020daf6e403d14ea6f22111108d
Instruction Fuzzy Hash: 915102F1A00314AFDB148F94C8C5B96BBA4FF94324F084268F918AB252D331EB54CB96

Function 201A96B0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 136COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 201A97E0
%s at line %d of [%.10s], xrefs: 201A97EF
database corruption, xrefs: 201A97EA

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: c460bbfaad83e01034b568ed1690d0f94c628ff16803b9f074041407ff230f14
Instruction ID: 412a888126a4a727d28c27863817041551e55d849afeec7ee338a07b205e1ffe
Opcode Fuzzy Hash: c460bbfaad83e01034b568ed1690d0f94c628ff16803b9f074041407ff230f14
Instruction Fuzzy Hash: 42412B7A2047904FD3218FFC94806D7FFE0AF51215F1808AEE2D58B656E222E9C5DB61

Function 20100300 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 128COMMON

Download Yara Rule

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 201003FF
winWrite1, xrefs: 2010045E
winWrite2, xrefs: 2010043B

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: delayed %dms for lock/sharing conflict at line %d$winWrite1$winWrite2
API String ID: 0-1808655853
Opcode ID: 1758f4fa579d5ce08148f1116d6dc7a063afb0394845aba02db7a8cfead0f325
Instruction ID: 5a61873999d2684b5cf03a57c58a6aa69d29d84e1bad974b281e958d22c8bead
Opcode Fuzzy Hash: 1758f4fa579d5ce08148f1116d6dc7a063afb0394845aba02db7a8cfead0f325
Instruction Fuzzy Hash: E3415A726047019FC3069F98DC809AFB7EAFB85310F510A2EFE91DB191D731DA458B95

Function 20275960 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 126COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 20275976
misuse, xrefs: 20275980
%s at line %d of [%.10s], xrefs: 20275985

Memory Dump Source

Source File: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: d486cc11788c2ce7730b7a9508a205d4bdbe8fa114b6ba3609157172e95e7c19
Instruction ID: 3c7440e542619a800a416d14570d1c78c9d2cccee81094ca15c12d3f35691d9d
Opcode Fuzzy Hash: d486cc11788c2ce7730b7a9508a205d4bdbe8fa114b6ba3609157172e95e7c19
Instruction Fuzzy Hash: 934109729043259FD3108F94CC81B9AF7F8BF95320F84463AF94497251E7B9EAA8C791

Function 20288850 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 2028895F
os_win.c:%d: (%lu) %s(%s) - %s, xrefs: 202888E2

Memory Dump Source

Source File: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: delayed %dms for lock/sharing conflict at line %d$os_win.c:%d: (%lu) %s(%s) - %s
API String ID: 0-1037342196
Opcode ID: 624862baed8d726975513cc9e54f6cb72b84e40ffde0d9f41b32fc0b85e396e3
Instruction ID: 74a22d42a55f7ae5d0bc1582a768e9383b10a3d30000e81121cbd74013ac41c1
Opcode Fuzzy Hash: 624862baed8d726975513cc9e54f6cb72b84e40ffde0d9f41b32fc0b85e396e3
Instruction Fuzzy Hash: E5218E7550834BAFE7209B94CC85BFBBBD9BFD4304F444C1DE58886192C6349C5487A3

Function 20135390 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 117COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 201353FE
%s at line %d of [%.10s], xrefs: 2013540D
database corruption, xrefs: 20135408

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 2cf8c6692faa9f0d59bdcee558bf82cec31505a0578b70bb2e414ffab6f919c1
Instruction ID: eb03c71771d91dec341536c52491db4bdcc20aa1ec75cadaa6c51c8f0aaff706
Opcode Fuzzy Hash: 2cf8c6692faa9f0d59bdcee558bf82cec31505a0578b70bb2e414ffab6f919c1
Instruction Fuzzy Hash: FD31BE2560078096D7258FF898407E7B7E0AF51B16F44046EEAC5C7682F366EAD2C3A1

Function 20217ED0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 111COMMON

Download Yara Rule

Strings

error in tokenizer constructor, xrefs: 20217F92
no such tokenizer: %s, xrefs: 20217F1B

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: error in tokenizer constructor$no such tokenizer: %s
API String ID: 0-815501780
Opcode ID: fe685664669871408bd594d41b9f4e1d5d29819dba60488e53d9e443c240f4d8
Instruction ID: 65c3c61114e2aa5503b5c2f567be4f7f58df35c6a743bb2c1d57ee424a296d45
Opcode Fuzzy Hash: fe685664669871408bd594d41b9f4e1d5d29819dba60488e53d9e443c240f4d8
Instruction Fuzzy Hash: C531AD727012168FC720CF99D880B6AF3E4EFC4625F1405AEF9489B701E732ED568B61

Function 200FF000 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

second argument to nth_value must be a positive integer, xrefs: 200FF0C4

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: second argument to nth_value must be a positive integer
API String ID: 0-2620530100
Opcode ID: aefc60752f637c1a0051df03530fe6673c63d845c9f603c2926ca585f148eb33
Instruction ID: ff2c42ecbc442f6481db6619523897bdfa12baae1689e8695ae13d2ba011ec60
Opcode Fuzzy Hash: aefc60752f637c1a0051df03530fe6673c63d845c9f603c2926ca585f148eb33
Instruction Fuzzy Hash: 39316CB290431A9BE7109F94DC8672B77E0BF50720F004675FD54A6283EF72EE58A692

Function 201105D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMON

Download Yara Rule

Strings

rbu(%s)/%z, xrefs: 20110697
rbu/zipvfs setup error, xrefs: 2011061A

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: rbu(%s)/%z$rbu/zipvfs setup error
API String ID: 0-199214844
Opcode ID: 10eaabe4100ecfbc70eccfc18849e1ad5d83b9157eb526cf504f9ee9d97e4614
Instruction ID: 6270d4836781b22c823aded7e187b3ca718f5a5c54216784938110d143011755
Opcode Fuzzy Hash: 10eaabe4100ecfbc70eccfc18849e1ad5d83b9157eb526cf504f9ee9d97e4614
Instruction Fuzzy Hash: 682104B2A003055FC7148F99DC80A8AF3E5EBC8220F04447EE90887202DBB2E954CB51

Function 20135280 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 201352F2
%s at line %d of [%.10s], xrefs: 20135301
database corruption, xrefs: 201352FC

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: feb77463f4e7c8fb2ce596add014816367e2f17b14074aeff4025c6e879d0d4d
Instruction ID: 27482955881f3521370f651040fa676dec824b9d33564f5868afea2ec4e211b9
Opcode Fuzzy Hash: feb77463f4e7c8fb2ce596add014816367e2f17b14074aeff4025c6e879d0d4d
Instruction Fuzzy Hash: C611873360020467CB105BD9FC81DDBBFA5EFD46B6F090566FA0856122D722DA2597A1

Function 20258490 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 80COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 202584C1
%s at line %d of [%.10s], xrefs: 202584D0
database corruption, xrefs: 202584CB

Memory Dump Source

Source File: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 7721c3981869b8cc20f592b7f0af8b1c1a1a4ce2140d4d3f82a21a11626cbee3
Instruction ID: f9ab82322891574a8132a00bf3e05081f93fc8d94d8867ad0e1ce50f91a15127
Opcode Fuzzy Hash: 7721c3981869b8cc20f592b7f0af8b1c1a1a4ce2140d4d3f82a21a11626cbee3
Instruction Fuzzy Hash: D82122762007029BD7208E98DC80B93B7E4FF94311F00482FF945A7B02E7B1E9588BA6

Function 2013FD60 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2013FDE6, 2013FE61
%s at line %d of [%.10s], xrefs: 2013FE82
database corruption, xrefs: 2013FE7D

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 4e4ac9a97189e4bccc287acfb3721939dc7c04d164cd2b1cb70eaa7394caadd4
Instruction ID: 7dbf34b8fa9b88d6325edd114d6cae4e0e094fc2d0a02e1fafe7702251bfaba7
Opcode Fuzzy Hash: 4e4ac9a97189e4bccc287acfb3721939dc7c04d164cd2b1cb70eaa7394caadd4
Instruction Fuzzy Hash: 42311A681143818AD3288FA4C0807A2BAA1BF15708F24D5DDD488DF757E3BBC9C7DB96

Function 2014D6F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

%s%s, xrefs: 2014D725

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s%s
API String ID: 0-3252725368
Opcode ID: be77ff30c5e498b275cb191d12d44704333a7e3e48c6302c6eaf9438d9b09717
Instruction ID: 3f69caecdac3b681b52052b7841d18234f435a12f5c7ab611e5bbeb68213b99d
Opcode Fuzzy Hash: be77ff30c5e498b275cb191d12d44704333a7e3e48c6302c6eaf9438d9b09717
Instruction Fuzzy Hash: 8F11B1759046509BEB025BA4DCC8B9733BCFF8025EF040135FA08C6225D7399A18DBE2

Function 20216140 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

Strings

fts5: error creating shadow table %q_%s: %s, xrefs: 20216197
WITHOUT ROWID, xrefs: 20216150, 20216162
CREATE TABLE %Q.'%q_%q'(%s)%s, xrefs: 20216175

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: WITHOUT ROWID$CREATE TABLE %Q.'%q_%q'(%s)%s$fts5: error creating shadow table %q_%s: %s
API String ID: 0-1971204597
Opcode ID: ad472b26c7fd798507d9adfb6c79be79b09e2615fbdea92402f69c92d2924a64
Instruction ID: 2de0f8920fa2d747ae60770e41f0b09a81852345a3fc8515e0da9be5c340ce5b
Opcode Fuzzy Hash: ad472b26c7fd798507d9adfb6c79be79b09e2615fbdea92402f69c92d2924a64
Instruction Fuzzy Hash: 6A11E771608201AFD7064F98DCC8E6BB7B8FF84359F004429F905D6221C739C968EBE2

Function 2019A6B0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2019A6C3
%s at line %d of [%.10s], xrefs: 2019A6D2
database corruption, xrefs: 2019A6CD

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 8e98981fe9895fbb93139c3ebb0225f26bf9ce3f43841fda723f1a7cb3846e89
Instruction ID: ec92f4ac14ad73c3083be08a0b53572d88c872ff87e0aacbde71d3bd8b7f5d6e
Opcode Fuzzy Hash: 8e98981fe9895fbb93139c3ebb0225f26bf9ce3f43841fda723f1a7cb3846e89
Instruction Fuzzy Hash: 1911DDB2600201AFD700CF99DC81F8BB7E8EBC4210F4408A9F6409B291D732A9458BA2

Function 20102380 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 62COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 201023FC
misuse, xrefs: 20102406
%s at line %d of [%.10s], xrefs: 2010240B

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: 5aa75e07932036f4a06491a2817c712cde950c24eed44573286acf9e43a831cc
Instruction ID: 767177d079684a44f11e4503f4eddfea115aeef56672261aa37e1477fde1460d
Opcode Fuzzy Hash: 5aa75e07932036f4a06491a2817c712cde950c24eed44573286acf9e43a831cc
Instruction Fuzzy Hash: 2711AC71204202DFDB18CF4CDC80FAAB7A5BF98304F414098FA819F296D731EA86DB90

Function 201A1F70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

JSON path error near '%q', xrefs: 201A1F92

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: JSON path error near '%q'
API String ID: 0-481711382
Opcode ID: a4874830ab33075e8c0be2d4295f20c437abf32eb3f5ae5f4279e28c076b3296
Instruction ID: be02f2f17337a274e4e56c5807d37b0c9fd444fc356cc76f28bbcc25e9678b78
Opcode Fuzzy Hash: a4874830ab33075e8c0be2d4295f20c437abf32eb3f5ae5f4279e28c076b3296
Instruction Fuzzy Hash: EA0104726092506FEB259AD48C01BDB7BD4DF51330F20066CF955962D1DB719905D3E2

Function 2011F0E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

INSERT INTO %Q.%Q(%Q) VALUES('flush'), xrefs: 2011F105

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: INSERT INTO %Q.%Q(%Q) VALUES('flush')
API String ID: 0-2312637080
Opcode ID: a8960821df8655d015f65dc7ff64a9d2998e1ca788863d3ec99a974a461b62d5
Instruction ID: 3b7969ca977a0cec654473c6cd840ab9a6eaaea0f2171e4af4365f5f3a9de02a
Opcode Fuzzy Hash: a8960821df8655d015f65dc7ff64a9d2998e1ca788863d3ec99a974a461b62d5
Instruction Fuzzy Hash: AA019236204241AED36186AEFC44FD7F7D8EBD4221F08047DF5ADC2202D7619C8592A1

Function 20101DF0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 20101E53
misuse, xrefs: 20101E59
%s at line %d of [%.10s], xrefs: 20101E63

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: 0c5cc11ae60bd75a5337a891061af1c03bfe2b6deb65fb38d5bc04e574b27f1d
Instruction ID: 948ea1eb3dae7ed5211a67d99bb70caff47d192dd15507621038a3f9e73db8b6
Opcode Fuzzy Hash: 0c5cc11ae60bd75a5337a891061af1c03bfe2b6deb65fb38d5bc04e574b27f1d
Instruction Fuzzy Hash: 2D11E3306089409FD31ACFA8D884F8ABBA9BF45608F150058FD85DB322D77CDA05C7A2

Function 20120D70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

INSERT INTO %Q.%Q(%Q) VALUES('flush'), xrefs: 20120D87

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: INSERT INTO %Q.%Q(%Q) VALUES('flush')
API String ID: 0-2312637080
Opcode ID: c76085160918cc0e7da577648a728b165d345c50ca24884677ec3a2850825e75
Instruction ID: 75ecd355f3de5303b7476348ddb2a5bfe07bd609bd0429f8df887be91caf2b3a
Opcode Fuzzy Hash: c76085160918cc0e7da577648a728b165d345c50ca24884677ec3a2850825e75
Instruction Fuzzy Hash: DC01DC32205604AFE3108ACDEC80F83B7E9EB88324F040568F68DEB242D7B2EC458790

Function 200FEF30 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 200FEFA6
misuse, xrefs: 200FEFB0
%s at line %d of [%.10s], xrefs: 200FEFB5

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: f78dff931706cf6c2ca7fa8c18ec6aed765d8b5f3b96e6dfb764255aa9aa34d5
Instruction ID: 271a8c798874bdcc04433c3836d322262605d64a99cd588fc004b397bad25c2a
Opcode Fuzzy Hash: f78dff931706cf6c2ca7fa8c18ec6aed765d8b5f3b96e6dfb764255aa9aa34d5
Instruction Fuzzy Hash: 3001F5B1A0AB559FE3018F48DC88B4B7BE5BF85708F094138E5086B361C775E84ADBC6

Function 20169180 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

Strings

%s_stat, xrefs: 20169192

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s_stat
API String ID: 0-920702477
Opcode ID: 8a155f546ee8c0f97ce1cefdbd070bebcea0892d45828a137af8a12fc312c4cf
Instruction ID: 296ef0aecc602ea7bad4acb7dc3ae2751b5e378be6806bda23ad706e0bcf6435
Opcode Fuzzy Hash: 8a155f546ee8c0f97ce1cefdbd070bebcea0892d45828a137af8a12fc312c4cf
Instruction Fuzzy Hash: BFF02033A092523BE70046F9BD89B8AEBD9BF54170F184635F40CA2209C766ACE293D1

Function 20117F70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

CREATE TABLE x(key,value,type,atom,id,parent,fullkey,path,json HIDDEN,root HIDDEN), xrefs: 20117F76

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: CREATE TABLE x(key,value,type,atom,id,parent,fullkey,path,json HIDDEN,root HIDDEN)
API String ID: 0-3072645960
Opcode ID: d5a4a089478664d89bd85480a573ea4f55020dcf7ca3c39a9adfc7db207f4069
Instruction ID: de271531a59c949f187abcbd4a9cb5bbd3b9042b0393bb892e8d82f25f3a2cea
Opcode Fuzzy Hash: d5a4a089478664d89bd85480a573ea4f55020dcf7ca3c39a9adfc7db207f4069
Instruction Fuzzy Hash: C4F02B326043034AE7005FA9FC02BCAF7E1AFD4321F150135F8549A281FB60DDC687A1

Function 202A066B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,202A0513,?,?,?,?,?,?,202A07BD,00000003,FlsSetValue,20317770,20317778), ref: 202A0678
GetLastError.KERNEL32(?,202A0513,?,?,?,?,?,?,202A07BD,00000003,FlsSetValue,20317770,20317778), ref: 202A0682
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 202A06AA

Strings

api-ms-, xrefs: 202A068F

Memory Dump Source

Source File: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 105e4897254a419e652b88e5719850774ce863fef9010acdada96accc02cbc0e
Instruction ID: d5485c591fe39ad13bd38e14230eb21000a8ea6394dca9b44f1a3d99401cfa5c
Opcode Fuzzy Hash: 105e4897254a419e652b88e5719850774ce863fef9010acdada96accc02cbc0e
Instruction Fuzzy Hash: 55E04870684706B7EB111FE1DCC9B593B5CAF45B54F104421FA0CE41E2DB759D749988

Function 2022C1F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 9COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2022C1F0
misuse, xrefs: 2022C1F9
%s at line %d of [%.10s], xrefs: 2022C1FE

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: 6ef5d85e189ce74b64c95347298b24e910ab9e25cde8f73226bbc84fbe03f779
Instruction ID: c956b0e35df3559f49580f54501dd32fdc814edfafba3dd235d87eb048df0bca
Opcode Fuzzy Hash: 6ef5d85e189ce74b64c95347298b24e910ab9e25cde8f73226bbc84fbe03f779
Instruction Fuzzy Hash: BFB09B6551064CF6DB0415C58CC2FC9D81077D870EF858054F7557D29EDDB540D06551

Function 201FA570 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 9COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 201FA570
%s at line %d of [%.10s], xrefs: 201FA57E
database corruption, xrefs: 201FA579

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 56c03a5ec1da47fb5d1b83212fc9272f18d4e814d0cb2b613d91eb1d368180d8
Instruction ID: bb1067a72c5c05088341b76624915ac953c250ee642532d50face21abf9dc5a5
Opcode Fuzzy Hash: 56c03a5ec1da47fb5d1b83212fc9272f18d4e814d0cb2b613d91eb1d368180d8
Instruction Fuzzy Hash: 3EB09B5550020872D60425D54DC1FC7FC107758608F858454F6053529ADA7544D05555

Function 201F6B50 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 9COMMON

Download Yara Rule

Strings

ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 201F6B50
%s at line %d of [%.10s], xrefs: 201F6B5E
cannot open file, xrefs: 201F6B59

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$cannot open file$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-1799306995
Opcode ID: 8ed02cbd07be0358c61070e2221bf8715ca57e30af003efde2f3911f4773c8b7
Instruction ID: b73657fe3c67302aa86adb9ce4c8dcc2be3d8af498fffff1bf65c4eb96dfe410
Opcode Fuzzy Hash: 8ed02cbd07be0358c61070e2221bf8715ca57e30af003efde2f3911f4773c8b7
Instruction Fuzzy Hash: 2CB09B5650024876D60429D5CCC2FC6EC107758608F858454F6453529ED9E5C0D09555

Function 201525E0 Relevance: 6.4, APIs: 4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6f90b573410ee5fdf89bc6048ca118ed079c65151bbf7ead0f2a49d60f533c5
Instruction ID: cbc73dd6a29d1ec4f5dae9b049511b072b241b1e4df44fd33e31164d242d7f0a
Opcode Fuzzy Hash: e6f90b573410ee5fdf89bc6048ca118ed079c65151bbf7ead0f2a49d60f533c5
Instruction Fuzzy Hash: 4AD1A171A08B019BD709DFA4DDC8B5A7BACFF05205F000529FA05C6621DB39DA5DEBE2

Function 202E67F5 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(579822A2,00000000,00000000,?), ref: 202E6858
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 202E6AAA
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 202E6AF0
GetLastError.KERNEL32 ref: 202E6B93

Memory Dump Source

Source File: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 5af066b1db53955dd4e4c215e522bb5c9bbcf5c9be687fa3b13f9d52dbe7f87c
Instruction ID: 0634ed8b1cf424e09eea38db427cee9eac2bac27f0d22f1314a7086f87052578
Opcode Fuzzy Hash: 5af066b1db53955dd4e4c215e522bb5c9bbcf5c9be687fa3b13f9d52dbe7f87c
Instruction Fuzzy Hash: 14D1AAB1D042499FCB05CFE9C8C4ADDBBB8FF09354F14416AE919EB352D630A952CB50

Function 20198EB0 Relevance: 6.2, APIs: 4, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38935c6867ea78d9c16d9305a13b5651c56ce39e6c0c0d48925113a89d87f70a
Instruction ID: 4d52f93027065cfffcbd28c2fe764175533519f8017e299f5e5faefbc0d3d324
Opcode Fuzzy Hash: 38935c6867ea78d9c16d9305a13b5651c56ce39e6c0c0d48925113a89d87f70a
Instruction Fuzzy Hash: 7F5148716043994BE7218FB8D8497DAFFE89F11310F0846A9F9D48B243E369DB89D361

Function 20117DA0 Relevance: 6.2, APIs: 4, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea291e1e53dcb4017a4c1efce0b9f153081f11f7ea2b366026b1b8c4d3347eaa
Instruction ID: 311de4b07f0604e39301b1a1ddc2dc5a8324390efe7172425e337e67add48e1c
Opcode Fuzzy Hash: ea291e1e53dcb4017a4c1efce0b9f153081f11f7ea2b366026b1b8c4d3347eaa
Instruction Fuzzy Hash: 7B41AA322016059FE318CF98D981A92F7F1FF84324F14456AEA4687B22D772FE91CB90

Function 2011CAE0 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6de9c1774845d9a621a267745840e4611a9874fc4f5e6975df5fde7ea23480dd
Instruction ID: b41511ea3a8c39e0f46b9063f20aeeda650d752e4dc11eb11631de19758de9ed
Opcode Fuzzy Hash: 6de9c1774845d9a621a267745840e4611a9874fc4f5e6975df5fde7ea23480dd
Instruction Fuzzy Hash: 4E31BEB26083119FE7188FA8D841B96F3E4FB94261F00097AF904C7651E371EE94E7A5

Function 2011B1F0 Relevance: 6.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c84fadece956eb82bcd06ee462d33b28814fba88082786c6e23e5494ba88420
Instruction ID: c03ab360b7c8eaeaa57f9fd155d8f480fe868ec0e85e5a5d56301f219f7afdc5
Opcode Fuzzy Hash: 2c84fadece956eb82bcd06ee462d33b28814fba88082786c6e23e5494ba88420
Instruction Fuzzy Hash: BD317E71104B419AD328CBA9E88079AF7F0BFA5314F14896ED49A86A01D371FA8D8791

Function 2018CFE0 Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67f155ee4936aae19aec06cb809ffc92085dd37a0bce870209c165f40ac7d322
Instruction ID: 613e914794880383dbcdbba3c879daf751b062b9295d146b60b735878f27fa2a
Opcode Fuzzy Hash: 67f155ee4936aae19aec06cb809ffc92085dd37a0bce870209c165f40ac7d322
Instruction Fuzzy Hash: D421A1715007059FE750EFA8D885B9BBBE0EFA8350F50082DF995D3212E731EA589F92

Function 202EF4CA Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,?,00000001,00000000,?,?,00000000), ref: 202EF4E0
GetLastError.KERNEL32(?,?,?,?), ref: 202EF4ED
SetFilePointerEx.KERNEL32(?,?,?,?,?), ref: 202EF513
SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,?,?,?), ref: 202EF539

Memory Dump Source

Source File: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID: FilePointer$ErrorLast
String ID:
API String ID: 142388799-0
Opcode ID: 8eecc3d56fcf5c3f051a4285a03170cba53d1ea8dacf175f94eaee88d4f808c3
Instruction ID: 239e556dc93242d22c4c4f30a911b8049b7d7bbcd0a13d615cab8c42198c67bf
Opcode Fuzzy Hash: 8eecc3d56fcf5c3f051a4285a03170cba53d1ea8dacf175f94eaee88d4f808c3
Instruction Fuzzy Hash: 3311457180461AABDB01DF96CC4899F3F7DEB00360F504145F928A61A0D735AA60EBA0

Function 200F2ABD Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 202F1382
GetLastError.KERNEL32 ref: 202F138E
___initconout.LIBCMT ref: 202F139E

Part of subcall function 202F1303: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,202F13A3), ref: 202F1316

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 202F13B3

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID: ConsoleWrite$CreateErrorFileLast___initconout
String ID:
API String ID: 3431868840-0
Opcode ID: 0593e8d1deca781b82b9f255b21a69d2326d1709272e886558aefff5502bfe78
Instruction ID: 610e4cc4743f3cc03477510775fe17a7e548e0336b0e6eea3f357a8acd1dfb1d
Opcode Fuzzy Hash: 0593e8d1deca781b82b9f255b21a69d2326d1709272e886558aefff5502bfe78
Instruction Fuzzy Hash: 55F08C3600492DBBCF236FD5CC48A8A7F6AFB086A1F004050FA1885120CA3A8920BBC1

Function 2010E6C0 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 317COMMON

Download Yara Rule

Strings

B0 , xrefs: 2010E751
B0 , xrefs: 2010E748

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: B0 $B0
API String ID: 0-1873354297
Opcode ID: a672d0b496cf70c891e75e9d5c25c870ad088959705c29b7ecae3e350dc1146d
Instruction ID: 49fff15a617a01510914d64a826b3d5bdb50fad85bad5df200f6480d67af802b
Opcode Fuzzy Hash: a672d0b496cf70c891e75e9d5c25c870ad088959705c29b7ecae3e350dc1146d
Instruction Fuzzy Hash: 12B147316183418FD7058FAAC4806AABBE3BF8A318F14466DEDD54B292D731DF46CB81

Function 2010BE80 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

string or blob too big, xrefs: 2010C1B5

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: string or blob too big
API String ID: 0-2803948771
Opcode ID: ece7fd379ed93a808f932146b780f80579cd3259da3c1ae99c06a3e8d89de355
Instruction ID: 5a7a996447e9741333ee99687161c2cc732dde8a3bb932f57472475e17ddde96
Opcode Fuzzy Hash: ece7fd379ed93a808f932146b780f80579cd3259da3c1ae99c06a3e8d89de355
Instruction Fuzzy Hash: C7A1E175508746CBD7048FA88C917A6B7E3AF99220F140B5DFDE0872D6E770DA89CE81

Function 20277300 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 242COMMON

Download Yara Rule

Strings

%!.15g, xrefs: 202775C3
-, xrefs: 20277538

Memory Dump Source

Source File: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %!.15g$-
API String ID: 0-583212262
Opcode ID: 5c1f1c163cd09c75a01ee1026a6aa9d32b0b6c79ea785c2293611b327c969c83
Instruction ID: 8cddced0a52076a0944a4f17455e5ee3a9a4b69b537d744426e1b98089ff165b
Opcode Fuzzy Hash: 5c1f1c163cd09c75a01ee1026a6aa9d32b0b6c79ea785c2293611b327c969c83
Instruction Fuzzy Hash: 8B915C71A083468FD304DF6DD89175AFBE0ABC8344F44496EE988C7361E7B9D9098B92

Function 2013CBF0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

string or blob too big, xrefs: 2013CE39

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: string or blob too big
API String ID: 0-2803948771
Opcode ID: c078f6e91ba416cbd90ed565997217d7987187d15b5bed0bec78469e04e971ed
Instruction ID: 571b49f0574e18d6081d14664cbb54bd83cdae32a5bbdfef579ebf5fca5af5dd
Opcode Fuzzy Hash: c078f6e91ba416cbd90ed565997217d7987187d15b5bed0bec78469e04e971ed
Instruction Fuzzy Hash: E4811271A043058FD704CFD8C882B96BBE5BF94310F154928FA4897292E775EB858BD2

Function 202178F0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 214COMMON

Download Yara Rule

Strings

?, xrefs: 2021794A
*, xrefs: 20217982

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: *$?
API String ID: 0-2367018687
Opcode ID: 22826d08863b2f315e3846722321c7c77e6e9ae130eb999a4fdf139ea68cdd0d
Instruction ID: d94f4d9d855260420269c205077f3ba36227e0b16b2f9bd55b01d20bb65e85a7
Opcode Fuzzy Hash: 22826d08863b2f315e3846722321c7c77e6e9ae130eb999a4fdf139ea68cdd0d
Instruction Fuzzy Hash: 2171D370A087428FD3118FA8CC8071BFBF6BFD5200F54496EE98587213D775EA968B92

Function 2010C8E0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 206COMMON

Download Yara Rule

Strings

LIKE or GLOB pattern too complex, xrefs: 2010C94F
ESCAPE expression must be a single character, xrefs: 2010CA43

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 0-264706735
Opcode ID: ff6a055fd8a0daacb5eb9758717dcbe6a19caff68f0d731420cf5bbdb846d91d
Instruction ID: 821756c865b95f7354f70a593d30840f965c97220bbcc8b0595ade2db84a28da
Opcode Fuzzy Hash: ff6a055fd8a0daacb5eb9758717dcbe6a19caff68f0d731420cf5bbdb846d91d
Instruction Fuzzy Hash: 626148716042599FDB08CBA4C881BA677A3AB41328F244289FCD15B2D3E675CB8EDF51

Function 200F28A6 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 147COMMON

Download Yara Rule

APIs

SetConsoleCtrlHandler.KERNEL32(202D9F34,00000001,2032D4A8,00000014), ref: 202DA544
GetLastError.KERNEL32 ref: 202DA557

Strings

~1 , xrefs: 202DA496

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID: ConsoleCtrlErrorHandlerLast
String ID: ~1
API String ID: 3113525192-2281923414
Opcode ID: e63faec7b712506b8768477ade0a1acbf633e950d19dc1ea8c2611ec163d63f7
Instruction ID: 3b28b2a365a05d5436b5eee8b111559bce79882cd7591629d2cf12a30845b80e
Opcode Fuzzy Hash: e63faec7b712506b8768477ade0a1acbf633e950d19dc1ea8c2611ec163d63f7
Instruction Fuzzy Hash: B2412673E452078FDB018FE8EC86FAD77E1AB55250B64402BEA06A7350DB34DDA0D651

Function 2010D0F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

string or blob too big, xrefs: 2010D213

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: string or blob too big
API String ID: 0-2803948771
Opcode ID: a3f46ab7cb1deb150b2b4db315710aab9ce107b35f1c453a4b3225458af5af4f
Instruction ID: 1fba0a2f34d7b4b123939226d2ac8c11d742e9763d37b33732aedeba531aa999
Opcode Fuzzy Hash: a3f46ab7cb1deb150b2b4db315710aab9ce107b35f1c453a4b3225458af5af4f
Instruction Fuzzy Hash: 4C415C728042418EE3105AB89C4279A7BA7AF61320F144939EDD5533D3DA37E708D392

Function 201055D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 201056D1
winDelete, xrefs: 2010569C

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: delayed %dms for lock/sharing conflict at line %d$winDelete
API String ID: 0-1405699761
Opcode ID: bf831cf215fa40a60d339edab28ffe6121df81da12fa9066d0a4603cc5c4f91e
Instruction ID: 0c04d8c8bf78829a4c1d3115552a855f64b2ed25c2b8a68190e9e6a99c8878f5
Opcode Fuzzy Hash: bf831cf215fa40a60d339edab28ffe6121df81da12fa9066d0a4603cc5c4f91e
Instruction Fuzzy Hash: 10316C72A046005BE7012BF89DC99D7775EBB40365F410632FE82C62A2D66ACE48E6D1

Function 2010D300 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

string or blob too big, xrefs: 2010D3D5

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: string or blob too big
API String ID: 0-2803948771
Opcode ID: 6b144c630bb0aa0f6433465a55dcdee538e125b3cca057d91f4b515039d3230c
Instruction ID: cca104039efa60b28635aaf80d11b0ee7fa0a53a335c3420747ef546e30a3623
Opcode Fuzzy Hash: 6b144c630bb0aa0f6433465a55dcdee538e125b3cca057d91f4b515039d3230c
Instruction Fuzzy Hash: B03180F19042245BD7104A949C02BA63B5BAB91324F1902A5FDD56F3C3C667EE16D392

Function 201EDEE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87COMMON

Download Yara Rule

Strings

SELECT tbl,idx,stat FROM %Q.sqlite_stat1, xrefs: 201EDF4F
sqlite_stat1, xrefs: 201EDF30

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: SELECT tbl,idx,stat FROM %Q.sqlite_stat1$sqlite_stat1
API String ID: 0-3572622772
Opcode ID: 970af0f3b8f317dc41f2558d15fae5374a920b4bd16b2e989284c0fe45da91c6
Instruction ID: 0793b9d666df9585b17fb00a3d22bf50fa0378b9f26fbd2ba4ce8b435a1a9683
Opcode Fuzzy Hash: 970af0f3b8f317dc41f2558d15fae5374a920b4bd16b2e989284c0fe45da91c6
Instruction Fuzzy Hash: B121F671A017155FCB10DEA6DC81FAFB3A4BF91724B05412CFC499B252D720EE16CB91

Function 20287E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

OsError 0x%lx (%lu), xrefs: 20287ED9

Memory Dump Source

Source File: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: OsError 0x%lx (%lu)
API String ID: 0-3720535092
Opcode ID: d3786ae94fbe85b6e3fb1111f3cb0c391014ef77f961b480bf60294572b3df92
Instruction ID: 11121f010644b626d41c0b5e551953ec90502f0f754455cc4255231a7cdb899c
Opcode Fuzzy Hash: d3786ae94fbe85b6e3fb1111f3cb0c391014ef77f961b480bf60294572b3df92
Instruction Fuzzy Hash: F721C271609A01ABE7029FA4DC89F9B37ADFF00255F040525FA09D11A0DB38DD24FBE2

Function 200F141F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

InitializeCriticalSectionEx, xrefs: 202D0E84
GetXStateFeaturesMask, xrefs: 202D0E34

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: GetXStateFeaturesMask$InitializeCriticalSectionEx
API String ID: 0-4196971266
Opcode ID: 7ceab6f353ffd9bf64a1aceebfc48e5786b2a7ab0337d817a634ae6c1ad6e67f
Instruction ID: 325a5e6fe9204f5a38158945f715e167b82b7bddf90d5152bb08688d78a43d51
Opcode Fuzzy Hash: 7ceab6f353ffd9bf64a1aceebfc48e5786b2a7ab0337d817a634ae6c1ad6e67f
Instruction Fuzzy Hash: 9E017132540168B7CB152BD18C85FDA7F19EB54761F014412FE182A324DA768CB0A6D1

Function 2011F740 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

DROP TABLE '%q'.'%q_node';DROP TABLE '%q'.'%q_rowid';DROP TABLE '%q'.'%q_parent';, xrefs: 2011F752

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: DROP TABLE '%q'.'%q_node';DROP TABLE '%q'.'%q_rowid';DROP TABLE '%q'.'%q_parent';
API String ID: 0-2071071404
Opcode ID: cae8c9c8cea735067108b5cf362b959c2345ff53d7de7fe5b3997b8895909b67
Instruction ID: 384466cc84e89d20abc6279a14cf1e423843cdc925d580b129e86aec47543d35
Opcode Fuzzy Hash: cae8c9c8cea735067108b5cf362b959c2345ff53d7de7fe5b3997b8895909b67
Instruction Fuzzy Hash: 7A118D75604500AFE3059B98DCC9FBB73ACFB54215F04013DF905D2591E768AE49E7E1

Function 20125350 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

F, xrefs: 2012539B

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-1304234792
Opcode ID: 4ec01da220f84d452b046b9d3a5986918dd5584e63ede22492a5fcdee4b24920
Instruction ID: 7eb2ff38e7676bf071a07e11e3a02d5205946911df62d6ba4ae32531a0cdd5bb
Opcode Fuzzy Hash: 4ec01da220f84d452b046b9d3a5986918dd5584e63ede22492a5fcdee4b24920
Instruction Fuzzy Hash: 0F116DB16083448FD708DF65D85575BB7E4AFD8314F84482EE88A87291EB74D548CB83

Function 2014EFE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

SELECT %s WHERE rowid = ?, xrefs: 2014F017

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: SELECT %s WHERE rowid = ?
API String ID: 0-866778640
Opcode ID: eb9ca4c0d9cf34d7e02bb18cfd9d40b8042b308a85a07150cc6a7643c6b7d2db
Instruction ID: 33daf7131b910198c8d936dea52c68cd238b34334d8901c4d30264cfed310edb
Opcode Fuzzy Hash: eb9ca4c0d9cf34d7e02bb18cfd9d40b8042b308a85a07150cc6a7643c6b7d2db
Instruction Fuzzy Hash: 931125326003099BD7204BDAEC80F92F7A4EF80331F10852EF55997642EBB3B9558BA0

Function 20127200 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

Strings

invalid, xrefs: 2012721B
API call with %s database connection pointer, xrefs: 20127220

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: API call with %s database connection pointer$invalid
API String ID: 0-3574585026
Opcode ID: dff748f6cc473d2478e34d116d42dff203531ddc43a76218d574ec20caaca528
Instruction ID: 4e54f704dc981c38ac5640ae52314e539ffdd7b14e5241467e7f917fe4efd5ce
Opcode Fuzzy Hash: dff748f6cc473d2478e34d116d42dff203531ddc43a76218d574ec20caaca528
Instruction Fuzzy Hash: 85F0F031B05E208FDA2087A8BC24BE377EABF51321F0406A9F795D22A0C320ED54C2D1

Function 201085B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

CREATE TABLE x(sql,ncol,ro,busy,nscan,nsort,naidx,nstep,reprep,run,mem), xrefs: 201085B6

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: CREATE TABLE x(sql,ncol,ro,busy,nscan,nsort,naidx,nstep,reprep,run,mem)
API String ID: 0-3640693396
Opcode ID: 6f219fff9fa7f42f4956557b10d10f078044ee63f24ac14b35284edc163cb3ce
Instruction ID: f2a0b2bdf8fad33387bff4b6eb22bd6da79cbc2562e26910ff27e045b4a68bc7
Opcode Fuzzy Hash: 6f219fff9fa7f42f4956557b10d10f078044ee63f24ac14b35284edc163cb3ce
Instruction Fuzzy Hash: B5F0F6316043114AC2015BADFC017C6A3E59FE1321F054166F8849B111DBA0ED828AD1

Function 200FB224 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11COMMON

Download Yara Rule

Strings

misuse, xrefs: 200FB233
%s at line %d of [%.10s], xrefs: 200FB238

Memory Dump Source

Source File: 00000001.00000002.2917991129.00000000200F8000.00000020.00001000.00020000.00000000.sdmp, Offset: 200F0000, based on PE: true

Associated: 00000001.00000002.2917975956.00000000200F0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000200F1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.0000000020256000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2917991129.00000000202FD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.00000000202FF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918835753.0000000020308000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918937144.0000000020332000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2918963109.000000002033F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_200f0000_kat6899.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$misuse
API String ID: 0-2530468415
Opcode ID: 5ad8b9957b4df0c1c980f98cb3438b0ec1011022cd2b593ff5e4141da111bf91
Instruction ID: 46e146707fcecbafc1598fe933e6f389d827a170473c0e6a7320fd16b4a3130f
Opcode Fuzzy Hash: 5ad8b9957b4df0c1c980f98cb3438b0ec1011022cd2b593ff5e4141da111bf91
Instruction Fuzzy Hash: C8C0122154074CE7C7049AE4E8C2DC967207FA8A58B558165E7692948BEA61C1994641

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5IRIk4f1PO.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\HIIEGHJJDGHC\AAAKEB

C:\ProgramData\HIIEGHJJDGHC\CFIECB

C:\ProgramData\HIIEGHJJDGHC\DAKJDA

C:\ProgramData\HIIEGHJJDGHC\DBKFHJ

C:\ProgramData\HIIEGHJJDGHC\EBGCBA

C:\ProgramData\HIIEGHJJDGHC\EBKJDB

C:\ProgramData\HIIEGHJJDGHC\GCFHDA

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll

C:\Users\user\AppData\Local\Temp\kat6899.tmp

Static File Info

General

File Icon

Windows Analysis Report
5IRIk4f1PO.exe

Function 02ADBEF0 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 317
threadmemoryfileCOMMON

Function 02ADB250 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191
filenativeCOMMON

Function 02ADB510 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115
COMMON

Function 02ADB9B0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 46
memoryCOMMON

Function 02ADC510 Relevance: .1, Instructions: 92
COMMON

Function 20104CF0 Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 461
fileCOMMON

Function 200FFD40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 134
fileCOMMON

Function 201204D0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre