Edit tour

Windows Analysis Report
M9dfZzH3qn.exe

Overview

General Information

Sample name:	M9dfZzH3qn.exe renamed because original name is a hash value
Original sample name:	dee45b3ad0c841d54049061df5775ec0.exe
Analysis ID:	1464560
MD5:	dee45b3ad0c841d54049061df5775ec0
SHA1:	6fcbcf0d362d83ac346576ec8ba66b0cb3f1b4fd
SHA256:	159e547225b9f035bf95279055d66810149fa93debea660766552008271e3e5c
Tags:	32exe
Infos:

Detection

CryptOne, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (creates a PE file in dynamic memory)

Found malware configuration

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Multi AV Scanner detection for submitted file

Yara detected CryptOne packer

Yara detected Powershell download and execute

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Sample uses process hollowing technique

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

M9dfZzH3qn.exe (PID: 6852 cmdline: "C:\Users\user\Desktop\M9dfZzH3qn.exe" MD5: DEE45B3AD0C841D54049061DF5775EC0)

kat99F5.tmp (PID: 4312 cmdline: C:\Users\user\AppData\Local\Temp\kat99F5.tmp MD5: 66064DBDB70A5EB15EBF3BF65ABA254B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199707802586", "https://t.me/g067n"], "Botnet": "f5b5622f4f4fc7235c0e9e6367cafc13"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1652155095.0000000002B5B000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Crypt	Yara detected CryptOne packer	Joe Security
00000000.00000002.1652566058.00000000040A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1651953276.0000000002590000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: M9dfZzH3qn.exe PID: 6852	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: M9dfZzH3qn.exe PID: 6852	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: M9dfZzH3qn.exe PID: 6852	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: kat99F5.tmp PID: 4312	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: kat99F5.tmp PID: 4312	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.M9dfZzH3qn.exe.2590000.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.M9dfZzH3qn.exe.2b27719.3.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.M9dfZzH3qn.exe.40a0000.5.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.M9dfZzH3qn.exe.40a0000.5.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.M9dfZzH3qn.exe.2b27719.3.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Click to see the 1 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199707802586	Avira URL Cloud: Label: malware
Source: https://t.me/g067n	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199707802586", "https://t.me/g067n"], "Botnet": "f5b5622f4f4fc7235c0e9e6367cafc13"}

Multi AV Scanner detection for submitted file

Source: M9dfZzH3qn.exe	Virustotal: Detection: 35%			Perma Link
Source: M9dfZzH3qn.exe	ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: M9dfZzH3qn.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetProcAddress
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: LoadLibraryA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: lstrcatA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: OpenEventA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CreateEventA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CloseHandle
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Sleep
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: VirtualFree
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetSystemInfo
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: VirtualAlloc
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: HeapAlloc
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetComputerNameA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: lstrcpyA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetProcessHeap
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetCurrentProcess
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: lstrlenA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ExitProcess
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetSystemTime
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: advapi32.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: gdi32.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: user32.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: crypt32.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ntdll.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetUserNameA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CreateDCA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetDeviceCaps
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ReleaseDC
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sscanf
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: NtQueryInformationProcess
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: VMwareVMware
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: HAL9TH
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: JohnDoe
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: DISPLAY
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetFileAttributesA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GlobalLock
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: HeapFree
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetFileSize
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GlobalSize
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: IsWow64Process
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Process32Next
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetLocalTime
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: FreeLibrary
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Process32First
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: DeleteFileA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: FindNextFileA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: LocalFree
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: FindClose
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: LocalAlloc
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetFileSizeEx
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ReadFile
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SetFilePointer
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: WriteFile
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CreateFileA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: FindFirstFileA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CopyFileA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: VirtualProtect
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetLastError
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: lstrcpynA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GlobalFree
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GlobalAlloc
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: OpenProcess
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: TerminateProcess
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: gdiplus.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ole32.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: bcrypt.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: wininet.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: shlwapi.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: shell32.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: psapi.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SelectObject
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: BitBlt
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: DeleteObject
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GdiplusStartup
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GdiplusShutdown
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GdipDisposeImage
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GdipFree
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CoUninitialize
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CoInitialize
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CoCreateInstance
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: BCryptDecrypt
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: BCryptSetProperty
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetWindowRect
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetDesktopWindow
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetDC
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CloseWindow
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: wsprintfA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CharToOemW
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: wsprintfW
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RegQueryValueExA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RegCloseKey
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RegEnumValueA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CryptUnprotectData
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ShellExecuteExA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: InternetConnectA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: InternetCloseHandle
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: InternetOpenA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: HttpSendRequestA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: InternetReadFile
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: StrCmpCA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: StrStrA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: StrCmpCW
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: PathMatchSpecA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RmStartSession
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RmRegisterResources
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RmGetList
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: RmEndSession
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3_open
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3_step
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3_column_text
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3_finalize
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3_close
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: encrypted_key
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: PATH
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: NSS_Init
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: NSS_Shutdown
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: PK11_Authenticate
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: C:\ProgramData\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Soft:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: profile:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Host:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Login:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Password:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Opera
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: OperaGX
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Network
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Cookies
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: .txt
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: TRUE
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: FALSE
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Autofill
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: History
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Name:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Month:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Year:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Card:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Cookies
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Login Data
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Web Data
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: History
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: logins.json
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: formSubmitURL
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: usernameField
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: encryptedUsername
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: encryptedPassword
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: guid
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: cookies.sqlite
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: formhistory.sqlite
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: places.sqlite
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Plugins
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Local Extension Settings
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Sync Extension Settings
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: IndexedDB
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Opera Stable
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Opera GX Stable
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: CURRENT
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: chrome-extension_
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Local State
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: profiles.ini
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: chrome
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: opera
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: firefox
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Wallets
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ProductName
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ProcessorNameString
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: DisplayName
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: DisplayVersion
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: freebl3.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: mozglue.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: msvcp140.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: nss3.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: softokn3.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: vcruntime140.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \Temp\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: .exe
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: runas
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: open
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: /c start
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %DESKTOP%
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %APPDATA%
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %USERPROFILE%
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: %RECENT%
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: *.lnk
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Files
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \discord\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: key_datas
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: map*
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Telegram
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: *.tox
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: *.ini
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Password
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: 00000001
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: 00000002
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: 00000003
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: 00000004
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Pidgin
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \.purple\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: accounts.xml
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: token:
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: SteamPath
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \config\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ssfn*
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: config.vdf
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: loginusers.vdf
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \Steam\
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: sqlite3.dll
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: browsers
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: done
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Soft
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: https
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: POST
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: HTTP/1.1
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: hwid
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: build
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: token
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: file_name
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: file
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: message
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack	String decryptor: screenshot.jpg

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Unpacked PE file: 1.2.kat99F5.tmp.22620000.0.unpack

Source: M9dfZzH3qn.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown

HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49247 version: TLS 1.2

Source:

Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199707802586
Source: Malware configuration extractor	URLs: https://t.me/g067n

Source: global traffic

TCP traffic: 192.168.2.4:49248 -> 195.201.251.214:9000

Source: global traffic

HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Source: Joe Sandbox View

ASN Name: TELEGRAMRU TELEGRAMRU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214

Source: global traffic

HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: t.me

Source: kat99F5.tmp, 00000001.00000003.1708011594.00000000009EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: kat99F5.tmp, 00000001.00000003.1884389408.0000000000967000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867996216.0000000000965000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2779015830.0000000000968000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891625943.000000000096C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: kat99F5.tmp, 00000001.00000003.1708011594.00000000009EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?3858708399b65
Source: kat99F5.tmp, 00000001.00000003.1867996216.0000000000958000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1884389408.000000000095A000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2779015830.000000000095A000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891625943.000000000095A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabz
Source: M9dfZzH3qn.exe, 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000000.1651485308.00000000004B4000.00000002.00000001.01000000.00000004.sdmp, kat99F5.tmp.0.dr	String found in binary or memory: http://rpi.net.au/~ajohnson/resourcehacker
Source: M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: M9dfZzH3qn.exe	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types
Source: M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Types
Source: M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Types7
Source: M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/TypesJ
Source: M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesc0da53E
Source: M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesc0da53F
Source: M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesmmon-cF
Source: kat99F5.tmp, 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: kat99F5.tmp, 00000001.00000003.1867996216.0000000000965000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214/?
Source: kat99F5.tmp, 00000001.00000003.1867996216.0000000000965000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214/_
Source: kat99F5.tmp, 00000001.00000003.1689316500.000000000092E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000
Source: kat99F5.tmp, 00000001.00000003.1835992285.00000000009C3000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.00000000009C2000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1824196823.00000000009DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/
Source: kat99F5.tmp, 00000001.00000003.1884389408.0000000000979000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2779015830.0000000000979000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867996216.0000000000973000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/%
Source: kat99F5.tmp, 00000001.00000003.1835432938.00000000009C3000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1835992285.00000000009C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/9
Source: kat99F5.tmp, 00000001.00000002.2891131725.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/?
Source: kat99F5.tmp, 00000001.00000003.2779015830.000000000095A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/Mac
Source: kat99F5.tmp, 00000001.00000003.1884389408.000000000095F000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2779015830.000000000095A000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891625943.0000000000961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/P
Source: kat99F5.tmp, 00000001.00000003.1860079117.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.00000000009C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/a
Source: kat99F5.tmp, 00000001.00000003.2779015830.000000000095A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/al
Source: kat99F5.tmp, 00000001.00000003.1847246580.00000000009C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/d
Source: kat99F5.tmp, 00000001.00000003.1860079117.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.00000000009CE000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1883885383.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1860079117.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2778910489.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dll
Source: kat99F5.tmp, 00000001.00000003.1860079117.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllD
Source: kat99F5.tmp, 00000001.00000003.1860079117.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.00000000009CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllF
Source: kat99F5.tmp, 00000001.00000003.1860079117.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllU
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllge
Source: kat99F5.tmp, 00000001.00000003.1860079117.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllla
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/icrosoft
Source: kat99F5.tmp, 00000001.00000003.1860079117.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.00000000009C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/j
Source: kat99F5.tmp, 00000001.00000002.2891747383.00000000009C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/lV
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dll
Source: kat99F5.tmp, 00000001.00000002.2891956141.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1883885383.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2778910489.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dll)b
Source: kat99F5.tmp, 00000001.00000002.2891956141.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1883885383.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2778910489.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dllM
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dllge
Source: kat99F5.tmp, 00000001.00000003.1883885383.00000000009CD000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2778910489.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/msvcp140.dll
Source: kat99F5.tmp, 00000001.00000003.1883885383.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/msvcp140.dll-
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/msvcp140.dll15;
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/msvcp140.dlle
Source: kat99F5.tmp, 00000001.00000003.1883885383.00000000009CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/msvcp140.dllf
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2778846215.00000000009B1000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2779015830.0000000000968000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/nss3.dll
Source: kat99F5.tmp, 00000001.00000003.2778846215.00000000009B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/nss3.dllr
Source: kat99F5.tmp, 00000001.00000003.1835432938.00000000009C3000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1835992285.00000000009CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/o
Source: kat99F5.tmp, 00000001.00000003.1860079117.00000000009C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/rlM
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891131725.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/softokn3.dll
Source: kat99F5.tmp, 00000001.00000002.2891131725.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/softokn3.dllb
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/softokn3.dlle
Source: kat99F5.tmp, 00000001.00000003.2779015830.0000000000931000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891131725.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/sqlt.dll
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891747383.00000000009CD000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891131725.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dll
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dller
Source: kat99F5.tmp, 00000001.00000003.1860079117.00000000009C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/w
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000Google
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000Microsoft
Source: kat99F5.tmp, 00000001.00000002.2889856394.0000000000539000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000f4cle
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000g
Source: kat99F5.tmp, 00000001.00000002.2889856394.0000000000539000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000ontent-Disposition:
Source: kat99F5.tmp, 00000001.00000002.2889856394.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000t.txtoft
Source: IDBAFH.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: IDBAFH.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: IDBAFH.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: IDBAFH.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: IDBAFH.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: IDBAFH.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: IDBAFH.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: M9dfZzH3qn.exe, 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1652566058.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1651953276.0000000002590000.00000040.00001000.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000425000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586
Source: M9dfZzH3qn.exe, 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1652566058.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1651953276.0000000002590000.00000040.00001000.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000425000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000004A9000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1835432938.00000000009C3000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000539000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.00000000004B1000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1824049927.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2895605358.000000002249D000.00000004.00000020.00020000.00000000.sdmp, DBFBFB.1.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: DBFBFB.1.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: kat99F5.tmp, 00000001.00000002.2889856394.00000000004A9000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.00000000004B1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: kat99F5.tmp, 00000001.00000003.1835432938.00000000009C3000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000539000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1824049927.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2895605358.000000002249D000.00000004.00000020.00020000.00000000.sdmp, DBFBFB.1.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: DBFBFB.1.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: kat99F5.tmp, 00000001.00000002.2889856394.0000000000539000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17exe
Source: kat99F5.tmp, 00000001.00000002.2889856394.0000000000539000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: kat99F5.tmp, 00000001.00000002.2891131725.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: M9dfZzH3qn.exe, 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1652566058.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1651953276.0000000002590000.00000040.00001000.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000425000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2779015830.0000000000931000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1689316500.000000000092E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891131725.0000000000911000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g067n
Source: kat99F5.tmp, 00000001.00000002.2891131725.0000000000911000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g067n2r
Source: M9dfZzH3qn.exe, 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1652566058.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1651953276.0000000002590000.00000040.00001000.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000425000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g067nry1neMozilla/5.0
Source: kat99F5.tmp, 00000001.00000003.1689316500.0000000000957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: IDBAFH.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: IDBAFH.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49247
Source: unknown	Network traffic detected: HTTP traffic on port 49247 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49247 version: TLS 1.2

Source: Yara match	File source: 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: M9dfZzH3qn.exe PID: 6852, type: MEMORYSTR

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Code function: 0_2_02B5B510 NtProtectVirtualMemory,NtProtectVirtualMemory,	0_2_02B5B510
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Code function: 0_2_02B5BEF0 NtAllocateVirtualMemory,GetTempFileNameA,CreateFileA,WriteFile,CreateProcessA,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64GetThreadContext,Wow64SetThreadContext,ResumeThread,ExitProcess,	0_2_02B5BEF0
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Code function: 0_2_02B5B250 NtCreateFile,CreateFileMappingA,MapViewOfFile,FindCloseChangeNotification,	0_2_02B5B250

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Code function: 0_2_02B5C510	0_2_02B5C510
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22634CF0	1_2_22634CF0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226AA0B0	1_2_226AA0B0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262209F	1_2_2262209F
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226366C0	1_2_226366C0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226247AF	1_2_226247AF
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2264A560	1_2_2264A560
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2271A590	1_2_2271A590
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262AA40	1_2_2262AA40
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262EA80	1_2_2262EA80
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2275E800	1_2_2275E800
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262481D	1_2_2262481D
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22623E3B	1_2_22623E3B
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2271A940	1_2_2271A940
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2273A900	1_2_2273A900
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_227069C0	1_2_227069C0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22682EE0	1_2_22682EE0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_227FAEBE	1_2_227FAEBE
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22666E80	1_2_22666E80
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226219DD	1_2_226219DD
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22653370	1_2_22653370
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262F160	1_2_2262F160
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262174E	1_2_2262174E
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2264BAB0	1_2_2264BAB0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262251D	1_2_2262251D
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262290A	1_2_2262290A
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22623AB2	1_2_22623AB2
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22748030	1_2_22748030
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226A0090	1_2_226A0090
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226A8120	1_2_226A8120
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22648680	1_2_22648680
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22648763	1_2_22648763
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22684760	1_2_22684760
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226B8760	1_2_226B8760
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22760480	1_2_22760480
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22724A60	1_2_22724A60
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22621EF1	1_2_22621EF1
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22648D2A	1_2_22648D2A
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_227FD209	1_2_227FD209
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22623580	1_2_22623580
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226B53B0	1_2_226B53B0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22745040	1_2_22745040
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22639000	1_2_22639000
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226DD6D0	1_2_226DD6D0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226C9690	1_2_226C9690
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22789430	1_2_22789430
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22749A20	1_2_22749A20
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22622018	1_2_22622018
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22621C9E	1_2_22621C9E
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226D5940	1_2_226D5940
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22622AA9	1_2_22622AA9
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226212A8	1_2_226212A8
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2262292D	1_2_2262292D
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22789CC0	1_2_22789CC0

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\kat99F5.tmp 6A94DBDA2DD1EDCFF2331061D65E1BAF09D4861CC7BA590C5EC754F3AC96A795

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: String function: 22621C2B appears 47 times
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: String function: 2262415B appears 133 times
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: String function: 2262395E appears 79 times
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: String function: 22623AF3 appears 37 times
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: String function: 22621F5A appears 31 times
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: String function: 228006B1 appears 36 times

Source: M9dfZzH3qn.exe, 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameResHack! vs M9dfZzH3qn.exe

Source: M9dfZzH3qn.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/11@1/2

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\EGRMTY3W.htm

Jump to behavior

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe

File created: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Jump to behavior

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: kat99F5.tmp, kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: kat99F5.tmp, kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: DGHIDA.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: kat99F5.tmp, kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.1.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: M9dfZzH3qn.exe	Virustotal: Detection: 35%
Source: M9dfZzH3qn.exe	ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\M9dfZzH3qn.exe "C:\Users\user\Desktop\M9dfZzH3qn.exe"
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Process created: C:\Users\user\AppData\Local\Temp\kat99F5.tmp C:\Users\user\AppData\Local\Temp\kat99F5.tmp
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Process created: C:\Users\user\AppData\Local\Temp\kat99F5.tmp C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Jump to behavior

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: M9dfZzH3qn.exe

Static file information: File size 2288128 > 1048576

Source: M9dfZzH3qn.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x127800

Source:

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Unpacked PE file: 1.2.kat99F5.tmp.22620000.0.unpack

Source: sqlt[1].dll.1.dr

Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Code function: 0_2_02B5CA10 push edx; ret	0_2_02B5CC1F
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Code function: 0_2_02B5C310 push edx; ret	0_2_02B5C31B
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226210C8 push ecx; ret	1_2_22823552
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22621BF9 push ecx; ret	1_2_227C4C03

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll			Jump to dropped file
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	File created: C:\Users\user\AppData\Local\Temp\kat99F5.tmp			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: icon.png

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

API coverage: 0.8 %

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: kat99F5.tmp, 00000001.00000002.2891131725.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: kat99F5.tmp, 00000001.00000002.2891131725.0000000000921000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: kat99F5.tmp, 00000001.00000002.2891131725.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpB
Source: kat99F5.tmp, 00000001.00000002.2891131725.0000000000911000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWGj

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Code function: 1_2_22622C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_22622C8E

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Code function: 1_2_226246A6 GetProcessHeap,

1_2_226246A6

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226242AF SetUnhandledExceptionFilter,		1_2_226242AF
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22622C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		1_2_22622C8E

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: M9dfZzH3qn.exe PID: 6852, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe

Memory allocated: C:\Users\user\AppData\Local\Temp\kat99F5.tmp base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe

Code function: 0_2_02B5BEF0 NtAllocateVirtualMemory,GetTempFileNameA,CreateFileA,WriteFile,CreateProcessA,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64GetThreadContext,Wow64SetThreadContext,ResumeThread,ExitProcess,

0_2_02B5BEF0

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe

Memory written: C:\Users\user\AppData\Local\Temp\kat99F5.tmp base: 400000 value starts with: 4D5A

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe

Section unmapped: C:\Users\user\AppData\Local\Temp\kat99F5.tmp base address: 400000

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat99F5.tmp base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat99F5.tmp base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat99F5.tmp base: 425000	Jump to behavior
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat99F5.tmp base: 42E000	Jump to behavior
Source: C:\Users\user\Desktop\M9dfZzH3qn.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat99F5.tmp base: 643000	Jump to behavior

Source: C:\Users\user\Desktop\M9dfZzH3qn.exe

Process created: C:\Users\user\AppData\Local\Temp\kat99F5.tmp C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: EnumSystemLocalesW,	1_2_22812CB6
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: EnumSystemLocalesW,	1_2_22812DF9
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: EnumSystemLocalesW,	1_2_22812D38
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_22813300
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	1_2_22623AA3
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: EnumSystemLocalesW,	1_2_227FFF17
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: GetLocaleInfoW,	1_2_22622112
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: GetLocaleInfoW,	1_2_22622112

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Code function: 1_2_2262433C GetSystemTimeAsFileTime,

1_2_2262433C

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Code function: 1_2_22804A46 GetTimeZoneInformation,

1_2_22804A46

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: kat99F5.tmp, 00000001.00000003.1822336993.00000000009EF000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected CryptOne packer

Source: Yara match

File source: 00000000.00000002.1652155095.0000000002B5B000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.2590000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.2b27719.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.40a0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.40a0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.2b27719.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1652566058.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1651953276.0000000002590000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: M9dfZzH3qn.exe PID: 6852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kat99F5.tmp PID: 4312, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Source: Yara match

File source: Process Memory Space: kat99F5.tmp PID: 4312, type: MEMORYSTR

Remote Access Functionality

Yara detected CryptOne packer

Source: Yara match

File source: 00000000.00000002.1652155095.0000000002B5B000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.2590000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.2b27719.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.40a0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.2590000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.40a0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M9dfZzH3qn.exe.2b27719.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1652566058.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1651953276.0000000002590000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: M9dfZzH3qn.exe PID: 6852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kat99F5.tmp PID: 4312, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2268E200 sqlite3_initialize,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	1_2_2268E200
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2268E090 sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	1_2_2268E090
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2269E170 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_2269E170
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2269A6F0 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,	1_2_2269A6F0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226366C0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_bind_value,sqlite3_free,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	1_2_226366C0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2267EF30 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,	1_2_2267EF30
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226E3770 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_226E3770
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_227037E0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_227037E0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2264B400 sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,sqlite3_reset,sqlite3_step,sqlite3_reset,sqlite3_column_int64,	1_2_2264B400
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22698200 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,	1_2_22698200
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226706E0 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	1_2_226706E0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22648680 sqlite3_mprintf,sqlite3_mprintf,sqlite3_initialize,sqlite3_finalize,sqlite3_free,sqlite3_mprintf,sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_int64,	1_2_22648680
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22678550 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,	1_2_22678550
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22634820 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_initialize,	1_2_22634820
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22650FB0 sqlite3_result_int64,sqlite3_result_double,sqlite3_result_int,sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	1_2_22650FB0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22704D40 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,InitOnceBeginInitialize,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	1_2_22704D40
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226DD3B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_226DD3B0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226B9090 sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_errmsg,sqlite3_mprintf,	1_2_226B9090
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226C51D0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_226C51D0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226FD610 sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_226FD610
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2274D4F0 sqlite3_bind_value,sqlite3_log,sqlite3_log,sqlite3_log,	1_2_2274D4F0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_227414D0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	1_2_227414D0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226C55B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_226C55B0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2269DB10 sqlite3_initialize,sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	1_2_2269DB10
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226C5910 sqlite3_mprintf,sqlite3_bind_int64,	1_2_226C5910
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2274D9E0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	1_2_2274D9E0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_226A1FE0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_226A1FE0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_2269DFC0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_mprintf,sqlite3_bind_text,sqlite3_step,sqlite3_reset,	1_2_2269DFC0
Source: C:\Users\user\AppData\Local\Temp\kat99F5.tmp	Code function: 1_2_22635C70 sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	1_2_22635C70

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	511 Process Injection	11 Masquerading	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Shared Modules	Boot or Logon Initialization Scripts	1 DLL Side-Loading	511 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	1 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	41 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
M9dfZzH3qn.exe	35%	Virustotal		Browse
M9dfZzH3qn.exe	34%	ReversingLabs	Win32.Trojan.Generic
M9dfZzH3qn.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\kat99F5.tmp	4%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
t.me	0%	Virustotal		Browse
windowsupdatebg.s.llnwi.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17exe	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/freebl3.dllla	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://t.me/	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
https://195.201.251.214:9000/mozglue.dll	0%	Avira URL Cloud	safe
https://t.me/	0%	Virustotal		Browse
http://www.borland.com/namespaces/TypesJ	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
https://195.201.251.214:9000/nss3.dll	0%	Avira URL Cloud	safe
https://web.telegram.org	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types	0%	Virustotal		Browse
https://195.201.251.214:9000/	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/mozglue.dll	0%	Virustotal		Browse
https://195.201.251.214:9000/freebl3.dllF	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/freebl3.dllD	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll	0%	Virustotal		Browse
https://195.201.251.214:9000/	0%	Virustotal		Browse
https://195.201.251.214:9000/nss3.dll	0%	Virustotal		Browse
https://195.201.251.214:9000/o	0%	Virustotal		Browse
http://www.borland.com/namespaces/TypesJ	0%	Virustotal		Browse
https://web.telegram.org	0%	Virustotal		Browse
https://195.201.251.214:9000t.txtoft	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/mozglue.dllge	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/o	0%	Avira URL Cloud	safe
https://195.201.251.214/?	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/j	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Types7	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/Mac	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/w	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/icrosoft	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/msvcp140.dll15;	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Types7	0%	Virustotal		Browse
https://195.201.251.214:9000/mozglue.dllM	0%	Avira URL Cloud	safe
https://195.201.251.214:9000Google	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/w	0%	Virustotal		Browse
https://195.201.251.214:9000/mozglue.dll)b	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Types	0%	Avira URL Cloud	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	0%	Avira URL Cloud	safe
https://t.me/g067n2r	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Typesc0da53E	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Typesc0da53F	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/al	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/msvcp140.dll-	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Types	0%	Virustotal		Browse
https://195.201.251.214:9000/%	0%	Avira URL Cloud	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	Avira URL Cloud	safe
https://195.201.251.214/_	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/freebl3.dll	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/softokn3.dll	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/msvcp140.dll-	0%	Virustotal		Browse
https://195.201.251.214:9000/rlM	0%	Avira URL Cloud	safe
https://t.me/g067nry1neMozilla/5.0	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/freebl3.dllU	0%	Avira URL Cloud	safe
http://www.sqlite.org/copyright.html.	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/?	0%	Avira URL Cloud	safe
https://195.201.251.214:9000g	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/nss3.dllr	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/softokn3.dll	0%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/9	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/msvcp140.dll	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Typesmmon-cF	0%	Avira URL Cloud	safe
http://rpi.net.au/~ajohnson/resourcehacker	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/vcruntime140.dller	0%	Avira URL Cloud	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/vcruntime140.dll	0%	Avira URL Cloud	safe
https://195.201.251.214:9000f4cle	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/msvcp140.dlle	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/softokn3.dlle	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/lV	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199707802586	100%	Avira URL Cloud	malware
https://195.201.251.214/_	0%	Virustotal		Browse
https://195.201.251.214:9000/softokn3.dllb	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/d	0%	Avira URL Cloud	safe
https://t.me/g067n	100%	Avira URL Cloud	malware
https://195.201.251.214:9000/freebl3.dllge	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/msvcp140.dllf	0%	Avira URL Cloud	safe
https://195.201.251.214:9000	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/a	0%	Avira URL Cloud	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/sqlt.dll	0%	Avira URL Cloud	safe
https://195.201.251.214:9000ontent-Disposition:	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/P	0%	Avira URL Cloud	safe
https://195.201.251.214:9000Microsoft	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
t.me	149.154.167.99	true	true	0%, Virustotal, Browse	unknown
windowsupdatebg.s.llnwi.net	87.248.205.0	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/profiles/76561199707802586	true	Avira URL Cloud: malware	unknown
https://t.me/g067n	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	IDBAFH.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t.me/	kat99F5.tmp, 00000001.00000002.2891131725.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17exe	kat99F5.tmp, 00000001.00000002.2889856394.0000000000539000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	IDBAFH.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/freebl3.dllla	kat99F5.tmp, 00000001.00000003.1860079117.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types	M9dfZzH3qn.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/mozglue.dll	kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.borland.com/namespaces/TypesJ	M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/nss3.dll	kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2778846215.00000000009B1000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2779015830.0000000000968000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://web.telegram.org	kat99F5.tmp, 00000001.00000003.1689316500.0000000000957000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll	M9dfZzH3qn.exe, 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1652566058.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1651953276.0000000002590000.00000040.00001000.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000425000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/	kat99F5.tmp, 00000001.00000003.1835992285.00000000009C3000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.00000000009C2000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1824196823.00000000009DA000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/freebl3.dllF	kat99F5.tmp, 00000001.00000003.1860079117.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.00000000009CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/freebl3.dllD	kat99F5.tmp, 00000001.00000003.1860079117.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000t.txtoft	kat99F5.tmp, 00000001.00000002.2889856394.0000000000445000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/o	kat99F5.tmp, 00000001.00000003.1835432938.00000000009C3000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1835992285.00000000009CE000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://195.201.251.214/?	kat99F5.tmp, 00000001.00000003.1867996216.0000000000965000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/mozglue.dllge	kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.borland.com/namespaces/Types7	M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/j	kat99F5.tmp, 00000001.00000003.1860079117.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.00000000009C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	IDBAFH.1.dr	false	URL Reputation: safe	unknown
https://195.201.251.214:9000/Mac	kat99F5.tmp, 00000001.00000003.2779015830.000000000095A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	kat99F5.tmp, 00000001.00000003.1835432938.00000000009C3000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000539000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1824049927.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2895605358.000000002249D000.00000004.00000020.00020000.00000000.sdmp, DBFBFB.1.dr	false	URL Reputation: safe	unknown
https://195.201.251.214:9000/w	kat99F5.tmp, 00000001.00000003.1860079117.00000000009C6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/icrosoft	kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/msvcp140.dll15;	kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/mozglue.dllM	kat99F5.tmp, 00000001.00000002.2891956141.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1883885383.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2778910489.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000Google	kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/mozglue.dll)b	kat99F5.tmp, 00000001.00000002.2891956141.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1883885383.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2778910489.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.borland.com/namespaces/Types	M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	kat99F5.tmp, 00000001.00000002.2889856394.0000000000539000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/g067n2r	kat99F5.tmp, 00000001.00000002.2891131725.0000000000911000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.borland.com/namespaces/Typesc0da53E	M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.borland.com/namespaces/Typesc0da53F	M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/al	kat99F5.tmp, 00000001.00000003.2779015830.000000000095A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/msvcp140.dll-	kat99F5.tmp, 00000001.00000003.1883885383.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/%	kat99F5.tmp, 00000001.00000003.1884389408.0000000000979000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2779015830.0000000000979000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867996216.0000000000973000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	DBFBFB.1.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	IDBAFH.1.dr	false	URL Reputation: safe	unknown
https://195.201.251.214/_	kat99F5.tmp, 00000001.00000003.1867996216.0000000000965000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/freebl3.dll	kat99F5.tmp, 00000001.00000003.1860079117.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.00000000009CE000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1883885383.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1860079117.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2778910489.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/softokn3.dll	kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891131725.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/rlM	kat99F5.tmp, 00000001.00000003.1860079117.00000000009C6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/g067nry1neMozilla/5.0	M9dfZzH3qn.exe, 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1652566058.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, M9dfZzH3qn.exe, 00000000.00000002.1651953276.0000000002590000.00000040.00001000.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000425000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/freebl3.dllU	kat99F5.tmp, 00000001.00000003.1860079117.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.0000000000A0E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	kat99F5.tmp, 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2897488584.000000002BC2C000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.1.dr	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/?	kat99F5.tmp, 00000001.00000002.2891131725.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000g	kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/nss3.dllr	kat99F5.tmp, 00000001.00000003.2778846215.00000000009B1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	IDBAFH.1.dr	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/9	kat99F5.tmp, 00000001.00000003.1835432938.00000000009C3000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1835992285.00000000009C3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://195.201.251.214:9000/msvcp140.dll	kat99F5.tmp, 00000001.00000003.1883885383.00000000009CD000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2778910489.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.borland.com/namespaces/Typesmmon-cF	M9dfZzH3qn.exe, 00000000.00000002.1651802719.000000000089E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	IDBAFH.1.dr	false	Avira URL Cloud: safe	unknown
http://rpi.net.au/~ajohnson/resourcehacker	M9dfZzH3qn.exe, 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000000.1651485308.00000000004B4000.00000002.00000001.01000000.00000004.sdmp, kat99F5.tmp.0.dr	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	kat99F5.tmp, 00000001.00000002.2889856394.00000000004A9000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1835432938.00000000009C3000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000539000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.00000000004B1000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1824049927.0000000000A19000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2895605358.000000002249D000.00000004.00000020.00020000.00000000.sdmp, DBFBFB.1.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe	kat99F5.tmp, 00000001.00000002.2889856394.00000000004A9000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.00000000004B1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	IDBAFH.1.dr	false	URL Reputation: safe	unknown
https://195.201.251.214:9000/vcruntime140.dller	kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/vcruntime140.dll	kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891747383.00000000009CD000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891131725.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000f4cle	kat99F5.tmp, 00000001.00000002.2889856394.0000000000539000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	IDBAFH.1.dr	false	URL Reputation: safe	unknown
https://195.201.251.214:9000/msvcp140.dlle	kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/softokn3.dlle	kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/lV	kat99F5.tmp, 00000001.00000002.2891747383.00000000009C6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/softokn3.dllb	kat99F5.tmp, 00000001.00000002.2891131725.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/d	kat99F5.tmp, 00000001.00000003.1847246580.00000000009C6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/freebl3.dllge	kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/msvcp140.dllf	kat99F5.tmp, 00000001.00000003.1883885383.00000000009CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/a	kat99F5.tmp, 00000001.00000003.1860079117.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.1867724762.00000000009C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000	kat99F5.tmp, 00000001.00000003.1689316500.000000000092E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	DBFBFB.1.dr	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	IDBAFH.1.dr	false	URL Reputation: safe	unknown
https://195.201.251.214:9000/sqlt.dll	kat99F5.tmp, 00000001.00000003.2779015830.0000000000931000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891131725.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000ontent-Disposition:	kat99F5.tmp, 00000001.00000002.2889856394.0000000000539000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/P	kat99F5.tmp, 00000001.00000003.1884389408.000000000095F000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000003.2779015830.000000000095A000.00000004.00000020.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2891625943.0000000000961000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000Microsoft	kat99F5.tmp, 00000001.00000002.2889856394.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, kat99F5.tmp, 00000001.00000002.2889856394.0000000000445000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
195.201.251.214	unknown	Germany		24940	HETZNER-ASDE	false
149.154.167.99	t.me	United Kingdom		62041	TELEGRAMRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1464560
Start date and time:	2024-06-29 02:29:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	M9dfZzH3qn.exe renamed because original name is a hash value
Original Sample Name:	dee45b3ad0c841d54049061df5775ec0.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/11@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 85% Number of executed functions: 7 Number of non-executed functions: 201
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 87.248.205.0
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:30:05	API Interceptor	1x Sleep call for process: kat99F5.tmp modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
195.201.251.214	5IRIk4f1PO.exe	Get hash	malicious	CryptOne, Vidar	Browse
	1719520929.094843_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse
	1Cvd8TyYPm.exe	Get hash	malicious	LummaC, Mars Stealer, PureLog Stealer, Stealc, Vidar, Xmrig, zgRAT	Browse
149.154.167.99	http://telegramtw1.org/	Get hash	malicious	Unknown	Browse	telegram.org/?setln=pl
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegram.dog	Get hash	malicious	Unknown	Browse	telegram.dog/
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot
	jtfCFDmLdX.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot
	vSlVoTPrmP.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot
	RO67OsrIWi.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot
	KeyboardRGB.exe	Get hash	malicious	Unknown	Browse	t.me/cinoshibot
	file.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	5IRIk4f1PO.exe	Get hash	malicious	CryptOne, Vidar	Browse	149.154.167.99
	1719520929.094843_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse	149.154.167.99
	1Cvd8TyYPm.exe	Get hash	malicious	LummaC, Mars Stealer, PureLog Stealer, Stealc, Vidar, Xmrig, zgRAT	Browse	149.154.167.99
	project.exe	Get hash	malicious	RedLine	Browse	149.154.167.99
	WR0fuHnEVW.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	BRWgvKaqbg.exe	Get hash	malicious	PureLog Stealer, RisePro Stealer, Vidar, zgRAT	Browse	149.154.167.99
	Resolucion Juridica Bloqueo Cuentas y servicios SRI.vbs.xz	Get hash	malicious	Unknown	Browse	104.21.51.236
	vidar2406.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	RW3MLiFPzL.exe	Get hash	malicious	PureLog Stealer, Vidar, zgRAT	Browse	149.154.167.99
	nEtQ9BP9hL.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
windowsupdatebg.s.llnwi.net	5IRIk4f1PO.exe	Get hash	malicious	CryptOne, Vidar	Browse	178.79.238.0
	https://t4ha7.shop/	Get hash	malicious	Unknown	Browse	87.248.205.0
	http://pub-5d5794a1344e4ef09c0d498cb30f8875.r2.dev/index.html	Get hash	malicious	Unknown	Browse	87.248.205.0
	http://pub-5e86a1f01e5a4476812e4d108add0587.r2.dev/index.html	Get hash	malicious	Unknown	Browse	41.63.96.0
	https://pub-4d0a115db8fb4f15a6bf3059fadf5ec9.r2.dev/secure_response.html?user-agent=Mozilla/5.0WindowsNT10.0;Win64;x64AppleWebKit/537.36KHTML,likeGeckoChrome/86.0.4240.75Safari/537.36	Get hash	malicious	HTMLPhisher	Browse	178.79.208.1
	http://sites.google.com/l0gin-microsoftwebonlne.app/867487/	Get hash	malicious	Unknown	Browse	41.63.96.128
	https://aradcofeenet1.aradcofeenet1.workers.dev/	Get hash	malicious	Unknown	Browse	87.248.205.0
	http://pub-5e86a1f01e5a4476812e4d108add0587.r2.dev/index.html	Get hash	malicious	Unknown	Browse	87.248.202.1
	http://pub-49f7bdad3ae7458f8076aa4480203a8b.r2.dev/index.html	Get hash	malicious	Unknown	Browse	87.248.202.1
	https://strangetype.shop/	Get hash	malicious	Unknown	Browse	87.248.205.0

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	5IRIk4f1PO.exe	Get hash	malicious	CryptOne, Vidar	Browse	149.154.167.99
	https://telegrambot-resolved.pages.dev/	Get hash	malicious	Unknown	Browse	149.154.167.99
	1719520929.094843_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse	149.154.167.99
	Kyeryong Construction - Products List & Spec.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	zrrHgsDzgS.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, StormKitty, WorldWind Stealer, zgRAT	Browse	149.154.167.220
	1Cvd8TyYPm.exe	Get hash	malicious	LummaC, Mars Stealer, PureLog Stealer, Stealc, Vidar, Xmrig, zgRAT	Browse	149.154.167.99
	H1XdsfkcgU.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	w5APKwp5DD.exe	Get hash	malicious	AsyncRAT, HTMLPhisher, MicroClip, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	https://telegrambot-resolved.pages.dev/	Get hash	malicious	Unknown	Browse	149.154.167.99
	project.exe	Get hash	malicious	RedLine	Browse	149.154.167.99
HETZNER-ASDE	5IRIk4f1PO.exe	Get hash	malicious	CryptOne, Vidar	Browse	195.201.251.214
	https://he110ca11he1lpn0wwb112.pages.dev/	Get hash	malicious	TechSupportScam	Browse	195.201.57.90
	Find-DscResource_QoS.ps1	Get hash	malicious	Unknown	Browse	5.161.214.209
	https://serviceca11he1pn0waa12.pages.dev/	Get hash	malicious	TechSupportScam	Browse	195.201.57.90
	Find-DscResource_QoS.ps1	Get hash	malicious	Unknown	Browse	5.161.214.209
	1719520929.094843_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse	195.201.251.214
	http://hostedonsporestack.com	Get hash	malicious	Unknown	Browse	95.216.25.250
	https://email.abad-ca.com/	Get hash	malicious	Unknown	Browse	135.181.16.82
	QUjE2KgAq6.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	cEEsFMSdw8.elf	Get hash	malicious	Mirai	Browse	213.239.211.194

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	5IRIk4f1PO.exe	Get hash	malicious	CryptOne, Vidar	Browse	149.154.167.99
	1719520929.094843_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse	149.154.167.99
	3443424611#U00b7pdf.exe	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.99
	UTN RFP_24-0676#U00b7pdf.exe	Get hash	malicious	GuLoader, Lokibot	Browse	149.154.167.99
	RFQ_22Q7305A-N23A-01#U00b7pdf.exe	Get hash	malicious	Remcos	Browse	149.154.167.99
	UPS_Bill_of_lading_291098829T_28_06_2024_000000_pdf.vbs	Get hash	malicious	GuLoader, Remcos	Browse	149.154.167.99
	PLANT PROJECT PROPOSAL BID_24-0676#U00b7pdf.exe	Get hash	malicious	GuLoader, Lokibot	Browse	149.154.167.99
	1Cvd8TyYPm.exe	Get hash	malicious	LummaC, Mars Stealer, PureLog Stealer, Stealc, Vidar, Xmrig, zgRAT	Browse	149.154.167.99
	w5APKwp5DD.exe	Get hash	malicious	AsyncRAT, HTMLPhisher, MicroClip, StormKitty, WorldWind Stealer	Browse	149.154.167.99
	sterverexe.exe	Get hash	malicious	FatalRAT, GhostRat, Nitol	Browse	149.154.167.99

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\kat99F5.tmp	5IRIk4f1PO.exe	Get hash	malicious	CryptOne, Vidar	Browse
	unKdkI2OE7.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
	igGqB0yylQ.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
	I71ylA9bM6.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
	RPI1VJ83ui.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
	l3gMFGppEi.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
	eyduk1OwKt.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
	8Scta2jVt5.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
	38XY6jzm6P.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
	tUB0RZsuki.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll	5IRIk4f1PO.exe	Get hash	malicious	CryptOne, Vidar	Browse
	1719520929.094843_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse
	1Cvd8TyYPm.exe	Get hash	malicious	LummaC, Mars Stealer, PureLog Stealer, Stealc, Vidar, Xmrig, zgRAT	Browse
	WR0fuHnEVW.exe	Get hash	malicious	Vidar	Browse
	BRWgvKaqbg.exe	Get hash	malicious	PureLog Stealer, RisePro Stealer, Vidar, zgRAT	Browse
	vidar2406.exe	Get hash	malicious	Vidar	Browse
	RW3MLiFPzL.exe	Get hash	malicious	PureLog Stealer, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	Setup.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\ProgramData\KEBKJDBAAKJD\CBFCBK

Download File

Process:	C:\Users\user\AppData\Local\Temp\kat99F5.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	modified
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEBKJDBAAKJD\DBFBFB

Download File

Process:	C:\Users\user\AppData\Local\Temp\kat99F5.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEBKJDBAAKJD\DGHIDA

Download File

Process:	C:\Users\user\AppData\Local\Temp\kat99F5.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEBKJDBAAKJD\DGHJEH

Download File

Process:	C:\Users\user\AppData\Local\Temp\kat99F5.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEBKJDBAAKJD\GIIIIJ

Download File

Process:	C:\Users\user\AppData\Local\Temp\kat99F5.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEBKJDBAAKJD\IDBAFH

Download File

Process:	C:\Users\user\AppData\Local\Temp\kat99F5.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEBKJDBAAKJD\KEBKJD

Download File

Process:	C:\Users\user\AppData\Local\Temp\kat99F5.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Local\Temp\kat99F5.tmp
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Local\Temp\kat99F5.tmp
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	2.977525407934455
Encrypted:	false
SSDEEP:	6:kK7d9Usw9L+N+SkQlPlEGYRMY9z+4KlDA3RUe/:DED9LNkPlE99SNxAhUe/
MD5:	358E8793A8CF27CEAE3047403B645D5D
SHA1:	B09FBF18A27DAB7FBE820B06BDEE30C346258895
SHA-256:	033E2110B2D00077153ADFA402B0677238987747DFBFDAC97B92EBBE50524AB0
SHA-512:	18269150F7B2CA8AF4F32B9331E5426300BAD9D12AFB9337D1BAA3EB11B95A7EDB3CF12B026A2F9A0940E9E5A65760F3C6234131F8C741411A1B18859A16C7B1
Malicious:	false
Preview:	p...... ........9..y....(....................................................... ........G..@.......................h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\kat99F5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 5IRIk4f1PO.exe, Detection: malicious, Browse Filename: 1719520929.094843_setup.exe, Detection: malicious, Browse Filename: 1Cvd8TyYPm.exe, Detection: malicious, Browse Filename: WR0fuHnEVW.exe, Detection: malicious, Browse Filename: BRWgvKaqbg.exe, Detection: malicious, Browse Filename: vidar2406.exe, Detection: malicious, Browse Filename: RW3MLiFPzL.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Download File

Process:	C:\Users\user\Desktop\M9dfZzH3qn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	881664
Entropy (8bit):	6.555251818096116
Encrypted:	false
SSDEEP:	24576:o0ESdQpglO1CxDyawn27h+9hrlgKQY9SGcZwCdTp:o0RIglO1CuL9VNcaCd9
MD5:	66064DBDB70A5EB15EBF3BF65ABA254B
SHA1:	0284FD320F99F62ACA800FB1251EFF4C31EC4ED7
SHA-256:	6A94DBDA2DD1EDCFF2331061D65E1BAF09D4861CC7BA590C5EC754F3AC96A795
SHA-512:	B05C6C09AE7372C381FBA591C3CB13A69A2451B9D38DA1A95AAC89413D7438083475D06796ACB5440CD6EC65B030C9FA6CBDAA0D2FE91A926BAE6499C360F17F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: 5IRIk4f1PO.exe, Detection: malicious, Browse Filename: unKdkI2OE7.exe, Detection: malicious, Browse Filename: igGqB0yylQ.exe, Detection: malicious, Browse Filename: I71ylA9bM6.exe, Detection: malicious, Browse Filename: RPI1VJ83ui.exe, Detection: malicious, Browse Filename: l3gMFGppEi.exe, Detection: malicious, Browse Filename: eyduk1OwKt.exe, Detection: malicious, Browse Filename: 8Scta2jVt5.exe, Detection: malicious, Browse Filename: 38XY6jzm6P.exe, Detection: malicious, Browse Filename: tUB0RZsuki.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*............................0.............@..............................................@..............................2'...........................@..p............................0......................................................CODE....d........................... ..`DATA................................@...BSS......................................idata..2'.......(..................@....tls......... ...........................rdata.......0......................@..P.reloc..p....@......................@..P.rsrc...............................@..P.....................t..............@..P........................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.128902243273674
TrID:	Win32 Executable (generic) a (10002005/4) 93.58% Win32 Executable Borland Delphi 7 (665061/41) 6.22% Win32 Executable Delphi generic (14689/80) 0.14% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	M9dfZzH3qn.exe
File size:	2'288'128 bytes
MD5:	dee45b3ad0c841d54049061df5775ec0
SHA1:	6fcbcf0d362d83ac346576ec8ba66b0cb3f1b4fd
SHA256:	159e547225b9f035bf95279055d66810149fa93debea660766552008271e3e5c
SHA512:	df3adca29d98c6bacbb9ecec498425f72a722aab2f187231689f5b7b959d8fa8b561ff0846ee0c8a495b204e6445305bbe56063672512f27369adba3e39978f2
SSDEEP:	49152:qpjNvr9ySAOmw4FHHO+SASagXkJr4MDkUwm:qpjNp7p4FHH8n5A
TLSH:	DDB5AE22F392C537C4723A789D1AB26994357D111D3874467BE85F4CDF3AA823F2E292
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	c1692e1f373f1307

Static PE Info

General

Entrypoint:	0x4f0b24
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1b5ec46ea5b288abd35faaa6c5e29620

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 004F0674h
call 00007F3604AB2345h
mov eax, dword ptr [004F358Ch]
mov eax, dword ptr [eax]
call 00007F3604B08599h
mov ecx, dword ptr [004F3714h]
mov eax, dword ptr [004F358Ch]
mov eax, dword ptr [eax]
mov edx, dword ptr [004F00B8h]
call 00007F3604B08599h
mov eax, dword ptr [004F358Ch]
mov eax, dword ptr [eax]
call 00007F3604B0860Dh
call 00007F3604AAFCD8h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xf5000	0x2226	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x10d000	0x127800	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xfa000	0x122e0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xf9000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0xefb6c	0xefc00	b6cbccf4120abae452c4f4bb0c0241a1	False	0.4459682937956204	data	6.569769101849669	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0xf1000	0x27b0	0x2800	075c39913dba2b50d48b34e05836ce6d	False	0.3671875	data	4.187577550487257	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xf4000	0xdd9	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xf5000	0x2226	0x2400	900ba339ba647a2a80150451120be588	False	0.3502604166666667	data	4.767633120388674	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xf8000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xf9000	0x18	0x200	bb1897305839cee8a2c35260b95c6576	False	0.05078125	data	0.2005819074398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0xfa000	0x122e0	0x12400	00541f5ce5b3ab6485498fee99281fc2	False	0.550339790239726	data	6.68159046363066	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x10d000	0x127800	0x127800	66e559430cb0ff61a714a8470e389322	False	0.7497000912119289	data	7.298892267002249	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x10dc94	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"			0.38636363636363635
RT_CURSOR	0x10ddc8	0x134	data			0.4642857142857143
RT_CURSOR	0x10defc	0x134	data			0.4805194805194805
RT_CURSOR	0x10e030	0x134	data			0.38311688311688313
RT_CURSOR	0x10e164	0x134	data			0.36038961038961037
RT_CURSOR	0x10e298	0x134	data			0.4090909090909091
RT_CURSOR	0x10e3cc	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"			0.4967532467532468
RT_BITMAP	0x10e500	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0x10e6d0	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380			0.46487603305785125
RT_BITMAP	0x10e8b4	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0x10ea84	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39870689655172414
RT_BITMAP	0x10ec54	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.4245689655172414
RT_BITMAP	0x10ee24	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5021551724137931
RT_BITMAP	0x10eff4	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5064655172413793
RT_BITMAP	0x10f1c4	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0x10f394	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5344827586206896
RT_BITMAP	0x10f564	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0x10f734	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.4870689655172414
RT_ICON	0x10f81c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.5013440860215054
RT_ICON	0x10fb04	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.311841949603691
RT_DIALOG	0x12032c	0x52	data			0.7682926829268293
RT_STRING	0x120380	0xc0	data			0.5260416666666666
RT_STRING	0x120440	0x634	data			0.30289672544080604
RT_STRING	0x120a74	0x358	data			0.3703271028037383
RT_STRING	0x120dcc	0x494	data			0.3796928327645051
RT_STRING	0x121260	0x3e0	data			0.32661290322580644
RT_STRING	0x121640	0x3cc	data			0.411522633744856
RT_STRING	0x121a0c	0x344	data			0.46411483253588515
RT_STRING	0x121d50	0x1d0	data			0.38146551724137934
RT_STRING	0x121f20	0x16c	data			0.532967032967033
RT_STRING	0x12208c	0x1fc	Targa image data - Color 99 x 107 x 32 +68 +111 "z"			0.4744094488188976
RT_STRING	0x122288	0x1f0	data			0.530241935483871
RT_STRING	0x122478	0xec	data			0.597457627118644
RT_STRING	0x122564	0x10c	data			0.5522388059701493
RT_STRING	0x122670	0x470	data			0.3908450704225352
RT_STRING	0x122ae0	0x388	data			0.38827433628318586
RT_STRING	0x122e68	0x358	data			0.34345794392523366
RT_STRING	0x1231c0	0x398	data			0.39456521739130435
RT_STRING	0x123558	0xe4	data			0.5482456140350878
RT_STRING	0x12363c	0xbc	data			0.5691489361702128
RT_STRING	0x1236f8	0x2f4	data			0.4312169312169312
RT_STRING	0x1239ec	0x4b8	data			0.298841059602649
RT_STRING	0x123ea4	0x388	data			0.3661504424778761
RT_STRING	0x12422c	0x2f0	data			0.39095744680851063
RT_RCDATA	0x12451c	0x10	data			1.5
RT_RCDATA	0x12452c	0x10f89c	data	English	United States	0.7984275817871094
RT_RCDATA	0x233dc8	0x658	data			0.6354679802955665
RT_RCDATA	0x234420	0x21b	Delphi compiled form 'Tplfb'			0.62152133580705
RT_GROUP_CURSOR	0x23463c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x234650	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x234664	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x234678	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x23468c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x2346a0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x2346b4	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0x2346c8	0x14	data	English	United States	1.2
RT_GROUP_ICON	0x2346dc	0x14	data	English	United States	1.25

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualAlloc, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetSystemInfo, GetStringTypeExA, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, GetACP, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumCalendarInfoA, EnterCriticalSection, DeleteFileA, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStretchBltMode, GetStockObject, GetPixelFormat, GetPixel, GetPaletteEntries, GetObjectA, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, ExcludeClipRect, DeleteObject, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
ole32.dll	IsEqualGUID, CoTaskMemFree, StringFromCLSID, CoCreateGuid
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayGetElement, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
ole32.dll	CLSIDFromProgID, CoCreateInstance, CoUninitialize, CoInitialize
oleaut32.dll	CreateErrorInfo, GetErrorInfo, SetErrorInfo, SysFreeString
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 29, 2024 02:29:57.459542990 CEST	49247	443	192.168.2.4	149.154.167.99
Jun 29, 2024 02:29:57.459585905 CEST	443	49247	149.154.167.99	192.168.2.4
Jun 29, 2024 02:29:57.459667921 CEST	49247	443	192.168.2.4	149.154.167.99
Jun 29, 2024 02:29:57.468981981 CEST	49247	443	192.168.2.4	149.154.167.99
Jun 29, 2024 02:29:57.468997955 CEST	443	49247	149.154.167.99	192.168.2.4
Jun 29, 2024 02:29:58.096347094 CEST	443	49247	149.154.167.99	192.168.2.4
Jun 29, 2024 02:29:58.096441984 CEST	49247	443	192.168.2.4	149.154.167.99
Jun 29, 2024 02:29:58.152827024 CEST	49247	443	192.168.2.4	149.154.167.99
Jun 29, 2024 02:29:58.152839899 CEST	443	49247	149.154.167.99	192.168.2.4
Jun 29, 2024 02:29:58.153038979 CEST	443	49247	149.154.167.99	192.168.2.4
Jun 29, 2024 02:29:58.153085947 CEST	49247	443	192.168.2.4	149.154.167.99
Jun 29, 2024 02:29:58.155641079 CEST	49247	443	192.168.2.4	149.154.167.99
Jun 29, 2024 02:29:58.200500965 CEST	443	49247	149.154.167.99	192.168.2.4
Jun 29, 2024 02:29:58.358000040 CEST	443	49247	149.154.167.99	192.168.2.4
Jun 29, 2024 02:29:58.358023882 CEST	443	49247	149.154.167.99	192.168.2.4
Jun 29, 2024 02:29:58.358058929 CEST	443	49247	149.154.167.99	192.168.2.4
Jun 29, 2024 02:29:58.358104944 CEST	443	49247	149.154.167.99	192.168.2.4
Jun 29, 2024 02:29:58.358134985 CEST	49247	443	192.168.2.4	149.154.167.99
Jun 29, 2024 02:29:58.358167887 CEST	49247	443	192.168.2.4	149.154.167.99
Jun 29, 2024 02:29:58.363271952 CEST	49247	443	192.168.2.4	149.154.167.99
Jun 29, 2024 02:29:58.363284111 CEST	443	49247	149.154.167.99	192.168.2.4
Jun 29, 2024 02:29:58.460130930 CEST	49248	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:29:58.465010881 CEST	9000	49248	195.201.251.214	192.168.2.4
Jun 29, 2024 02:29:58.465106010 CEST	49248	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:29:58.465400934 CEST	49248	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:29:58.470582008 CEST	9000	49248	195.201.251.214	192.168.2.4
Jun 29, 2024 02:29:59.313829899 CEST	9000	49248	195.201.251.214	192.168.2.4
Jun 29, 2024 02:29:59.313882113 CEST	9000	49248	195.201.251.214	192.168.2.4
Jun 29, 2024 02:29:59.313889980 CEST	49248	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:29:59.313915968 CEST	9000	49248	195.201.251.214	192.168.2.4
Jun 29, 2024 02:29:59.313922882 CEST	49248	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:29:59.313961983 CEST	49248	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:00.320431948 CEST	49248	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:00.325345993 CEST	9000	49248	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:00.516765118 CEST	9000	49248	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:00.516832113 CEST	49248	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:00.517465115 CEST	49248	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:00.523042917 CEST	9000	49248	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:00.975511074 CEST	9000	49248	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:00.975605011 CEST	49248	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:00.999898911 CEST	49250	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:01.005204916 CEST	9000	49250	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:01.005270004 CEST	49250	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:01.006480932 CEST	49250	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:01.011320114 CEST	9000	49250	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:01.678956985 CEST	9000	49250	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:01.679056883 CEST	49250	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:01.679351091 CEST	49250	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:01.680821896 CEST	49250	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:01.684175014 CEST	9000	49250	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:01.685640097 CEST	9000	49250	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:02.317800045 CEST	9000	49250	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:02.317882061 CEST	49250	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:02.318958998 CEST	49248	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:02.319303989 CEST	49251	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:02.324110031 CEST	9000	49251	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:02.324203014 CEST	49251	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:02.324424982 CEST	9000	49248	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:02.324476004 CEST	49248	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:02.324537992 CEST	49251	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:02.329323053 CEST	9000	49251	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:02.972373962 CEST	9000	49251	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:02.972466946 CEST	49251	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:02.972920895 CEST	49251	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:02.974833965 CEST	49251	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:02.977744102 CEST	9000	49251	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:02.979820967 CEST	9000	49251	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:03.611366034 CEST	9000	49251	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:03.611412048 CEST	9000	49251	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:03.611450911 CEST	49251	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:03.611478090 CEST	49251	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:03.612754107 CEST	49250	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:03.613111973 CEST	49252	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:03.618024111 CEST	9000	49252	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:03.618112087 CEST	49252	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:03.618208885 CEST	9000	49250	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:03.618267059 CEST	49250	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:03.618442059 CEST	49252	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:03.623277903 CEST	9000	49252	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:04.270536900 CEST	9000	49252	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:04.270714045 CEST	49252	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:04.270967007 CEST	49252	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:04.272500992 CEST	49252	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:04.275760889 CEST	9000	49252	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:04.277353048 CEST	9000	49252	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:04.900675058 CEST	9000	49252	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:04.900758982 CEST	9000	49252	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:04.900777102 CEST	49252	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:04.900795937 CEST	9000	49252	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:04.900815010 CEST	49252	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:04.900830984 CEST	9000	49252	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:04.900846958 CEST	49252	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:04.900867939 CEST	9000	49252	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:04.900882006 CEST	49252	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:04.900913000 CEST	49252	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:04.902348042 CEST	49251	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:04.902707100 CEST	49253	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:04.907499075 CEST	9000	49251	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:04.907577038 CEST	49251	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:04.907694101 CEST	9000	49253	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:04.907761097 CEST	49253	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:04.907949924 CEST	49253	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:04.912763119 CEST	9000	49253	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:05.587110996 CEST	9000	49253	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:05.587186098 CEST	49253	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:05.587660074 CEST	49253	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:05.589231014 CEST	49253	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:05.592502117 CEST	9000	49253	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:05.594002962 CEST	9000	49253	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:06.232398987 CEST	9000	49253	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:06.232661009 CEST	49253	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:06.291719913 CEST	49252	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:06.292043924 CEST	49254	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:06.297173023 CEST	9000	49254	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:06.297233105 CEST	49254	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:06.297281981 CEST	9000	49252	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:06.297333956 CEST	49252	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:06.297472000 CEST	49254	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:06.302268982 CEST	9000	49254	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:06.945250034 CEST	9000	49254	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:06.945468903 CEST	49254	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:06.945874929 CEST	49254	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:06.947263956 CEST	49254	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:06.947324991 CEST	49254	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:06.950598001 CEST	9000	49254	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:06.952014923 CEST	9000	49254	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:06.952045918 CEST	9000	49254	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:06.952102900 CEST	9000	49254	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:06.952116013 CEST	9000	49254	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:06.952177048 CEST	9000	49254	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:06.952188969 CEST	9000	49254	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:06.952239037 CEST	9000	49254	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:07.502669096 CEST	49253	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:07.503020048 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:07.507997990 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:07.508044958 CEST	9000	49253	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:07.508089066 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:07.508112907 CEST	49253	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:07.508424044 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:07.513354063 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:07.625792980 CEST	9000	49254	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:07.626053095 CEST	49254	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.173873901 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.173969030 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.174319029 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.175968885 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.179760933 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.180973053 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.509824038 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.509907007 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.509927034 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.509958029 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.509994030 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.510005951 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.510026932 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.510049105 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.510061026 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.510091066 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.510091066 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.510094881 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.510129929 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.510142088 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.510164976 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.510174036 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.510215044 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.510464907 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.510521889 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.514997959 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.515043974 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.515054941 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.515094995 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.602086067 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.602118015 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.602135897 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.602160931 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.607554913 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.607611895 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.607621908 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.607646942 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.607657909 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.607692003 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.611068964 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.611120939 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.611124039 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.611154079 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.611170053 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.611200094 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.617893934 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.617923021 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.617952108 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.617985010 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.618015051 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.618042946 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.618068933 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.618099928 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.625619888 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.625677109 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.625684977 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.625710011 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.625720978 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.625758886 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.631544113 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.631587982 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.631596088 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.631633997 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.631639957 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.631669044 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.631686926 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.631710052 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.638461113 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.638513088 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.638515949 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.638601065 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.638622999 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.638648033 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.645395994 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.645451069 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.645463943 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.645510912 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.645529032 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.645558119 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.645576954 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.645603895 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.652057886 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.652107954 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.652108908 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.652141094 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.652154922 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.652185917 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.652204037 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.652250051 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.659303904 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.659357071 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.659363985 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.659389973 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.659403086 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.659432888 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.665904045 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.665956974 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.665960073 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.666007042 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.700021982 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.700051069 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.700071096 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.700097084 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.700099945 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.700153112 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.700227022 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.700258017 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.700277090 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.700295925 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.705497026 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.705524921 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.705549002 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.705576897 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.705612898 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.705641031 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.705657005 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.705687046 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.708998919 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.709043026 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.709072113 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.709083080 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.709094048 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.709137917 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.709141016 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.709183931 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.715867996 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.715923071 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.715972900 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.716001034 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.716037035 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.716069937 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.722708941 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.722759962 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.722774029 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.722793102 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.722805023 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.722836018 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.729720116 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.729770899 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.729789972 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.729804039 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.729825974 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.729847908 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.736383915 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.736435890 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.736465931 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.736499071 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.736501932 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.736551046 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.743215084 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.743268013 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.743282080 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.743299961 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.743319035 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.743344069 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.749548912 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.749614954 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.749619961 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.749646902 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.749665022 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.749691963 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.755877018 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.755928993 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.755948067 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.755959988 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.756016970 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.759771109 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.761811018 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.761879921 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.761904001 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.761910915 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.761929035 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.761951923 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.767227888 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.767256021 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.767307043 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.767330885 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.769916058 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.769967079 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.769968987 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.770013094 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.770020008 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.770047903 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.770066023 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.770097971 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.775192022 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.775219917 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.775253057 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.775253057 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.775281906 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.775289059 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.775293112 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.775335073 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.780194044 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.780227900 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.780255079 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.780260086 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.780267954 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.780303001 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.785114050 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.785144091 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.785192966 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.785222054 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.785286903 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.785321951 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.790071011 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.790122032 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.790143013 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.790152073 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.790169001 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.790195942 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.795079947 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.795109034 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.795135975 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.795146942 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.795332909 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.795361042 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.795387983 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.795398951 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.800021887 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.800050020 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.800076962 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.800091028 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.800102949 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.800146103 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.800168991 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.800188065 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.804972887 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.805032015 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.805041075 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.805073023 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.805092096 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.805115938 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.808029890 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.808087111 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.808106899 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.808152914 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.808157921 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.808187008 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.808209896 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.808227062 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.810955048 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.811011076 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.811022997 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.811053991 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.811074972 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.811096907 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.814416885 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.814471960 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.814474106 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.814503908 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.814528942 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.814543009 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.817053080 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.817163944 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.817177057 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.817207098 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.817225933 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.817239046 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.817253113 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.817282915 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.819971085 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.820020914 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.820050001 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.820050955 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.820060968 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.820094109 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.822841883 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.822894096 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.822897911 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.822926044 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.822982073 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.825773954 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.825802088 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.825880051 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.825908899 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.825943947 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.825970888 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.828711033 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.828768015 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.828775883 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.828799963 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.828820944 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.828846931 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.831738949 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.831770897 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.831794977 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.831804037 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.831823111 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.831851006 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.834731102 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.834759951 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.834790945 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.834804058 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.835695028 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.835743904 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.835752964 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.835796118 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.837647915 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.837698936 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.837709904 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.837730885 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.837747097 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.837776899 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.840872049 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.840902090 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.840930939 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.840948105 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.842153072 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.842181921 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.842207909 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.842220068 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.843564987 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.843615055 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.843617916 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.843647957 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.843667030 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.843694925 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.846569061 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.846626997 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.846832037 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.846888065 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.848527908 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.848557949 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.848586082 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.848598003 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.849859953 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.849910975 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.849924088 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.849944115 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.849958897 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.849983931 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.852545023 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.852598906 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.852663040 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.852716923 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.854433060 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.854482889 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.854530096 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.854574919 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.855354071 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.855403900 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.855410099 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.855436087 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.855457067 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.855475903 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.858385086 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.858412027 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.858437061 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.858455896 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.862390995 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.862445116 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.862447023 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.862478018 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.862498045 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.862510920 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.862517118 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.862557888 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.864350080 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.864399910 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.864406109 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.864451885 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.867511988 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.867539883 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.867563963 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.867580891 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.867647886 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.867680073 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.867701054 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.867712021 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.867726088 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.867758036 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.870232105 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.870275021 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.870284081 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.870316982 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.873111963 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.873162031 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.873169899 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.873193026 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.873239994 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.873253107 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.873275042 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.873287916 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.873306036 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.873322010 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.873342991 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.877938986 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.877969027 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.878012896 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.878037930 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.879615068 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.879647017 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.879666090 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.879681110 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.879693031 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.879714966 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.879724979 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.879759073 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.882107973 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.882160902 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.882180929 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.882225990 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.882520914 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.882570982 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.882574081 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.882617950 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.884536982 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.884567022 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.884593010 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.884609938 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.884635925 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.884664059 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.884691000 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.884701967 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.887115955 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.887144089 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.887172937 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.887187004 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.887193918 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.887222052 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.887248993 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.887262106 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.889869928 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.889903069 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.889925003 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.889935017 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.889945030 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.889978886 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.892568111 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.892596960 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.892623901 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.892646074 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.892649889 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.892676115 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.892699957 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.892713070 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.895165920 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.895217896 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.895236015 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.895250082 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.895263910 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.895296097 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.897706985 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.897736073 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.897763014 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.897783041 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.897803068 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.897830963 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.897855997 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.897900105 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.900461912 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.900521040 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.900528908 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.900573015 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.900578022 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.900602102 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.900618076 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.900644064 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.902843952 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.902894020 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.902904987 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.902925968 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.902945995 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.902968884 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.904817104 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.904865026 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.904872894 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.904906034 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.904947042 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.904974937 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.904998064 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.905011892 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.906930923 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.906965017 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.906985998 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.906996965 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.907008886 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.907043934 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.909044027 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.909071922 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.909101963 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.909118891 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.909136057 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.909189939 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.909199953 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.909250975 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.911077976 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.911127090 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.911133051 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.911159039 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.911186934 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.911205053 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.912770987 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.912802935 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.912830114 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.912836075 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.912858963 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.912889004 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.914607048 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.914657116 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.914663076 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.914689064 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.914711952 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.914733887 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.916459084 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.916522980 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.916532993 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.916582108 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.916584015 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.916611910 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.916635036 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.916650057 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.918364048 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.918391943 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.918411970 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.918425083 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.918433905 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.918469906 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.918515921 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.918566942 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.920051098 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.920099974 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.920113087 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.920133114 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.920152903 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.920180082 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.921787024 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.921838045 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.921840906 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.921886921 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.921904087 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.921932936 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.921958923 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.921966076 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.923542976 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.923571110 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.923593998 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.923623085 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.923648119 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.923676014 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.923696995 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.923717976 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.925229073 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.925257921 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.925281048 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.925298929 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.925343990 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.925371885 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.925395012 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.925414085 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.926903963 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.926943064 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.926959038 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.926980972 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.926995039 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.927036047 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.927064896 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.927071095 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.928613901 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.928642988 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.928673029 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.928690910 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.928694963 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.928723097 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.928740025 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.928764105 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.930154085 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.930203915 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.930208921 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.930238008 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.930252075 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.930284977 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.930304050 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.930356026 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.931883097 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.931936026 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.931938887 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.931969881 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.931982994 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.932015896 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.933413982 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.933468103 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.933470964 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.933502913 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.933523893 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.933547974 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.935040951 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.935069084 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.935095072 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.935102940 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.935117960 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.935146093 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.935172081 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.935183048 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.937041998 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.937094927 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.937143087 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.937171936 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.937194109 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.937202930 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.937216043 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.937246084 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.938776970 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.938827991 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.938832998 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.938862085 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.938879967 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.938905001 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.940001965 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.940052986 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.940056086 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.940099955 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.940099955 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.940154076 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.940860033 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.940912008 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.940913916 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.940962076 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.940963984 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.940993071 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.941020012 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.941030979 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.942526102 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.942555904 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.942579985 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.942594051 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.942605019 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.942634106 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.942662001 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.942668915 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.945188999 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.945240974 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.945255041 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.945272923 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.945291042 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.945313931 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.945799112 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.945858002 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.945871115 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.945909023 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.945929050 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.945950985 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.946696043 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.946727991 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.946749926 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.946759939 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.946773052 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.946809053 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.948056936 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.948086023 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.948117018 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.948124886 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.948136091 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.948165894 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.948195934 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.948201895 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.949405909 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.949455023 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.949462891 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.949502945 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.949506998 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.949534893 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.949553013 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.949573994 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.954915047 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.954945087 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.954969883 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.954977036 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.954986095 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.955015898 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.955028057 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.955059052 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.955082893 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.955092907 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.955284119 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.955312014 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.955334902 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.955351114 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.955403090 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.955451965 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.955456972 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.955502033 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.960048914 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.960099936 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.960131884 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.960135937 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.960166931 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.960186005 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.960200071 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.960228920 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.960294962 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.960326910 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.960336924 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.960370064 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.965744019 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.965771914 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.965794086 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.965805054 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.965818882 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.965852976 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.965856075 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.965888977 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.965908051 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.965920925 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.965931892 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.965972900 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.966263056 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.966295958 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.966900110 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.971708059 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.971738100 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.971781015 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.971786976 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.971815109 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.971831083 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.971842051 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.971867085 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.971883059 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.971899986 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.971910000 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.971932888 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.971950054 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.971968889 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.971982956 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.972023010 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.979703903 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.979773998 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.979774952 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.979823112 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.979826927 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.979856968 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.979876041 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.979891062 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.979907990 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.979954958 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.979954958 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.980006933 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.980017900 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.980066061 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.987730026 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.987782001 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.987785101 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.987814903 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.987843990 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.987847090 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.987853050 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.987900972 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.987910986 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.987945080 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.987966061 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.987987041 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.988008022 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.988040924 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.988054991 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.988090038 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.995424032 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.995452881 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.995481968 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.995496035 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.995502949 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.995536089 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.995554924 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.995568991 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.995579958 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.995614052 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.995620012 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.995654106 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.995675087 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.995692968 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:08.995702028 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:08.995749950 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.001558065 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.001617908 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.001672983 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.001702070 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.001729012 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.001739979 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.001751900 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.001785040 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.001804113 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.001816988 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.001827002 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.001863003 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.002088070 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.002136946 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.002142906 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.002182961 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.005621910 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.005680084 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.005686998 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.005726099 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.005727053 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.005762100 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.005773067 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.005808115 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.005811930 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.005844116 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.005870104 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.005877018 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.005888939 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.005916119 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.005928040 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.005979061 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.010921001 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.010974884 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.010977983 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.011008024 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.011023998 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.011042118 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.011058092 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.011092901 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.011151075 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.011202097 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.011204004 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.011235952 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.011253119 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.011267900 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.011285067 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.011308908 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.016119957 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.016171932 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.016180992 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.016218901 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.016222000 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.016254902 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.016277075 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.016288996 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.016298056 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.016323090 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.016334057 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.016356945 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.016374111 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.016390085 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.016406059 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.016438007 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.021111965 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.021141052 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.021169901 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.021173954 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.021188021 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.021214962 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.021226883 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.021275997 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.021281958 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.021310091 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.021326065 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.021363020 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.021382093 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.021436930 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.021742105 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.021801949 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.025973082 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.026000977 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.026029110 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.026046038 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.026062965 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.026117086 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.026119947 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.026154041 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.026175976 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.026199102 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.026205063 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.026240110 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.026257992 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.026273012 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.026278973 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.026321888 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.029680967 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.029733896 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.029741049 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.029768944 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.029787064 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.029819012 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.029819965 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.029854059 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.029870033 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.029886961 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.029918909 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.029918909 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.029941082 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.029953003 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.029966116 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.030000925 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.033482075 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.033514977 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.033543110 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.033549070 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.033560991 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.033586025 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.033591986 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.033636093 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.033636093 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.033670902 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.033693075 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.033703089 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.033716917 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.033752918 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.034066916 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.034133911 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.038350105 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.038378954 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.038403988 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.038424015 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.038431883 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.038465023 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.038480997 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.038512945 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.038516045 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.038549900 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.038573027 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.038583040 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.038614988 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.038623095 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.038630009 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.038651943 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.041990042 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.042040110 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.042047024 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.042072058 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.042088985 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.042124033 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.042126894 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.042184114 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.042191029 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.042241096 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.042242050 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.042273998 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.042293072 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.042306900 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.042319059 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.042349100 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.047493935 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.047545910 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.047545910 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.047578096 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.047595024 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.047629118 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.047641039 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.047689915 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.047693014 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.047722101 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.047741890 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.047758102 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.047933102 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.047985077 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.048044920 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.048094034 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.058346987 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.058398962 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.058404922 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.058432102 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.058449030 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.058465958 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.058480978 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.058517933 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.058530092 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.058582067 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.058609009 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.058640957 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.058660984 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.058672905 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.058686018 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.058717012 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.064282894 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.064338923 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.064364910 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.064466953 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.064502001 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.064555883 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.064560890 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.064608097 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.064608097 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.064642906 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.064659119 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.064676046 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.064694881 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.064726114 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.072218895 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.072269917 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.072276115 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.072303057 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.072318077 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.072346926 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.072365999 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.072413921 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.072415113 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.072463036 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.072463989 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.072524071 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.072527885 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.072560072 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.072576046 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.072609901 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.080327034 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.080379009 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.080388069 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.080413103 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.080426931 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.080446959 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.080466032 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.080504894 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.080544949 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.080595970 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.080615997 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.080629110 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.080661058 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.080670118 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.080670118 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.080720901 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.087872982 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.087951899 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.087970972 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.088001013 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.088027000 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.088046074 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.088052988 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.088102102 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.088104963 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.088136911 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.088160038 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.088169098 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.088180065 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.088202000 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.088211060 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.088319063 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.094185114 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.094238043 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.094269037 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.094274044 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.094314098 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.094314098 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.094333887 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.094383955 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.094388962 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.094417095 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.094434023 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.094450951 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.094460011 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.094484091 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.094494104 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.094526052 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.098057032 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.098112106 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.098121881 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.098145962 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.098160982 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.098189116 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.098196983 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.098231077 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.098257065 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.098270893 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.098289013 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.098304987 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.098306894 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.098359108 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.103539944 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.103569984 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.103595018 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.103602886 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.103629112 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.103653908 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.103687048 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.103692055 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.103692055 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.103738070 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.103761911 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.103770018 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.103785038 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.103817940 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.103825092 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.103874922 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.108728886 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.108786106 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.108797073 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.108819962 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.108838081 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.108855009 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.108866930 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.108887911 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.108896017 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.108922005 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.108935118 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.108958006 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.108972073 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.108989954 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.109005928 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.109035015 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.118590117 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.118644953 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.118655920 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.118679047 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.118695021 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.118712902 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.118724108 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.118748903 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.118761063 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.118782043 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.118803024 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.118834972 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.118861914 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.118894100 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.118908882 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.118926048 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.118937969 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.118971109 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.118978977 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.119072914 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.119585037 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.119637012 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.119637966 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.119669914 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.119684935 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.119704962 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.119715929 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.119750977 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.122262955 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.122313023 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.122315884 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.122349977 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.122364998 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.122407913 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.122430086 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.122461081 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.122476101 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.122507095 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.122510910 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.122545004 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.122561932 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.122586012 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.131259918 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.131345034 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.131376028 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.131429911 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.131459951 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.131496906 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.131509066 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.131547928 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.131551027 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.131601095 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.131664991 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.131714106 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.131716967 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.131762028 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.131764889 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.131795883 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.131812096 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.131849051 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.132575035 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.132632017 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.132649899 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.132682085 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.132705927 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.132741928 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.132745028 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.132792950 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.134768963 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.134820938 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.134828091 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.134850979 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.134874105 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.134892941 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.134900093 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.134932995 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.134952068 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.134978056 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.134984016 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.135015965 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.135036945 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.135047913 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.135061026 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.135097980 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.140202999 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.140254974 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.140261889 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.140302896 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.140307903 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.140336990 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.140352011 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.140372038 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.140384912 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.140419960 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.140522003 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.140556097 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.140575886 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.140602112 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.151438951 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.151473045 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.151498079 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.151505947 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.151556015 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.151587009 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.151618004 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.151669025 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.151679993 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.151679993 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.151679993 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.151679993 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.151679993 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.151722908 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.156797886 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.156853914 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.156862020 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.156912088 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.157013893 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.157061100 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.157104015 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.157136917 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.157156944 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.157170057 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.157181978 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.157218933 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.157316923 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.157371044 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.157393932 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.157448053 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.164891005 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.164958954 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.164964914 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.164997101 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.165019989 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.165040970 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.165069103 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.165105104 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.165121078 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.165139914 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.165149927 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.165174961 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.165189028 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.165222883 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.165491104 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.165549040 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.173016071 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.173069954 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.173072100 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.173119068 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.173124075 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.173160076 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.173176050 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.173192978 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.173207045 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.173243046 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.173264027 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.173296928 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.173315048 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.173331976 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.173342943 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.173374891 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.180473089 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.180533886 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.180535078 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.180572987 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.180596113 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.180610895 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.180625916 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.180660009 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.180676937 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.180704117 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.180711985 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.180744886 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.180766106 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.180778980 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.180793047 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.180824041 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.186901093 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.186952114 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.186959028 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.186994076 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.187011003 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.187047005 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.187060118 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.187093973 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.187114954 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.187128067 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.187136889 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.187164068 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.187175989 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.187211990 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.190738916 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.190773010 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.190790892 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.190809011 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.190818071 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.190864086 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.190877914 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.190912008 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.190928936 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.190946102 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.190963030 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.190982103 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.190998077 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.191028118 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.201229095 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.201287985 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.201297998 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.201319933 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.201338053 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.201370955 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.201374054 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.201407909 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.201427937 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.201441050 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.201457024 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.201489925 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.201492071 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.201536894 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.201843023 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.201896906 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.201901913 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.201931953 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.201951981 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.201970100 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.201991081 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.202003956 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.202018976 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.202053070 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.202410936 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.202466011 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.202469110 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.202500105 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.202521086 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.202533960 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.202553034 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.202584982 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.210922003 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.210979939 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.210988045 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.211014986 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.211034060 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.211066008 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.211067915 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.211102962 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.211118937 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.211137056 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.211146116 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.211173058 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.211190939 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.211215973 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.211585999 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.211646080 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.211711884 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.211740971 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.211765051 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.211781025 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.211863041 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.211910963 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.211934090 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.211968899 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.211986065 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.212018013 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.212034941 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.212065935 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.212275028 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.212332010 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.212354898 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.212407112 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.214792967 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.214839935 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.214847088 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.214881897 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.214890957 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.214917898 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.214931965 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.214952946 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.215034962 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.215051889 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.215105057 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.215106964 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.215148926 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.223927975 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.223983049 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.223994970 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.224018097 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.224030018 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.224054098 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.224064112 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.224098921 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.224107027 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.224153042 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.224232912 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.224284887 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.224284887 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.224319935 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.224329948 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.224354029 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.224364042 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.224387884 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.224405050 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.224435091 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.224754095 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.224798918 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.224807024 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.224839926 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.224849939 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.224874973 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.224879980 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.224909067 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.224919081 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.224951982 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.227317095 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.227368116 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.227368116 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.227402925 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.227410078 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.227441072 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.227449894 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.227474928 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.227492094 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.227521896 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.227637053 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.227672100 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.227686882 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.227715969 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.232753992 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.232809067 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.232814074 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.232847929 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.232862949 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.232883930 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.232892990 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.232918978 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.232932091 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.232964039 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.232992887 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.233026981 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.233040094 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.233067989 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.244221926 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.244273901 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.244275093 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.244309902 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.244319916 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.244343996 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.244353056 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.244380951 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.244385004 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.244415998 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.244432926 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.244452000 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.244471073 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.244497061 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.244504929 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.244546890 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.251115084 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.251167059 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.251171112 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.251204014 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.251219988 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.251240015 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.251250029 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.251281977 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.251333952 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.251386881 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.251390934 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.251421928 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.251455069 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.251456022 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.251463890 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.251499891 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.273400068 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.273453951 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.273461103 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.273488998 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.273500919 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.273524046 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.273525000 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.273557901 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.273570061 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.273610115 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.273672104 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.273705959 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.273720026 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.273740053 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.273749113 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.273776054 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.273793936 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.273811102 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.273827076 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.273845911 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.273859024 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.273880005 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.273894072 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.273929119 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.273984909 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.274019957 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.274029970 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.274053097 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.274061918 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.274086952 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.274091959 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.274122953 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.274128914 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.274157047 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.274158001 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.274194002 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.274202108 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.274229050 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.274239063 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.274266005 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.274272919 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.274311066 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.279736996 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.279788017 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.279807091 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.279843092 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.279859066 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.279891968 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.279908895 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.279942036 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.279963017 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.279977083 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.279987097 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.280028105 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.280031919 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.280069113 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.283617973 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.283673048 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.283674002 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.283709049 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.283725023 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.283756018 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.283822060 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.283855915 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.283871889 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.283890963 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.283905983 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.283926010 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.283943892 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.283976078 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.294157028 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.294212103 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.294213057 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.294248104 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.294264078 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.294290066 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.294409037 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.294442892 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.294461966 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.294477940 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.294486046 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.294514894 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.294531107 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.294560909 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.294579983 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.294627905 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.294646978 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.294680119 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.294691086 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.294723988 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.294734001 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.294766903 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.294776917 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.294801950 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.294807911 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.294838905 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.294842958 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.294895887 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.324124098 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.324181080 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.324184895 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.324219942 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.324228048 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.324261904 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.324317932 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.324352980 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.324371099 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.324388027 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.324392080 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.324424028 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.324440956 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.324465036 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.324572086 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.324620008 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.324624062 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.324657917 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.324673891 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.324706078 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.324748039 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.324783087 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.324800014 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.324817896 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.324832916 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.324868917 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.324870110 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.324915886 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.325416088 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.325463057 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.325469971 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.325505018 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.325520039 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.325548887 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.325591087 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.325625896 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.325639963 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.325659990 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.325670004 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.325696945 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.325700045 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.325742960 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.326297998 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.326349020 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.326351881 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.326386929 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.326402903 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.326436043 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.326471090 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.326504946 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.326524019 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.326539040 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.326540947 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.326576948 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.326597929 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.326615095 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.327223063 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.327258110 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.327275038 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.327294111 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.327302933 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.327342987 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.327347040 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.327379942 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.327404022 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.327414036 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.327426910 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.327450037 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.327459097 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.327501059 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.328071117 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.328105927 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.328124046 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.328140020 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.328149080 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.328182936 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.328192949 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.328227997 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.328252077 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.328259945 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.328272104 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.328294039 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.328310966 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.328339100 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.328891993 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.328948021 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.328965902 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.328984976 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.329001904 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.329143047 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.336869955 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.336927891 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.336927891 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.336965084 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.336980104 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.337009907 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.337030888 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.337065935 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.337083101 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.337100029 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.337116003 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.337136030 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.337151051 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.337182999 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.343821049 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.343877077 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.343878031 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.343914032 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.343945026 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.343949080 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.343969107 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.343995094 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.344047070 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.344094992 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.344100952 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.344136000 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.344151020 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.344168901 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.344180107 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.344212055 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.364243031 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.364300966 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.364324093 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.364336014 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.364365101 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.364383936 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.364388943 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.364423037 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.364443064 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.364458084 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.364506960 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.364554882 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.364588976 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.364609003 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.364622116 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.364655018 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.364658117 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.364677906 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.364690065 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.364694118 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.364725113 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.364733934 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.364769936 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.364778996 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.364814043 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.364833117 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.364859104 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.365801096 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.365869045 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.365874052 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.365905046 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.365920067 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.365958929 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.366019964 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.366054058 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.366077900 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.366087914 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.366101980 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.366132975 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.366142988 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.366189957 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.372279882 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.372334957 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.372339010 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.372370958 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.372384071 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.372409105 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.372411966 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.372445107 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.372458935 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.372479916 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.372502089 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.372545004 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.372545004 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.372596025 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.376188993 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.376245022 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.376247883 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.376279116 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.376298904 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.376322031 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.376346111 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.376380920 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.376400948 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.376415014 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.376427889 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.376450062 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.376462936 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.376499891 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.376527071 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.376553059 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.387094021 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.387151003 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.387156963 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.387192965 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.387204885 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.387240887 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.387258053 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.387288094 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.387291908 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.387326956 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.387343884 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.387362003 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.387371063 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.387397051 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.387404919 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.387432098 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.387439013 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.387466908 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.387480974 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.387501955 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.387516022 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.387537003 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.387550116 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.387592077 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.387598038 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.387628078 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.387639046 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.387681007 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.416596889 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.416656017 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.416671991 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.416687965 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.416702032 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.416733027 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.416742086 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.416776896 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.416793108 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.416810989 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.416827917 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.416847944 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.416860104 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.416897058 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.416902065 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.416938066 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.416945934 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.416971922 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.416981936 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.417009115 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.417022943 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.417061090 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.417296886 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.417350054 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.417350054 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.417386055 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.417402029 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.417433023 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.417471886 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.417505026 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.417521000 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.417540073 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.417560101 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.417573929 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.417592049 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.417609930 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.417620897 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.417655945 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.417854071 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.417907000 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.417907953 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.417943001 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.417952061 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.417984009 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.418028116 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.418061972 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.418076992 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.418095112 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.418108940 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.418132067 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.418142080 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.418176889 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.418203115 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.418237925 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.418256044 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.418275118 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.418291092 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.418322086 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.418545008 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.418597937 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.418600082 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.418632984 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.418648005 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.418675900 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.418754101 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.418787003 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.418807030 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.418821096 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.418845892 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.418854952 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.418863058 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.418890953 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.418898106 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.418926954 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.418941021 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.418963909 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.418977022 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.418998957 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.419013023 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.419045925 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.419070959 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.419101000 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.419118881 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.419141054 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.419445038 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.419496059 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.419500113 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.419533968 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.419548988 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.419581890 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.419650078 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.419682980 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.419699907 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.419717073 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.419724941 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.419751883 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.419764042 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.419795036 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.429546118 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.429601908 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.429613113 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.429636955 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.429650068 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.429683924 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.429706097 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.429738998 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.429760933 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.429771900 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.429805994 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.429805994 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.429814100 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.429867029 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.437520027 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.437581062 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.437593937 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.437614918 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.437628031 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.437664986 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.437673092 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.437707901 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.437726974 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.437741041 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.437752008 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.437777042 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.437788963 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.437819004 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.456568003 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.456638098 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.456646919 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.456674099 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.456686020 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.456724882 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.456752062 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.456785917 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.456799030 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.456819057 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.456835032 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.456864119 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.456870079 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.456914902 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.456924915 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.456962109 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.456975937 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.456998110 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.457010031 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.457032919 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.457043886 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.457068920 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.457082987 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.457104921 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.457115889 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.457142115 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.457154989 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.457185030 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.458738089 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.458827972 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.458836079 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.458872080 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.458892107 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.458915949 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.458925009 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.458961010 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.458976030 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.458993912 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.459006071 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.459028959 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.459038973 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.459105968 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.465106010 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.465136051 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.465162039 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.465171099 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.465186119 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.465214968 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.465223074 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.465256929 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.465279102 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.465290070 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.465307951 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.465325117 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.465337992 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.465358019 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.465373993 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.465408087 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.468806982 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.468837023 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.468863964 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.468869925 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.468890905 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.468913078 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.468920946 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.468956947 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.468976021 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.468991041 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.468996048 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.469039917 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.469074965 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.469108105 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.469130993 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.469151020 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.479840994 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.479871035 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.479898930 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.479919910 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.479923010 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.479958057 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.479971886 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.479991913 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.480005980 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.480045080 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.480045080 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.480079889 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.480103016 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.480112076 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.480123043 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.480164051 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.480176926 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.480230093 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.480230093 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.480268002 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.480283022 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.480320930 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.480333090 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.480366945 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.480385065 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.480400085 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.480410099 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.480437040 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.480448008 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.480505943 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.509413958 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.509483099 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.509491920 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.509530067 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.509551048 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.509567022 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.509578943 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.509624958 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.509627104 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.509677887 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.509699106 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.509732962 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.509747028 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.509768009 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.509776115 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.509802103 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.509819031 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.509848118 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.509855986 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.509907961 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.509908915 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.509944916 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.509955883 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.509979963 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.509994984 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.510015965 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.510030985 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.510052919 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.510067940 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.510087967 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.510102987 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.510138035 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.510140896 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.510175943 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.510191917 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.510211945 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.510226011 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.510258913 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.510467052 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.510575056 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.510579109 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.510620117 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.510627985 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.510664940 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.510684013 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.510698080 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.510709047 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.510735035 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.510747910 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.510786057 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.510895014 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.510946989 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.510952950 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.510982037 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.510998011 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.511025906 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.511082888 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.511116028 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.511131048 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.511149883 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.511167049 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.511199951 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.511218071 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.511235952 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.511243105 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.511288881 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.511291981 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.511326075 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.511334896 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.511360884 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.511375904 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.511396885 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.511413097 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.511434078 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.511447906 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.511482000 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.511883020 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.511939049 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.512033939 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.512063980 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.512089968 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.512101889 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.512115002 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.512150049 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.512166023 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.512183905 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.512201071 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.512218952 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.512242079 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.512258053 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.512270927 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.512305975 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.512322903 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.512341022 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.512351036 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.512382030 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.522048950 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.522104025 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.522104025 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.522139072 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.522155046 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.522188902 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.522224903 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.522258043 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.522279024 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.522291899 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.522300959 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.522325993 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.522341013 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.522361994 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.522377014 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.522409916 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.530023098 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.530080080 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.530083895 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.530112982 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.530128956 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.530162096 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.530165911 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.530213118 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.530216932 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.530251980 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.530272961 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.530286074 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.530292988 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.530322075 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.530333042 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.530366898 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.549110889 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.549168110 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.549175024 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.549202919 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.549217939 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.549257040 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.549258947 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.549292088 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.549312115 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.549324989 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.549344063 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.549360991 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.549375057 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.549396992 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.549417973 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.549438953 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.549448967 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.549499035 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.549504042 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.549539089 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.549552917 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.549593925 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.549612045 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.549644947 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.549660921 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.549679041 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.549689054 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.549731016 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.551239967 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.551292896 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.551292896 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.551330090 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.551346064 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.551364899 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.551378012 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.551399946 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.551414967 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.551440001 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.551445961 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.551475048 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.551490068 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.551520109 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.557486057 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.557540894 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.557544947 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.557574987 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.557589054 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.557610989 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.557621956 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.557646990 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.557662964 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.557682037 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.557707071 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.557715893 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.557724953 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.557749987 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.557766914 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.557799101 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.561575890 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.561635971 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.561705112 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.561755896 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.561758995 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.561790943 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.561809063 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.561825037 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.561836004 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.561860085 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.561871052 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.561894894 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.561912060 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.561976910 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.572463036 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.572546959 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.572580099 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.572598934 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.572626114 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.572633982 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.572655916 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.572690010 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.572712898 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.572724104 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.572745085 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.572760105 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.572777987 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.572814941 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.572815895 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.572860956 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.572866917 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.572916985 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.572918892 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.572956085 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.572971106 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.572988987 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.572999001 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.573091984 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.573103905 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.573139906 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.573154926 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.573174000 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.573189020 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.573210001 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.573220968 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.573261023 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.602104902 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.602262020 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.602278948 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.602302074 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.602318048 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.602343082 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.602344036 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.602359056 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.602462053 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.602477074 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.602490902 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.602505922 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.602519989 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.602564096 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.602564096 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.602564096 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.602564096 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.602653027 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.602668047 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.602689028 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.602700949 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.602787971 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.602803946 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.602845907 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.602880955 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.602895975 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.602910042 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.602922916 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.602925062 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.602942944 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.602950096 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.602971077 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.602994919 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.603085995 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.603101015 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.603116989 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.603142977 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.603161097 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.603167057 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.603200912 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.603334904 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.603374958 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.603415966 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.603430986 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.603452921 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.603456020 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.603471994 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.603493929 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.603543043 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.603655100 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.603688955 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.603709936 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.603734970 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.603743076 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.603776932 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.603794098 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.603811026 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.603823900 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.603847027 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.603853941 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.603883982 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.603893042 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.603920937 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.603931904 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.603965044 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.603976965 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.604012012 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.604022026 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.604047060 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.604058027 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.604082108 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.604090929 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.604116917 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.604125977 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.604160070 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.604358912 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.604403973 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.604444027 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.604479074 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.604486942 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.604545116 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.604568005 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.604600906 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.604619980 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.604635000 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.604645014 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.604680061 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.604686975 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.604732990 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.614890099 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.614948988 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.614975929 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.614984035 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.615070105 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.615103006 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.615135908 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.615144968 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.615144968 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.615144968 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.615170956 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.615171909 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.615185022 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.615231037 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.622857094 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.622911930 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.622925997 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.622981071 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.622982025 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.623016119 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.623035908 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.623059988 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.623068094 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.623104095 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.623121977 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.623137951 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.623147964 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.623182058 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.641801119 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.641832113 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.641865969 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.641871929 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.641894102 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.641916037 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.641921997 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.641957045 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.641985893 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.641993999 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.642011881 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.642030001 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.642065048 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.642091990 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.642112017 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.642128944 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.642134905 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.642188072 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.642204046 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.642222881 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.642258883 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.642272949 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.642276049 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.642309904 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.642322063 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.642358065 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.642364025 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.642400980 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.642416000 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.642431021 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.642455101 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.642478943 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.645236015 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.645294905 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.645324945 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.645349979 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.645365953 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.645376921 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.645411015 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.645418882 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.645447016 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.645469904 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.645481110 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.645483971 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.645515919 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.645560980 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.650115013 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.650176048 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.650186062 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.650218010 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.650235891 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.650264025 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.650284052 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.650319099 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.650335073 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.650366068 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.650372028 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.650405884 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.650420904 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.650441885 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.650454044 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.650490046 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.654048920 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.654102087 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.654105902 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.654133081 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.654155016 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.654196024 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.654215097 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.654247999 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.654266119 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.654282093 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.654295921 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.654330969 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.654350996 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.654403925 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.654814959 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.654880047 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.665009975 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.665065050 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.665067911 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.665095091 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.665146112 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.665179014 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.665210962 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.665246010 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.665278912 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.665292978 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.665292978 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.665292978 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.665292978 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.665292978 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.665311098 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.665328026 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.694838047 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.694891930 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.694905996 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.694931030 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.694974899 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.694993973 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.695009947 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.695024967 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.695070028 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.695178032 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.695194006 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.695209026 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.695224047 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.695228100 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.695240021 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.695249081 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.695256948 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.695266962 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.695277929 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.695295095 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.695378065 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.695400953 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.695425987 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.695442915 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.695481062 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.695497036 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.695512056 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.695525885 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.695525885 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.695535898 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.695542097 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.695554972 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.695580006 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.695646048 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.695699930 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.695739031 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.695755005 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.695785999 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.695802927 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.695832014 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.695847988 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.695862055 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.695877075 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.695892096 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.695923090 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.696022987 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.696038961 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.696053982 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.696069956 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.696094990 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.696120977 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.696166039 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.696254015 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.696269989 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.696302891 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.696320057 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.696321011 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.696337938 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.696353912 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.696381092 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.696403027 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.696504116 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.696518898 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.696532965 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.696566105 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.696585894 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.696660042 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.696676970 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.696691036 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.696706057 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.696719885 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.696722984 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.696738958 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.696741104 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.696757078 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.696763039 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.696785927 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.696810007 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.696942091 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.696958065 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.696971893 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.696985960 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.697002888 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.697026968 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.697170973 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.697261095 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.697276115 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.697297096 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.697314978 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.697341919 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.697355986 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.697371006 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.697385073 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.697386026 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.697412968 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.697429895 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.707401991 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.707461119 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.707564116 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.707595110 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.707612991 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.707639933 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.707648039 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.707680941 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.707700014 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.707715988 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.707730055 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.707751989 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.707792044 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.707803011 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.707808971 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.707853079 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.715408087 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.715462923 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.715465069 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.715497971 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.715509892 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.715540886 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.715553999 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.715588093 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.715605021 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.715625048 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.715636969 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.715658903 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.715670109 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.715703964 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.734514952 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.734549999 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.734584093 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.734586954 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.734601974 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.734637976 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.734641075 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.734693050 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.734697104 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.734728098 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.734749079 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.734771967 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.734780073 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.734816074 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.734829903 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.734849930 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.734862089 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.734885931 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.734896898 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.734929085 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.734941006 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.734992981 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.734993935 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.735029936 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.735047102 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.735066891 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.735076904 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.735121012 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.737910986 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.737967968 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.737971067 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.738002062 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.738033056 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.738042116 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.738054991 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.738087893 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.738106012 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.738122940 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.738136053 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.738158941 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.738173008 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.738193989 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.738208055 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.738250017 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.742697001 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.742750883 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.742784977 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.742809057 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.742837906 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.742872953 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.742907047 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.742940903 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.743050098 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.743050098 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.743050098 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.743050098 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.743050098 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.746722937 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.746753931 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.746789932 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.746799946 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.746807098 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.746843100 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.746860027 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.746879101 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.746893883 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.746915102 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.746927023 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.746965885 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.747461081 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.747510910 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.747510910 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.747565985 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.758477926 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.758512020 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.758553028 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.758585930 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.758624077 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.758650064 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.758683920 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.758718014 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.758738041 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.758754969 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.758763075 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.758800983 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.787228107 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.787305117 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.787321091 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.787365913 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.787381887 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.787390947 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.787439108 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.787439108 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.787455082 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.787497997 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.787601948 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.787617922 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.787632942 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.787643909 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.787657976 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.787667036 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.787676096 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.787688971 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.787697077 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.787697077 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.787714005 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.787729025 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.787729979 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.787744045 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.787791014 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.787844896 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.787858963 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.787875891 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.787890911 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.787905931 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.787900925 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.787919998 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.787939072 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.787955999 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.787974119 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.787988901 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.788003922 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.788036108 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.788036108 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.788053036 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.788073063 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.788116932 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.788168907 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.788184881 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.788199902 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.788216114 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.788222075 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.788249969 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.788263083 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.788295031 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.788309097 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.788322926 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.788336992 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.788348913 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.788361073 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.788373947 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.788471937 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.788501978 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.788527966 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.788542986 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.788549900 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.788568974 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.788582087 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.788700104 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.788716078 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.788731098 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.788744926 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.788758993 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.788763046 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.788769960 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.788798094 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.788813114 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.788902044 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.788916111 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.788930893 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.788944006 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.788948059 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.788954973 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.788976908 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.789000034 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.789028883 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.789143085 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.789164066 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.789186001 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.789202929 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.789227009 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.789242029 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.789257050 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.789268970 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.789273024 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.789280891 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.789289951 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.789310932 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.792262077 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.792309999 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.792315006 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.792325020 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.792351007 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.792370081 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.792385101 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.792391062 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.792411089 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.792419910 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.792454958 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.792469978 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.792504072 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.792516947 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.800169945 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.800184011 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.800199032 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.800241947 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.800267935 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.800283909 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.800298929 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.800313950 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.800326109 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.800338030 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.800342083 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.800357103 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.800379038 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.800385952 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.802464962 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.807987928 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.808046103 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.808079004 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.808111906 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.808130980 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.808142900 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.808166027 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.808176994 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.808199883 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.808235884 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.808245897 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.808271885 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.808279037 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.808316946 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.827095032 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.827131987 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.827162981 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.827183008 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.827186108 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.827229977 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.827239990 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.827275038 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.827285051 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.827310085 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.827316999 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.827346087 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.827353001 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.827393055 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.827402115 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.827435970 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.827445030 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.827469110 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.827477932 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.827505112 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.827513933 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.827542067 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.827550888 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.827589989 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.827596903 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.827631950 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.827645063 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.827673912 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.830508947 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.830579042 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.830585003 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.830615997 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.830632925 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.830667973 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.830672026 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.830705881 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.830749989 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.830755949 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.830790043 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.830810070 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.830837011 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.830924034 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.830955029 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.830965996 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.831000090 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.835299015 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.835330009 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.835382938 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.835396051 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.835443020 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.835450888 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.835485935 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.835494995 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.835529089 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.835537910 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.835573912 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.835587978 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.835608006 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.835618019 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.835649967 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.839381933 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.839436054 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.839437962 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.839484930 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.839488983 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.839524984 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.839530945 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.839560032 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.839569092 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.839684010 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.839684963 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.839720964 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.839766979 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.879750967 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.879813910 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.879863024 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.879865885 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.879898071 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.879909039 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.879931927 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.879968882 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.879982948 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.880008936 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.880023003 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.880028963 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.880058050 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.880091906 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.880104065 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.880119085 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.880146027 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.880177975 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.880228996 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.880229950 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.880264044 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.880274057 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.880300045 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.880311012 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.880336046 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.880354881 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.880377054 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.880398989 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.880431890 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.880465031 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.880475044 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.880511999 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.880548000 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.880582094 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.880594015 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.880614996 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.880620956 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.880647898 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.880656958 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.880692005 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.880701065 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.880732059 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.880749941 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.880764961 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.880769968 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.880803108 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.880847931 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.880857944 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.880892992 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.880903959 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.880927086 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.880938053 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.880963087 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.880979061 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.880999088 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.881002903 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.881035089 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.881059885 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.881122112 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.881155014 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.881162882 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.881189108 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.881201982 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.881223917 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.881232023 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.881258965 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.881263971 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.881292105 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.881299973 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.881326914 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.881336927 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.881365061 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.881371021 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.881408930 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.881448984 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.881481886 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.881494045 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.881516933 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.881525993 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.881551027 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.881561041 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.881587029 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.881601095 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.881635904 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.881642103 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.881676912 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.881690025 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.881712914 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.881720066 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.881762981 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.881856918 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.881890059 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.881900072 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.881925106 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.881932974 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.881958961 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.881969929 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.881994009 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.882000923 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.882028103 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.882036924 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.882045031 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.882060051 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.882069111 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.882075071 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.882086039 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.882090092 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.882105112 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.882106066 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.882114887 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.882122040 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.882136106 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.882148027 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.882165909 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.882236958 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.882251978 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.882266045 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.882281065 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.882292032 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.882296085 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.882316113 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.882334948 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.882416964 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.882433891 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.882458925 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.882482052 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.892735004 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.892790079 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.892802000 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.892805099 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.892829895 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.892842054 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.892873049 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.892889023 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.892926931 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.892956972 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.892971992 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.892998934 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.893017054 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.900544882 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.900604963 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.900682926 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.900696993 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.900711060 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.900722980 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.900726080 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.900738955 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.900743008 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.900748968 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.900759935 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.900770903 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.900779009 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.900788069 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.900791883 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.900800943 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.900815964 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.900825977 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.919791937 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.919822931 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.919838905 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.919857979 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.919888973 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.919924021 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.919956923 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.919962883 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.920000076 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.920007944 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.920047998 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.920061111 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.920095921 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.920105934 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.920129061 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.920134068 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.920162916 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.920166016 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.920201063 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.920212984 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.920244932 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.920561075 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.920593023 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.920628071 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.920646906 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.920659065 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.920672894 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.920701981 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.923258066 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.923346043 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.923355103 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.923377037 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.923393011 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.923425913 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.923429966 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.923464060 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.923496008 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.923499107 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.923507929 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.923533916 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.923542023 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.923568010 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.923578978 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.923608065 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.928029060 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.928083897 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.928118944 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.928158045 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.928188086 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.928191900 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.928241968 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.928277016 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.928287029 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.928313017 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.928323984 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.928348064 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.928356886 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.928395987 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.932145119 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.932197094 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.932230949 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.932230949 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.932248116 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.932284117 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.932317972 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.932318926 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.932338953 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.932353020 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.932360888 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.932388067 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.932421923 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.932432890 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.932462931 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.972362041 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.972394943 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.972429037 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.972464085 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.972500086 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.972502947 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.972553968 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.972608089 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.972609043 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.972661018 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.972678900 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.972712040 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.972726107 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.972757101 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.972779989 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.972836971 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.972868919 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.972919941 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.972954988 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.973007917 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.973057032 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.973093987 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.973124981 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.973144054 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.973176956 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.973181009 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.973229885 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.973231077 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.973263979 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.973285913 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.973303080 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.973320961 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.973335981 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.973366976 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.973386049 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.973387957 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.973421097 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.973455906 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.973468065 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.973504066 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.973527908 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.973537922 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.973557949 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.973573923 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.973588943 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.973623991 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.973637104 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.973659039 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.973671913 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.973695993 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.973707914 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.973731041 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.973746061 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.973767996 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.973779917 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.973817110 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.973823071 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.973856926 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.973870993 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.973891973 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.973902941 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.973927975 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.973939896 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.973974943 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.973982096 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.974031925 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.974034071 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.974070072 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.974085093 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.974103928 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.974117041 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.974138975 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.974150896 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.974174023 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.974188089 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.974209070 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.974231005 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.974251986 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.974261045 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.974296093 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.974307060 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.974334955 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.974344015 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.974369049 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.974381924 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.974404097 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.974427938 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.974442959 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.974448919 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.974484921 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.974531889 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.974565029 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.974581003 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.974597931 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.974608898 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.974632025 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.974637985 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.974667072 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.974683046 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.974703074 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.974710941 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.974737883 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.974750996 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.974771976 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.974781990 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.974808931 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.974816084 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.974853992 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.975225925 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.975258112 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.975290060 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.975291014 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.975310087 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.975323915 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.975342989 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.975358009 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.975373983 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.975392103 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.975425005 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.975438118 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.975471020 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.985402107 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.985441923 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.985457897 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.985502958 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.985522032 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.985567093 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.985583067 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.985598087 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.985610962 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.985611916 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.985626936 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.985644102 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.985661983 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.993163109 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.993212938 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.993226051 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.993263960 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.993290901 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.993316889 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.993331909 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.993345976 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.993361950 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.993374109 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.993407965 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:09.993418932 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:09.993458986 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.012723923 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.012749910 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.012763977 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.012823105 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.012859106 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.012875080 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.012895107 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.012904882 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.012908936 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.012931108 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.012943029 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.013089895 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.013104916 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.013118982 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.013130903 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.013134003 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.013149977 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.013154984 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.013165951 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.013168097 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.013183117 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.013195038 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.013199091 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.013221979 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.013246059 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.020663023 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.020697117 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.020730972 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.020751953 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.020787954 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.020808935 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.020843029 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.020858049 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.020875931 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.020889044 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.020910978 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.020920038 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.020953894 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.020966053 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.021001101 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.021008015 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.021034956 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.021040916 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.021075964 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.021080971 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.021110058 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.021121025 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.021145105 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.021157026 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.021179914 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.021184921 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.021214962 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.021225929 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.021256924 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.024811029 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.024882078 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.024914026 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.024966002 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.024985075 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.024998903 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.025007010 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.025023937 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.025034904 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.025052071 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.025069952 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.025082111 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.025119066 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.065068007 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.065120935 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.065172911 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.065241098 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.065274954 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.065308094 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.065341949 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.065392017 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.065426111 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.065454960 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.065505028 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.065537930 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.065571070 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.065604925 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.065638065 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.065671921 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.065709114 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.065741062 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.065789938 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.065823078 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.065855980 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.065888882 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.065939903 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.065989971 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.066023111 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.066072941 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.066106081 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.066138983 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.066164017 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.066171885 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.066224098 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.066250086 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.066257954 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.066267967 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.066310883 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.066344976 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.066353083 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.066378117 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.066385984 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.066435099 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.066468954 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.066479921 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.066504955 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.066517115 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.066539049 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.066548109 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.066576004 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.066584110 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.066612959 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.066626072 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.066658020 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.066760063 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.066792965 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.066807985 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.066827059 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.066839933 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.066862106 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.066867113 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.066898108 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.066907883 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.066932917 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.066941023 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.066967964 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.066987991 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.067012072 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.067019939 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.067055941 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.067069054 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.067089081 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.067109108 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.067121983 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.067132950 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.067167997 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.067173958 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.067219019 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.067226887 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.067260027 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.067270041 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.067295074 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.067302942 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.067329884 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.067334890 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.067365885 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.067373991 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.067404985 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.067409039 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.067451000 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.067490101 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.067523003 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.067536116 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.067557096 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.067569971 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.067591906 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.067605019 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.067626953 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.067636013 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.067662001 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.067673922 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.067697048 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.067711115 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.067730904 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.067743063 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.067768097 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.067778111 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.067811012 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.078023911 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.078079939 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.078114033 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.078140020 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.078155041 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.078197956 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.078231096 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.078265905 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.078274012 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.078300953 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.078310013 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.078345060 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.104945898 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.104999065 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.105015039 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.105057001 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.105084896 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.105118990 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.105134010 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.105149031 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.105164051 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.105173111 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.105195999 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.105221033 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.105365038 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.105381012 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.105395079 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.105407000 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.105411053 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.105420113 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.105434895 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.105442047 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.105451107 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.105453014 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.105468035 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.105478048 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.105492115 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.105503082 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.113245964 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.113270998 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.113337994 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.113351107 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.113368034 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.113399029 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.113426924 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.113435030 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.113451004 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.113466024 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.113480091 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.113493919 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.113495111 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.113526106 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.113543034 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.113652945 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.113687992 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.113698959 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.113723040 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.113733053 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.113759995 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.113766909 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.113802910 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.113943100 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.113979101 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.113993883 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.114015102 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.114025116 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.114049911 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.114058018 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.114085913 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.114095926 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.114129066 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.114140034 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.114175081 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.114182949 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.114218950 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.114226103 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.114260912 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.114269972 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.114305973 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.117353916 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.117409945 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.117440939 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.117465973 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.117494106 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.117496014 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.117531061 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.117544889 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.117564917 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.117578983 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.117600918 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.117609978 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.117635965 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.117646933 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.117682934 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.159270048 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.159307003 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.159359932 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.159393072 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.159393072 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.159429073 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.159450054 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.159462929 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.159471035 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.159501076 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.159508944 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.159547091 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.159599066 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.159645081 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.159651995 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.159698009 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.159702063 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.159745932 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.159769058 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.159804106 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.159815073 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.159838915 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.159849882 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.159876108 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.159885883 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.159913063 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.159923077 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.159955978 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.159965992 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.160000086 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.160007000 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.160034895 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.160046101 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.160079002 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.160119057 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.160152912 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.160172939 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.160192966 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.160206079 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.160239935 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.160249949 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.160273075 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.160283089 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.160309076 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.160319090 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.160343885 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.160353899 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.160379887 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.160389900 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.160415888 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.160425901 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.160464048 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.160617113 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.160651922 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.160665035 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.160685062 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.160696983 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.160721064 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.160734892 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.160758018 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.160768986 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.160793066 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.160804987 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.160829067 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.160862923 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.160866022 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.160909891 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.161039114 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.161072016 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.161082029 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.161107063 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.161119938 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.161139965 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.161150932 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.161175013 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.161185026 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.161211967 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.161225080 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.161247015 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.161257982 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.161282063 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.161290884 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.161317110 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.161329031 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.161353111 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.161364079 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.161390066 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.161400080 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.161425114 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.161434889 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.161459923 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.161470890 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.161505938 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.162554979 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.162589073 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.162610054 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.162622929 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.162631989 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.162657976 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.162664890 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.162693024 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.162702084 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.162728071 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.162739992 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.162761927 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.162770987 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.162811041 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.178340912 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.178394079 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.178427935 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.178450108 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.178461075 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.178488016 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.178495884 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.178514004 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.178550005 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.178585052 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.178592920 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.178618908 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.178630114 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.178663015 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.178689957 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.178725004 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.178741932 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.178767920 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.178775072 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.178811073 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.178822994 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.178845882 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.178858995 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.178879976 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.178890944 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.178925991 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.203042030 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.203090906 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.203107119 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.203156948 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.203170061 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.203208923 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.203223944 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.203238964 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.203249931 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.203254938 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.203263044 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.203283072 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.203313112 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.203414917 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.203429937 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.203444958 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.203459978 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.203464985 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.203476906 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.203485966 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.203491926 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.203494072 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.203517914 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.203545094 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.203587055 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.206154108 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.206212997 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.206238985 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.206254959 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.206275940 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.206294060 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.206300974 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.206310034 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.206326962 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.206351042 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.206367970 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.206505060 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.206520081 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.206535101 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.206549883 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.206549883 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.206558943 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.206564903 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.206578970 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.206582069 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.206592083 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.206610918 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.206618071 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.206799984 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.206815958 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.206830978 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.206841946 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.206845999 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.206857920 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.206866026 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.206880093 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.206882954 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.206890106 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.206899881 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.206907034 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.206916094 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.206923962 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.206935883 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.206963062 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.251475096 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.251518011 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.251533031 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.251580000 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.251584053 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.251596928 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.251612902 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.251629114 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.251629114 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.251646996 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.251714945 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.251730919 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.251745939 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.251754999 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.251760006 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.251807928 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.251822948 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.251837969 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.251866102 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.251888037 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.251940012 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.251955032 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.251969099 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.251996040 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.252019882 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.252087116 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.252111912 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.252126932 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.252140999 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.252156019 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.252156973 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.252171993 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.252182007 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.252188921 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.252188921 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.252207994 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.252219915 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.252228975 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.252249002 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.252371073 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.252384901 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.252412081 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.252419949 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.252427101 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.252435923 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.252461910 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.252500057 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.252567053 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.252583027 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.252597094 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.252609015 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.252612114 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.252628088 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.252630949 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.252643108 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.252655983 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.252677917 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.252697945 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.252741098 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.252784014 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.252799988 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.252815008 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.252825975 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.252832890 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.252839088 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.252850056 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.252851963 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.252866030 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.252882004 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.252887011 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.252923965 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.253074884 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.253089905 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.253104925 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.253139973 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.253149033 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.253169060 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.253184080 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.253196955 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.253211975 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.253226042 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.253227949 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.253242016 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.253257990 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.253257990 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.253268003 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.253274918 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.253293991 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.253300905 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.253324032 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.253345013 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.253655910 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.253670931 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.253685951 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.253700018 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.253715038 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.253720045 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.253730059 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.253745079 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.253745079 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.253757954 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.253761053 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.253787994 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.253809929 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.253999949 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.254014015 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.254029036 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.254043102 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.254045010 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.254050970 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.254061937 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.254074097 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.254079103 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.254084110 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.254096031 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.254103899 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.254112959 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.254115105 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.254137039 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.254157066 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.271663904 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.271717072 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.271732092 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.271773100 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.271794081 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.271806955 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.271810055 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.271826029 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.271840096 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.271842003 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.271853924 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.271863937 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.271886110 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.271933079 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.271949053 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.271974087 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.271981955 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.272066116 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.272082090 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.272095919 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.272108078 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.272113085 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.272120953 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.272149086 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.272157907 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.272202015 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.272217989 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.272259951 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.295546055 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.295579910 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.295595884 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.295641899 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.295672894 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.295701981 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.295717955 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.295732021 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.295747042 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.295758963 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.295763969 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.295784950 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.295795918 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.295941114 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.295957088 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.295970917 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.295983076 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.295986891 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.295991898 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.296004057 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.296015024 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.296019077 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.296047926 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.296077967 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.298696041 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.298737049 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.298752069 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.298794031 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.298829079 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.298882008 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.298897028 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.298913956 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.298928976 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.298943043 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.298945904 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.298975945 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.298989058 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.299127102 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.299141884 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.299156904 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.299171925 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.299185991 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.299186945 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.299202919 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.299206972 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.299220085 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.299222946 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.299248934 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.299261093 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.299407959 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.299422979 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.299438000 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.299448013 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.299453974 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.299453974 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.299474955 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.299487114 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.299554110 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.299570084 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.299607038 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.345781088 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.345813990 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.345829010 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.345881939 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.345920086 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.345936060 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.345952988 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.345962048 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.345968008 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.345987082 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.345995903 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.346013069 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.346044064 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.346148014 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.346163034 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.346177101 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.346189022 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.346220016 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.346230984 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.346246004 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.346261978 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.346271038 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.346293926 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.346302986 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.346338034 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.346352100 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.346383095 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.346383095 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.346448898 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.346465111 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.346479893 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.346494913 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.346502066 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.346510887 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.346529961 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.346559048 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.346575022 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.346677065 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.346692085 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.346721888 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.346729994 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.346796989 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.346811056 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.346826077 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.346841097 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.346853971 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.346857071 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.346878052 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.346899033 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.346930981 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.346946955 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.346987963 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.346988916 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.347029924 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.347078085 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.347091913 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.347121000 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.347129107 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.347162008 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.347177982 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.347192049 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.347198963 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.347208977 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.347229958 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.347243071 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.347273111 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.347538948 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.347552061 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.347573996 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.347584963 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.347599983 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.347635031 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.347654104 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.347668886 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.347716093 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.347719908 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.347735882 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.347762108 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.347784042 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.347847939 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.347862959 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.347876072 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.347891092 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.347903013 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.347904921 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.347922087 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.347924948 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.347937107 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.347958088 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.347970009 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.348134041 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.348149061 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.348162889 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.348191023 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.348207951 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.349250078 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.349339962 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.349353075 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.349375963 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.349389076 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.349390030 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.349417925 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.349432945 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.349452972 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.349467993 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.349508047 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.349579096 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.349595070 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.349610090 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.349617004 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.349626064 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.349641085 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.349647999 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.349647999 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.349677086 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.349685907 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.349783897 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.349798918 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.349822998 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.349832058 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.349834919 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.349877119 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.377851963 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.377897978 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.377955914 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.377971888 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.377991915 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.378010035 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.378037930 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.378045082 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.378079891 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.378093004 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.378119946 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.378132105 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.378165007 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.378180027 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.378196955 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.378206968 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.378236055 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.378242970 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.378266096 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.378277063 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.378310919 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.378317118 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.378349066 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.378356934 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.378381968 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.378392935 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.378415108 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.378424883 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.378448009 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.378459930 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.378485918 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.378489971 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.378531933 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.388144970 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.388187885 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.388206005 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.388253927 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.388287067 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.388293028 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.388308048 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.388322115 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.388334990 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.388338089 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.388349056 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.388367891 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.388372898 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.388375998 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.388430119 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.388478994 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.388514042 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.388529062 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.388530016 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.388544083 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.388556957 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.388561010 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.388572931 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.388583899 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.388583899 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.388601065 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.388626099 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.388714075 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.388726950 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.388767958 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.391187906 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.391252995 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.391268015 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.391313076 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.391336918 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.391341925 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.391351938 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.391392946 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.391442060 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.391454935 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.391477108 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.391479969 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.391491890 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.391506910 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.391506910 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.391515970 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.391537905 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.391549110 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.391680956 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.391695976 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.391709089 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.391721964 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.391724110 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.391735077 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.391742945 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.391757011 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.391762972 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.391781092 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.391808987 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.392023087 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.392061949 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.392066002 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.392076969 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.392101049 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.392110109 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.392113924 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.392124891 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.392162085 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.453666925 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.453784943 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.453833103 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.453850031 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.453866005 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.453885078 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.453910112 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.453917027 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.453952074 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.453959942 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.453985929 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.453994989 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.454019070 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.454029083 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.454057932 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.454067945 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.454092026 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.454123974 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.454123974 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.454153061 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.454159021 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.454168081 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.454193115 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.454193115 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.454252958 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.454261065 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.454294920 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.454301119 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.454339027 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.454349041 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.454384089 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.454395056 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.454417944 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.454428911 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.454452038 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.454466105 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.454487085 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.454497099 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.454521894 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.454533100 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.454565048 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.454607010 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.454638958 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.454653025 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.454684019 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.454690933 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.454724073 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.454737902 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.454757929 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.454767942 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.454791069 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.454797983 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.454826117 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.454833984 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.454870939 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.454933882 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.454967976 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.454981089 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.455001116 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.455013037 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.455035925 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.455049992 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.455070019 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.455075979 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.455104113 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.455122948 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.455136061 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.455142021 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.455169916 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.455179930 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.455204010 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.455210924 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.455245018 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.455370903 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.455403090 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.455430984 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.455435038 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.455451965 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.455467939 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.455501080 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.455512047 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.455533981 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.455544949 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.455568075 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.455580950 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.455601931 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.455612898 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.455637932 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.455652952 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.455689907 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.455709934 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.455741882 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.455758095 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.455775023 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.455786943 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.455809116 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.455821037 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.455842018 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.455853939 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.455884933 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.456006050 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.456037998 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.456052065 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.456070900 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.456084967 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.456104040 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.456116915 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.456137896 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.456150055 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.456171036 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.456181049 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.456203938 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.456211090 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.456235886 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.456250906 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.456270933 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.456283092 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.456304073 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.456317902 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.456338882 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.456348896 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.456372023 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.456382990 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.456407070 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.456417084 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.456440926 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.456451893 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.456495047 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.482707024 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.482757092 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.482767105 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.482815981 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.482817888 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.482850075 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.482861042 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.482883930 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.482897997 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.482932091 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.482938051 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.482971907 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.482989073 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.483005047 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.483016014 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.483043909 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.483160019 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.483210087 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.483242035 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.483270884 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.483302116 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.483308077 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.483346939 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.483378887 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.483391047 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.483412981 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.483421087 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.483448029 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.483458996 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.483490944 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.483529091 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.483561039 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.483592033 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.483604908 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.483624935 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.483644009 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.483658075 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.483679056 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.483691931 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.483701944 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.483726025 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.483735085 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.483760118 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.483763933 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.483793974 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.483800888 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.483828068 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.483835936 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.483871937 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.483937025 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.483969927 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.483998060 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.484004021 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.484016895 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.484036922 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.484046936 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.484071016 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.484080076 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.484116077 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.484191895 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.484224081 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.484256029 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.484268904 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.484288931 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.484303951 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.484322071 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.484332085 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.484357119 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.484374046 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.484390020 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.484400034 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.484424114 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.484425068 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.484468937 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.484595060 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.484626055 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.484639883 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.484658957 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.484673023 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.484694004 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.484709978 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.484726906 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.484735966 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.484765053 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.484771013 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.484782934 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.484795094 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.484807014 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.484810114 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.484819889 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.484827042 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.484838963 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.484841108 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.484855890 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.484864950 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.484872103 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.484889030 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.484927893 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.484950066 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.487760067 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.553062916 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.553107023 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.553159952 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.553178072 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.553193092 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.553210020 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.553239107 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.553246021 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.553286076 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.553287029 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.553324938 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.553338051 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.553381920 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.553388119 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.553421021 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.553431988 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.553452969 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.553463936 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.553487062 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.553497076 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.553520918 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.553527117 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.553555012 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.553569078 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.553587914 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.553596020 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.553632021 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.553642035 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.553689957 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.553693056 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.553725004 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.553735971 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.553769112 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.653907061 CEST	49254	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.654323101 CEST	49256	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.659004927 CEST	9000	49254	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.659127951 CEST	9000	49256	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:10.659198999 CEST	49254	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.659231901 CEST	49256	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.659595966 CEST	49256	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:10.664385080 CEST	9000	49256	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:11.333944082 CEST	9000	49256	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:11.334014893 CEST	49256	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:11.334443092 CEST	49256	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:11.336894989 CEST	49256	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:11.336930990 CEST	49256	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:11.339282990 CEST	9000	49256	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:11.341798067 CEST	9000	49256	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:11.341830015 CEST	9000	49256	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:11.341878891 CEST	9000	49256	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:11.341907978 CEST	9000	49256	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:11.341938019 CEST	9000	49256	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:11.945175886 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:11.946197987 CEST	49258	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:11.950459957 CEST	9000	49255	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:11.950531960 CEST	49255	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:11.951199055 CEST	9000	49258	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:11.951267958 CEST	49258	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:11.951770067 CEST	49258	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:11.955353975 CEST	9000	49256	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:11.955411911 CEST	49256	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:11.956521034 CEST	9000	49258	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:12.621296883 CEST	9000	49258	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:12.621361017 CEST	49258	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:12.625900030 CEST	49258	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:12.628359079 CEST	49258	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:12.628607988 CEST	49258	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:12.630649090 CEST	9000	49258	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:12.634857893 CEST	9000	49258	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:12.634866953 CEST	9000	49258	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:12.634875059 CEST	9000	49258	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:13.091090918 CEST	49256	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:13.091491938 CEST	49260	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:13.383929014 CEST	49256	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:13.841603041 CEST	9000	49258	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:13.841617107 CEST	9000	49258	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:13.841655970 CEST	49258	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:13.841681004 CEST	49258	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:13.841824055 CEST	9000	49258	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:13.841933966 CEST	49258	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:13.843374014 CEST	9000	49260	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:13.843384981 CEST	9000	49256	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:13.843403101 CEST	9000	49256	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:13.843489885 CEST	49260	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:13.843513966 CEST	49256	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:13.843852997 CEST	49260	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:13.850214005 CEST	9000	49260	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:14.221199036 CEST	49258	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:14.221524000 CEST	49261	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:14.226322889 CEST	9000	49258	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:14.226341963 CEST	9000	49261	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:14.226388931 CEST	49258	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:14.226413012 CEST	49261	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:14.226675987 CEST	49261	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:14.231412888 CEST	9000	49261	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:14.494503021 CEST	9000	49260	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:14.494652033 CEST	49260	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:14.494851112 CEST	49260	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:14.496315956 CEST	49260	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:14.499578953 CEST	9000	49260	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:14.501070976 CEST	9000	49260	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:14.882384062 CEST	9000	49261	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:14.882435083 CEST	49261	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:14.882962942 CEST	49261	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:14.884403944 CEST	49261	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:14.887698889 CEST	9000	49261	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:14.889178038 CEST	9000	49261	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:15.262099981 CEST	9000	49260	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:15.264017105 CEST	49260	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:15.388353109 CEST	49260	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:15.393524885 CEST	9000	49260	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:15.393584967 CEST	49260	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:15.517671108 CEST	49264	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:15.522454023 CEST	9000	49264	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:15.522527933 CEST	49264	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:15.522746086 CEST	49264	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:15.527729988 CEST	9000	49264	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:15.656302929 CEST	9000	49261	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:15.661010027 CEST	49261	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:16.174360991 CEST	9000	49264	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:16.174463034 CEST	49264	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:16.174784899 CEST	49264	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:16.179918051 CEST	9000	49264	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:16.281341076 CEST	49264	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:16.282949924 CEST	49267	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:16.406218052 CEST	9000	49267	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:16.406301022 CEST	49267	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:16.406327009 CEST	9000	49264	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:16.406383991 CEST	49264	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:16.406735897 CEST	49267	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:16.411469936 CEST	9000	49267	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:17.082271099 CEST	9000	49267	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:17.082474947 CEST	49267	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:17.082938910 CEST	49267	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:17.087871075 CEST	9000	49267	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:17.089148045 CEST	49267	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:17.091121912 CEST	49268	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:17.094250917 CEST	9000	49267	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:17.094336033 CEST	49267	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:17.096040964 CEST	9000	49268	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:17.096122980 CEST	49268	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:17.096357107 CEST	49268	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:17.101510048 CEST	9000	49268	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:17.795924902 CEST	9000	49268	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:17.796530962 CEST	49268	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:17.796989918 CEST	49268	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:17.801717997 CEST	9000	49268	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:17.910185099 CEST	49268	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:17.912230968 CEST	49269	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:17.915424109 CEST	9000	49268	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:17.915477037 CEST	49268	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:17.917113066 CEST	9000	49269	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:17.917188883 CEST	49269	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:17.917409897 CEST	49269	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:17.922081947 CEST	9000	49269	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:18.568059921 CEST	9000	49269	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:18.571150064 CEST	49269	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:18.571585894 CEST	49269	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:18.573142052 CEST	49269	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:18.575109959 CEST	49270	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:18.576597929 CEST	9000	49269	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:18.578195095 CEST	9000	49269	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:18.578247070 CEST	49269	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:18.579921007 CEST	9000	49270	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:18.579989910 CEST	49270	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:18.580219030 CEST	49270	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:18.585648060 CEST	9000	49270	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:19.247997999 CEST	9000	49270	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:19.248128891 CEST	49270	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:19.248697996 CEST	49270	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:19.250492096 CEST	49270	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:19.252618074 CEST	49271	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:19.253427982 CEST	9000	49270	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:19.255491018 CEST	9000	49270	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:19.255542994 CEST	49270	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:19.257397890 CEST	9000	49271	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:19.257463932 CEST	49271	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:19.257668018 CEST	49271	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:19.262451887 CEST	9000	49271	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:19.917115927 CEST	9000	49271	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:19.917206049 CEST	49271	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:19.917941093 CEST	49271	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:19.919996023 CEST	49271	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:30:19.922677994 CEST	9000	49271	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:19.925023079 CEST	9000	49271	195.201.251.214	192.168.2.4
Jun 29, 2024 02:30:19.925090075 CEST	49271	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:31:25.660068989 CEST	9000	49261	195.201.251.214	192.168.2.4
Jun 29, 2024 02:31:25.660171032 CEST	49261	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:31:25.661246061 CEST	9000	49261	195.201.251.214	192.168.2.4
Jun 29, 2024 02:31:25.661329985 CEST	49261	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:31:47.375756979 CEST	49261	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:31:47.375796080 CEST	49261	9000	192.168.2.4	195.201.251.214
Jun 29, 2024 02:31:47.380642891 CEST	9000	49261	195.201.251.214	192.168.2.4
Jun 29, 2024 02:31:47.380707979 CEST	49261	9000	192.168.2.4	195.201.251.214

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 29, 2024 02:29:57.339848042 CEST	54046	53	192.168.2.4	1.1.1.1
Jun 29, 2024 02:29:57.454720974 CEST	53	54046	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 29, 2024 02:29:57.339848042 CEST	192.168.2.4	1.1.1.1	0x7b0c	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 29, 2024 02:29:57.454720974 CEST	1.1.1.1	192.168.2.4	0x7b0c	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Jun 29, 2024 02:29:59.368180037 CEST	1.1.1.1	192.168.2.4	0x9958	No error (0)	windowsupdatebg.s.llnwi.net		87.248.205.0	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

t.me

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49247	149.154.167.99	443	4312	C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Timestamp	Bytes transferred	Direction	Data
2024-06-29 00:29:58 UTC	84	OUT	GET /g067n HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-06-29 00:29:58 UTC	512	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 29 Jun 2024 00:29:58 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12312 Connection: close Set-Cookie: stel_ssid=113103ff2a63c5aec1_17809550942204552132; expires=Sun, 30 Jun 2024 00:29:58 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-06-29 00:29:58 UTC	12312	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 67 30 36 37 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 2e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @g067n</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.parent.

Target ID:	0
Start time:	20:29:53
Start date:	28/06/2024
Path:	C:\Users\user\Desktop\M9dfZzH3qn.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\M9dfZzH3qn.exe"
Imagebase:	0x400000
File size:	2'288'128 bytes
MD5 hash:	DEE45B3AD0C841D54049061DF5775EC0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Crypt, Description: Yara detected CryptOne packer, Source: 00000000.00000002.1652155095.0000000002B5B000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1652566058.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1651953276.0000000002590000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.1652155095.0000000002A50000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:29:54
Start date:	28/06/2024
Path:	C:\Users\user\AppData\Local\Temp\kat99F5.tmp
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\kat99F5.tmp
Imagebase:	0x400000
File size:	881'664 bytes
MD5 hash:	66064DBDB70A5EB15EBF3BF65ABA254B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 4%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	50.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	64.1%
Total number of Nodes:	39
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02B5BEF0 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 317
threadmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,?,00003000,00000004), ref: 02B5BF61
GetTempFileNameA.KERNELBASE(?,kate,00000000,?), ref: 02B5C114
CreateFileA.KERNELBASE(?,00000003,00000000,00000000,00000004,00000002,00000000), ref: 02B5C142
WriteFile.KERNELBASE(00000000,?,000D7400,00000000,00000000), ref: 02B5C16C
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,00000000,00000000), ref: 02B5C1B6
NtUnmapViewOfSection.NTDLL(00000000,00400000), ref: 02B5C1D0
VirtualAllocEx.KERNELBASE(00000000,00400000,?,00003000,00000040), ref: 02B5C1FB
WriteProcessMemory.KERNELBASE(00000000,00400000,00000000,?,00000000), ref: 02B5C21F
WriteProcessMemory.KERNELBASE(00000000,00000000,00000000,00000000,00000000), ref: 02B5C281
Wow64GetThreadContext.KERNEL32(?,00010002), ref: 02B5C2AF
Wow64SetThreadContext.KERNEL32(?,00010002), ref: 02B5C2DA
ResumeThread.KERNELBASE(?), ref: 02B5C2EC
ExitProcess.KERNEL32(00000000), ref: 02B5C2F9

Strings

kate, xrefs: 02B5C100, 02B5C103

Memory Dump Source

Source File: 00000000.00000002.1652155095.0000000002B5B000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B5B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b5b000_M9dfZzH3qn.jbxd

Yara matches

Similarity

API ID: Process$FileMemoryThreadWrite$ContextCreateVirtualWow64$AllocAllocateExitNameResumeSectionTempUnmapView
String ID: kate
API String ID: 1984375786-4076676908
Opcode ID: 8bdce1911b773aa4c5a77b11a59fe6ead0f340a8c12956d4af66eaabf161a0bb
Instruction ID: 40cfe4a121edc2251492cba803c218a35e085a303cb84afb39d096c7ecc3e625
Opcode Fuzzy Hash: 8bdce1911b773aa4c5a77b11a59fe6ead0f340a8c12956d4af66eaabf161a0bb
Instruction Fuzzy Hash: 59E1D975A00208AFDB54CF84C895FEEB7B5BF88304F108199E908AB395D771AE85CF94

Function 02B5B250 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B5B9B0: VirtualAlloc.KERNELBASE(00000000,02B5B30F,00003000,00000040), ref: 02B5BA34

NtCreateFile.NTDLL(00000000,00120089,00000018,?,00000000,00000080,00000001,00000001,00000040,00000000,00000000), ref: 02B5B41B
FindCloseChangeNotification.KERNELBASE(00000000), ref: 02B5B4CC

Strings

@, xrefs: 02B5B39D

Memory Dump Source

Source File: 00000000.00000002.1652155095.0000000002B5B000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B5B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b5b000_M9dfZzH3qn.jbxd

Yara matches

Similarity

API ID: AllocChangeCloseCreateFileFindNotificationVirtual
String ID: @
API String ID: 482251274-2766056989
Opcode ID: 1eb9ea2caabc7391b7229261c1d9bf95df83910e65e6df0dd8a40b88344f7981
Instruction ID: 0b3b46509a71f111b2c18f910fe6d56f9801fe27ab34c1d83f8201057f703844
Opcode Fuzzy Hash: 1eb9ea2caabc7391b7229261c1d9bf95df83910e65e6df0dd8a40b88344f7981
Instruction Fuzzy Hash: 4881FB71A00228AFDB24DF54CC95FDAB3B5EF48704F1481E9EA09AB294D7706A84CF94

Function 02B5B510 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

.tex, xrefs: 02B5B5D4

Memory Dump Source

Source File: 00000000.00000002.1652155095.0000000002B5B000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B5B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b5b000_M9dfZzH3qn.jbxd

Yara matches

Similarity

API ID:
String ID: .tex
API String ID: 0-1946526065
Opcode ID: 86473fe90031cc0144bf05fc695b61ac0536840d3e25b293d5c37be5d6457d6f
Instruction ID: a22b50c2a07404f028d8de63c8c55d87371ed9666b9845f255b71a16a7731103
Opcode Fuzzy Hash: 86473fe90031cc0144bf05fc695b61ac0536840d3e25b293d5c37be5d6457d6f
Instruction Fuzzy Hash: D35107B0D00119DFCB08CF84D894BEEFBB5FB48318F248599D915AB285D775AA85CBA0

Function 02B5B9B0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 46
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,02B5B30F,00003000,00000040), ref: 02B5BA34

Strings

VirtualAlloc, xrefs: 02B5BA19, 02B5BA1C

Memory Dump Source

Source File: 00000000.00000002.1652155095.0000000002B5B000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B5B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b5b000_M9dfZzH3qn.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: VirtualAlloc
API String ID: 4275171209-164498762
Opcode ID: c42a450ca02fa363a87eb9b6114333d3fd783ad335b2bc0464273431a807ed53
Instruction ID: af603d2a034d57a5d810203b470224c03625e0aaade9b527ac3adbd87ec39f03
Opcode Fuzzy Hash: c42a450ca02fa363a87eb9b6114333d3fd783ad335b2bc0464273431a807ed53
Instruction Fuzzy Hash: 3611DD60D082CDEEEF01DBE89409BEEBFB55F11708F044098D9446A282D6BA57588BA6

Non-executed Functions

Function 02B5C510 Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1652155095.0000000002B5B000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B5B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b5b000_M9dfZzH3qn.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a568a7dc076fac4237d36aa73511bb81ae5ea1128cbd7157671a2a4345687388
Instruction ID: 2dff36c07183543b74508e7464de5ee1740bb56f391efaed2d5559114490940e
Opcode Fuzzy Hash: a568a7dc076fac4237d36aa73511bb81ae5ea1128cbd7157671a2a4345687388
Instruction Fuzzy Hash: A6419171D1051C9BDF48CFADC991AEEBBF2EF88201F648299D516AB345D730AB41DB80

Analysis Process: kat99F5.tmpPID: 4312, Parent PID: 6852COMMON

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	14
Total number of Limit Nodes:	5

Executed Functions

Function 22634CF0 Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 461
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,-00000003,04000102,00000000), ref: 22634EE1

Strings

psow, xrefs: 226351F5
winOpen, xrefs: 22635110
exclusive, xrefs: 22634E81
delayed %dms for lock/sharing conflict at line %d, xrefs: 22634FB5

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID: CreateFile
String ID: delayed %dms for lock/sharing conflict at line %d$exclusive$psow$winOpen
API String ID: 823142352-3829269058
Opcode ID: f8058a5891ca0b919c4640c213ce2f1f9b26fbc5f161bc43ec6cfb812823fd94
Instruction ID: 4b211852a04a2e3caa9acdc0ba484b27ad6f11258b5623d50435337d6a022dc6
Opcode Fuzzy Hash: f8058a5891ca0b919c4640c213ce2f1f9b26fbc5f161bc43ec6cfb812823fd94
Instruction Fuzzy Hash: D5F1BF72A443018BDB158F24CA84B2BB7E4BB88B48F44192DFE46C72D9D779D944CB93

Function 2262FD40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 134
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32(?,?,?,?,?), ref: 2262FE03

Strings

winRead, xrefs: 2262FE3D
delayed %dms for lock/sharing conflict at line %d, xrefs: 2262FE78

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID: FileRead
String ID: delayed %dms for lock/sharing conflict at line %d$winRead
API String ID: 2738559852-1843600136
Opcode ID: 3d5920509594f929fc16f28c70af8b9ed1db4dcf863eb083281dc0193b4546f4
Instruction ID: e50bd985686dbe40a3498468fc13b528fd766237880ff401aff079acb866605d
Opcode Fuzzy Hash: 3d5920509594f929fc16f28c70af8b9ed1db4dcf863eb083281dc0193b4546f4
Instruction Fuzzy Hash: 94410473604705AFC300DF64CD81A6BB7E8FF84714F841A2DFA4587681EB75E9188BA2

Function 226504D0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

failed to allocate %u bytes of memory, xrefs: 226504E7

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: failed to allocate %u bytes of memory
API String ID: 0-1168259600
Opcode ID: b904dbce088388c131e47bb3eb77627eba5e4094079bec04be83eb89b2c38671
Instruction ID: 5f71aeb3df7082cad40449ed61611ede9ab10dc99c611d5c0a8b8556eefb0603
Opcode Fuzzy Hash: b904dbce088388c131e47bb3eb77627eba5e4094079bec04be83eb89b2c38671
Instruction Fuzzy Hash: 9CD01263E8C731A3D6121290BD01FCB7E414F606A1F054174FD4C69335D565DDA187D6

Non-executed Functions

Function 22760480 Relevance: 30.2, APIs: 8, Strings: 9, Instructions: 476COMMON

Download Yara Rule

Strings

no such %s mode: %s, xrefs: 22760922
loca, xrefs: 22760598
no such vfs: %s, xrefs: 2276099A
%s mode not allowed: %s, xrefs: 227609EC
mode, xrefs: 22760867
cach, xrefs: 2276082B
file, xrefs: 227604DA
invalid uri authority: %.*s, xrefs: 227605C2
lhos, xrefs: 227605A1

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s mode not allowed: %s$cach$file$invalid uri authority: %.*s$lhos$loca$mode$no such %s mode: %s$no such vfs: %s
API String ID: 0-1127695371
Opcode ID: a315b8d070b6e817bd2603991c4ca538f33758d54d5cbf6e8809205e87c7bce0
Instruction ID: 69cc0f9f7847081b1b0669a727aa09ca92d7a0d5b4a8144bec7880acffd0c040
Opcode Fuzzy Hash: a315b8d070b6e817bd2603991c4ca538f33758d54d5cbf6e8809205e87c7bce0
Instruction Fuzzy Hash: F2F1117150C3828FE7158F24C69077A7BE2BF86318F844A9CECD51B293D776964ACB42

Function 22648680 Relevance: 28.6, APIs: 9, Strings: 7, Instructions: 550COMMON

Download Yara Rule

Strings

parse error in rank function: %s, xrefs: 226497FF
ASC, xrefs: 226498BA
%s: table does not support scanning, xrefs: 22649979
recursively defined fts5 content table, xrefs: 226486C5
SELECT rowid, rank FROM %Q.%Q ORDER BY %s("%w"%s%s) %s, xrefs: 226498F1
, xrefs: 22649848
DESC, xrefs: 226498C2, 226498D6

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: $%s: table does not support scanning$ASC$DESC$SELECT rowid, rank FROM %Q.%Q ORDER BY %s("%w"%s%s) %s$parse error in rank function: %s$recursively defined fts5 content table
API String ID: 0-2381147695
Opcode ID: bb4e088ce5e7178c73294b32fc80c7f12e0331658e242187b5d7a71b1aa9ca96
Instruction ID: e1744544c8788ea47e72af2366345cab06d9b4a55c31d7cd776cb3b9dbb5bb50
Opcode Fuzzy Hash: bb4e088ce5e7178c73294b32fc80c7f12e0331658e242187b5d7a71b1aa9ca96
Instruction Fuzzy Hash: 6322F0B2941301DFDB24CF24C880B6A7BF4BF49308F144A29F9898B251EB35E955CF92

Function 2274D9E0 Relevance: 23.3, APIs: 8, Strings: 5, Instructions: 564COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 2274DADB, 2274DE3E
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2274DACC, 2274DE2F
API called with NULL prepared statement, xrefs: 2274DA9B, 2274DDFE
misuse, xrefs: 2274DAD6, 2274DE39
API called with finalized prepared statement, xrefs: 2274DAB0, 2274DE13

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-860711957
Opcode ID: f9889630de89971331dd9d5ee7863449a3d1f671a7e107cd5e67af5d494297d2
Instruction ID: ed82d43781d042356766b2fbab4082dfc850beeaaadd2098c1be9917b17a572d
Opcode Fuzzy Hash: f9889630de89971331dd9d5ee7863449a3d1f671a7e107cd5e67af5d494297d2
Instruction Fuzzy Hash: B712C2B1D087009BE7218F25C948B5777F4AF56318F040A2CF9E997342EBBAE545CB92

Function 226366C0 Relevance: 23.2, APIs: 12, Strings: 1, Instructions: 416COMMON

Download Yara Rule

Strings

_shape does not contain a valid polygon, xrefs: 22636816

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: _shape does not contain a valid polygon
API String ID: 0-1814939628
Opcode ID: 795c1023193c4c8b30e7eae641e54bc119d9fda350c7429986063519b0a46fa2
Instruction ID: a00c795d5ada99fa6f65ff3afead9973839c19f64c9f872535744aa38149d91d
Opcode Fuzzy Hash: 795c1023193c4c8b30e7eae641e54bc119d9fda350c7429986063519b0a46fa2
Instruction Fuzzy Hash: BBE103B28083009FC312DF14C940A5BBBE8EF88B14F444A6DF99A57352E735DA55CF9A

Function 2264B400 Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 367COMMON

Download Yara Rule

Strings

SELECT %s WHERE rowid BETWEEN %lld AND %lld ORDER BY rowid %s, xrefs: 2264B696
SELECT %s ORDER BY rowid %s, xrefs: 2264B665
ASC, xrefs: 2264B651, 2264B678
DESC, xrefs: 2264B656, 2264B65E, 2264B67D, 2264B685

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: ASC$DESC$SELECT %s ORDER BY rowid %s$SELECT %s WHERE rowid BETWEEN %lld AND %lld ORDER BY rowid %s
API String ID: 0-3496276579
Opcode ID: 513cc549d2c1290d8669313fe5e4738c73e9c7c8cc5bbdd8376b44cb99f906e9
Instruction ID: 02134a594b6cde4b3f51e46ddd3b0188eb6a43cd3ee00f5adae7ced381386c9b
Opcode Fuzzy Hash: 513cc549d2c1290d8669313fe5e4738c73e9c7c8cc5bbdd8376b44cb99f906e9
Instruction Fuzzy Hash: C2C1447BD047069BC7218F24D940B67B7E0FF84314F14092EE9C98A641EB3AE659CB92

Function 2269DB10 Relevance: 18.3, APIs: 12, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4081a8e4302302becee0a7f11b4007d9660085bae316d5788de1893097702abc
Instruction ID: 33cb865ad601bd1bfafb33eaa00193aaf852507a42443a1d44a6faf02792bd6f
Opcode Fuzzy Hash: 4081a8e4302302becee0a7f11b4007d9660085bae316d5788de1893097702abc
Instruction Fuzzy Hash: 0D81DEB2604301ABD710EF68CC80B6BB3E9EF95314F04093CFA8597251EBB5E915CB96

Function 227414D0 Relevance: 17.9, APIs: 4, Strings: 6, Instructions: 360COMMON

Download Yara Rule

Strings

o:t", xrefs: 227414D5
%s at line %d of [%.10s], xrefs: 227415B1
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227415A2
API called with NULL prepared statement, xrefs: 22741571
misuse, xrefs: 227415AC
API called with finalized prepared statement, xrefs: 22741586

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$o:t"
API String ID: 0-1932537654
Opcode ID: 3fca4383a64f6d6e61a72c9b20309ac763967b0ee47ba125d8ec169b1b440aae
Instruction ID: 769c321fb85775293ed8428897e9dda800b295325414434e44a489995f27c432
Opcode Fuzzy Hash: 3fca4383a64f6d6e61a72c9b20309ac763967b0ee47ba125d8ec169b1b440aae
Instruction Fuzzy Hash: 33C115B1E087019BE721AF24CD45B6777F8BF10358F04062CE996A7252EF76E548C792

Function 22650FB0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

e, xrefs: 2265115A

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: e
API String ID: 0-4024072794
Opcode ID: 36bf8875baaf085edaede92fcfbfd96a80b42455c8294c9340591cc07f665f1e
Instruction ID: c4c0c68ade1e49e9c80e95f838c0d112c05000cdf6d7f606c317b0e7b23ac1f2
Opcode Fuzzy Hash: 36bf8875baaf085edaede92fcfbfd96a80b42455c8294c9340591cc07f665f1e
Instruction Fuzzy Hash: 8D5126732083419FD714CF28CC80B67B7E5EF95315F1006AEF88196162E771E964CBA1

Function 2269DFC0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

%lld %lld, xrefs: 2269E055

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %lld %lld
API String ID: 0-3794783949
Opcode ID: 114adb17a7c5dc2be5f6f5dcd39df2b2b385dd0b6e03a21c4aed720343a00cb3
Instruction ID: c40dd6cb30570684c73ca192ab707746c276e48992a2eeb117e3fd3c58419bca
Opcode Fuzzy Hash: 114adb17a7c5dc2be5f6f5dcd39df2b2b385dd0b6e03a21c4aed720343a00cb3
Instruction Fuzzy Hash: 45310773704700BBE7115BA88D05F6B77AEDFD0710F004919FA4197262EB76C9219BA6

Function 2274D4F0 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 310COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 2274D5EC
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2274D5DD
API called with NULL prepared statement, xrefs: 2274D5AC
misuse, xrefs: 2274D5E7
API called with finalized prepared statement, xrefs: 2274D5C1

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-860711957
Opcode ID: 541101f832bda9c34ad4e3156db5237beff07b21eed6ec52c0bbbecd90696afc
Instruction ID: 7e76f5b07e290944976f38d0f631d60f18021521777b2904220cb6a87b84ca4c
Opcode Fuzzy Hash: 541101f832bda9c34ad4e3156db5237beff07b21eed6ec52c0bbbecd90696afc
Instruction Fuzzy Hash: 32B1AEB19087019FE3118F24D948B67B7F4AF55308F04492CF9D99B342EB75E549CB92

Function 22704D40 Relevance: 14.0, APIs: 9, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a85b18f8898cd901f1cf740db54bac19ebab26903aa8ee47893cb6462f9bee3
Instruction ID: 342beb0c08b5e86b3c37c6f508eebb51ca6a04701a7dbdc19848fd34bc5fb0c1
Opcode Fuzzy Hash: 5a85b18f8898cd901f1cf740db54bac19ebab26903aa8ee47893cb6462f9bee3
Instruction Fuzzy Hash: D5F104B25047019FD3109F65CD84A2B77F8FF95319F040A2CFD0586286E7B9EA59CBA2

Function 22698200 Relevance: 14.0, APIs: 9, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a45cb16ca43e2ce0df36d7a669c9e9572b7cd75e11080ffc32d0aa711f6889f
Instruction ID: 7c3e7339ecd60297f31cb7b296c6594dfd5ad570aa152a59efe751d9c31617bf
Opcode Fuzzy Hash: 1a45cb16ca43e2ce0df36d7a669c9e9572b7cd75e11080ffc32d0aa711f6889f
Instruction Fuzzy Hash: C002D073904301AFC7118F64C980F6FB7E9BF84354F440A29FA8997251EB7AD958CB92

Function 226D5940 Relevance: 12.4, APIs: 8, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b9b03db992dd962bcf9e471514f85b6e223d7b19c824983517109ffd5c57934
Instruction ID: 0ec2b551126fa7a58f1160c4c3a060e93dfad9c36158d28bd7c29b1594c724ce
Opcode Fuzzy Hash: 6b9b03db992dd962bcf9e471514f85b6e223d7b19c824983517109ffd5c57934
Instruction Fuzzy Hash: B2C168B3E587088FE7049A18CC81BDB7791EFD2310F9C0A6EE49587792E225D649C792

Function 226C51D0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 141COMMON

Download Yara Rule

Strings

REPLACE INTO '%q'.'%q_data'(id, block) VALUES(?,?), xrefs: 226C5264
, xrefs: 226C5334

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: $REPLACE INTO '%q'.'%q_data'(id, block) VALUES(?,?)
API String ID: 0-69911113
Opcode ID: b3e2b944171802ff23ab39843fad6558113840a6b84533d8ae0192e861fb522e
Instruction ID: d2404a3d1ba7fae9af3ab8a5d6474e356274bb54d1b9b2e72de94413665fb5c5
Opcode Fuzzy Hash: b3e2b944171802ff23ab39843fad6558113840a6b84533d8ae0192e861fb522e
Instruction Fuzzy Hash: 9441A072A04301EFD700EF28CD84B5AB7E9FF88308F440568F948A7212E776E951CB96

Function 226FD610 Relevance: 10.6, APIs: 7, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd5a444f62547b55e1c478906cffc6cc5e8d8fd97acf4dcf33dab7dbce9423b
Instruction ID: 015cf1037d0c17b3c2ca66f43253b0f7cfcf3ecc2424cdd186167da400bb7dc9
Opcode Fuzzy Hash: 8fd5a444f62547b55e1c478906cffc6cc5e8d8fd97acf4dcf33dab7dbce9423b
Instruction Fuzzy Hash: B341D173600B05ABCB019F29CD80A1BB7E8FF55314F004A2CF95986261E772EA15CBA6

Function 22684760 Relevance: 9.4, APIs: 6, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e48c570b99b0da359a7655e8bc05ce05f1a8a698eeeaaab82164297d1898c06
Instruction ID: afd37fdbe93b760ce16396a055f6fe2d391d5f9545ce2f35b91d7e156ab1a59d
Opcode Fuzzy Hash: 2e48c570b99b0da359a7655e8bc05ce05f1a8a698eeeaaab82164297d1898c06
Instruction Fuzzy Hash: B8F1BEB2904341DFC700CF24C984A1ABBE8FF84308F045A2DFA8997615E775EA58CB97

Function 22634820 Relevance: 9.3, APIs: 6, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64edaed3d074d376ec23f517fc8a2776dde3b2210617136e886a3590cabf0766
Instruction ID: 8ab22547aaaf00936b6a6fc6b3a2af702e497b8e9c5f9b256e96de3505318125
Opcode Fuzzy Hash: 64edaed3d074d376ec23f517fc8a2776dde3b2210617136e886a3590cabf0766
Instruction Fuzzy Hash: 01B1CBB2804701ABD301CF25C880B5BB7E8BF99708F008A19F95596681E378E598CF96

Function 22635C70 Relevance: 9.1, APIs: 6, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43830c2c14d87b3ae716c7a1980d3d4f048575f12cac28b556fe9d979f0dcba0
Instruction ID: 97adf4173150ea4fcdcf5a07e16ce9ae83d63b737e4ae95e617c67a7d3dc8042
Opcode Fuzzy Hash: 43830c2c14d87b3ae716c7a1980d3d4f048575f12cac28b556fe9d979f0dcba0
Instruction Fuzzy Hash: 98412EB2204301DFEB06DF18C984F66B7F0FF88718F10456DE9818B6A2E762E954CB60

Function 226B9090 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 101be851e6e467698f17e836d4b19f10ca2d7ae0aaef7aa193d3332fd36a1746
Instruction ID: ddf2be829a0a3dc6eb63cb538774ed25c8930edce052007799b0c4bd1cbb988c
Opcode Fuzzy Hash: 101be851e6e467698f17e836d4b19f10ca2d7ae0aaef7aa193d3332fd36a1746
Instruction Fuzzy Hash: 7531CB36601700DFD364CF28D9C4F66B3E4FF80325B0446A9E9429B262E722EC51DF90

Function 2268E200 Relevance: 9.1, APIs: 6, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aa9df6d1ff820c473622d33b2fe2672f57977123eaaec1a60bcc324478c5c15
Instruction ID: 44906f9268dd92e33a34f86bb734b369c93b9b65da1397358d65c96b6bebce73
Opcode Fuzzy Hash: 6aa9df6d1ff820c473622d33b2fe2672f57977123eaaec1a60bcc324478c5c15
Instruction Fuzzy Hash: DC1129B3205708AFD3145FA0DC81FABF3DCEF58325F10062AFB0562151EBB6991547A6

Function 226706E0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

VUUU, xrefs: 2267083A

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: VUUU
API String ID: 0-2040033107
Opcode ID: 012e9799adecb1bcf32ca169081b5188151f197404f62bffa38ddb430080be44
Instruction ID: 25eb8620c912d2ea10311bfefcedbe57ea5c64788682da75271d3a57e1ff84ab
Opcode Fuzzy Hash: 012e9799adecb1bcf32ca169081b5188151f197404f62bffa38ddb430080be44
Instruction Fuzzy Hash: 8681A1B26043458FC714DF29D890A2BFBF8FF99314F144A6DE98997242E770E944CBA1

Function 2268E090 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

0:t", xrefs: 2268E0E7

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: 0:t"
API String ID: 0-1721809645
Opcode ID: f27db6faee07414462d1e02d1fc2581c0fc49c4d444039d896ef124a660fe5a6
Instruction ID: a97efc754841802e40d96f599727c10cad8ffad8aa9379402d97cd414c3350e0
Opcode Fuzzy Hash: f27db6faee07414462d1e02d1fc2581c0fc49c4d444039d896ef124a660fe5a6
Instruction Fuzzy Hash: 553101B26007009FD715CF08DD40B77B7E4EB89315F01859AF8858F252E73AE89ACB96

Function 226A1FE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

REPLACE INTO '%q'.'%q_data'(id, block) VALUES(?,?), xrefs: 226A2001

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: REPLACE INTO '%q'.'%q_data'(id, block) VALUES(?,?)
API String ID: 0-914542581
Opcode ID: 3e057cd238ae2e28607fb5b341d27051c003e3ed77d347caa685320d18642b6e
Instruction ID: b8e8649bf25adc9d675487afcada13cb44dc6053320f29bf0064ee712d0c4b0b
Opcode Fuzzy Hash: 3e057cd238ae2e28607fb5b341d27051c003e3ed77d347caa685320d18642b6e
Instruction Fuzzy Hash: 1121DDB2500304AFDB11AF68DD84F27B7ADFF24314F040558F9459712AE7A6E860CBA6

Function 22813300 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,00000000,?,?,?,22813688,?,00000000), ref: 22813399
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,?,22813688,?,00000000), ref: 228133C2
GetACP.KERNEL32(?,?,22813688,?,00000000), ref: 228133D7

Strings

OCP, xrefs: 22813354
ACP, xrefs: 2281331E

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 589f9350ed6f98a52d9cd67c80dd9b8999d455d4675772bffb1a9ec9b4c2b4b6
Instruction ID: 0c00fc73bdfa9d7e36e5797fab615a1269e219812b7ab3b5cc971aa1395f3598
Opcode Fuzzy Hash: 589f9350ed6f98a52d9cd67c80dd9b8999d455d4675772bffb1a9ec9b4c2b4b6
Instruction Fuzzy Hash: 5F21B32A700304E6DF148F14EA05F8B73A6AFD0E54F5A4564E90EDF285EF32DA44C358

Function 226E3770 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

?Pp", xrefs: 226E3770

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: ?Pp"
API String ID: 0-535765321
Opcode ID: f4ccdf9b743d75f8252b2851f4553c50142fb9d6052622b86404dbf4ff0d5e94
Instruction ID: 9dc62a5bdac3ad19a95df8c0d566a23093c851a96c84bb8d0a3b083d7861ae13
Opcode Fuzzy Hash: f4ccdf9b743d75f8252b2851f4553c50142fb9d6052622b86404dbf4ff0d5e94
Instruction Fuzzy Hash: 8EE0B636108B00EBCB225F50DE46E4BBFA6BF58710F041D58F6C525671C7729864AF45

Function 227037E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

?Pp", xrefs: 227037E0

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: ?Pp"
API String ID: 0-535765321
Opcode ID: 163b20eed04c21f543b465dbf508e26d1b36e382aec2e71a79acdea727c2a907
Instruction ID: b4adcaf809618442cda916614fb47483006d4e4bb302eaf4028c3a922fbce0ba
Opcode Fuzzy Hash: 163b20eed04c21f543b465dbf508e26d1b36e382aec2e71a79acdea727c2a907
Instruction Fuzzy Hash: F2E04636108B80EBCB221F11CC40E4BBFA6AF58314F040D48F28424030C3B298A2AF05

Function 22623AA3 Relevance: 7.7, APIs: 5, Instructions: 183COMMON

Download Yara Rule

APIs

GetUserDefaultLCID.KERNEL32 ref: 2281365A
IsValidCodePage.KERNEL32(00000000), ref: 22813698
IsValidLocale.KERNEL32(?,00000001), ref: 228136AB
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040), ref: 228136F3
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 2281370E

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID: Locale$InfoValid$CodeDefaultPageUser
String ID:
API String ID: 3475089800-0
Opcode ID: ce6b7aff52e84f1972e51d6cb1c03ae2c8e9a04f25325bd15fc83a133a6d9773
Instruction ID: 872c90d03333b3b8e8ae66f3aa8bc5246bc282c6afaa36d5b5e23ceb45826f4c
Opcode Fuzzy Hash: ce6b7aff52e84f1972e51d6cb1c03ae2c8e9a04f25325bd15fc83a133a6d9773
Instruction Fuzzy Hash: D25171B9A00309DBEF00DFA5DD80AAE77B8AF14704F144569EA09EF2C4E774D640CB61

Function 2269A6F0 Relevance: 7.6, APIs: 5, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5b03f3d6d57e41db247c11df589d6e3c5f255f778ea51499fca773adfc6098e
Instruction ID: 4231da001c01ea5af2d7a56b5a106d0e368166d6bbd8601760f7d14747e602c3
Opcode Fuzzy Hash: f5b03f3d6d57e41db247c11df589d6e3c5f255f778ea51499fca773adfc6098e
Instruction Fuzzy Hash: 78614DB9908349CFC328CF55C6C0A6BBBE1BB85340F454A8CF5986B221DBB5D508CF92

Function 22678550 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3966a2d936edd45f59b6e0deb058351046a11c26772725d757917f5ea545eae4
Instruction ID: 8ce547d3150e08ead629f332071500a6b0fa6aebcd00f3a223c7c622855b8195
Opcode Fuzzy Hash: 3966a2d936edd45f59b6e0deb058351046a11c26772725d757917f5ea545eae4
Instruction Fuzzy Hash: E801D1B2604701ABDB115F14ED00B6A77A6EFD0715F1404ACF90066210D336EC29DBAA

Function 22622C8E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 227C48A7
IsDebuggerPresent.KERNEL32 ref: 227C4973
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 227C4993
UnhandledExceptionFilter.KERNEL32(?), ref: 227C499D

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 0b76fd1ef103a92d91fb9b8f5ad5d49bd810f2177f0bbdf88ef3da60de37e661
Instruction ID: 048eed1f098e61cdee98982516fca986a3c6499fd923c0fdb165f3509e4b3ff4
Opcode Fuzzy Hash: 0b76fd1ef103a92d91fb9b8f5ad5d49bd810f2177f0bbdf88ef3da60de37e661
Instruction Fuzzy Hash: CE311875D4531C9BDB10DFA4C989BCCBBF8BF08704F1041AAE80DAB280EB759A858F05

Function 2267EF30 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf41f3b5669224c1154e9b2a92fe1b82126ef762f8275621b626f57154db146f
Instruction ID: 127d169c969f6d000c0a79830532b03519acd73c5513245e091cc5093d57d2ad
Opcode Fuzzy Hash: bf41f3b5669224c1154e9b2a92fe1b82126ef762f8275621b626f57154db146f
Instruction Fuzzy Hash: 4F114433904B11ABD3128BA8E940B46F7A0FF14324F044768F8489FE61C329F864CBC1

Function 226C5910 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

INSERT INTO '%q'.'%q_idx'(segid,term,pgno) VALUES(?,?,?), xrefs: 226C597E

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: INSERT INTO '%q'.'%q_idx'(segid,term,pgno) VALUES(?,?,?)
API String ID: 0-143322027
Opcode ID: 6a449bdd89ab18eaa06935ceb84c9ef30fff9cc1ac597fa73f4173a03d1bdbd5
Instruction ID: 8ee8a8ece0658e9978ad176de8273e704a3ff5a56b8fce9a0549bb67b9b42290
Opcode Fuzzy Hash: 6a449bdd89ab18eaa06935ceb84c9ef30fff9cc1ac597fa73f4173a03d1bdbd5
Instruction Fuzzy Hash: 491197B2900705BFEB109F54CC84F86BBADFF15324F004155FA08AB252D7B6A9A4CBA0

Function 226DD3B0 Relevance: 4.6, APIs: 3, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a11f2ac06c36971e570194f90611e41f09d324fb6f9f1748e8385c501f78c83
Instruction ID: 104588acf5dde8429137769114c47c7055d7530ab79f03e9e303ce651d7408fd
Opcode Fuzzy Hash: 5a11f2ac06c36971e570194f90611e41f09d324fb6f9f1748e8385c501f78c83
Instruction Fuzzy Hash: BE3148B3604309ABE704EF69DD84B66B3E9BF59314F008628FA49C3241E775F910CAA5

Function 226C55B0 Relevance: 4.6, APIs: 3, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e03d9b3a7851e68cd4dccaf3418b8688b441dd47cc65761ab36610756ba5b11
Instruction ID: c7963ecd8df062fb05faa6cf22c1ddd18e7037e58fda601db0ce36fc53a27d10
Opcode Fuzzy Hash: 4e03d9b3a7851e68cd4dccaf3418b8688b441dd47cc65761ab36610756ba5b11
Instruction Fuzzy Hash: 6131D0B2604300AFEB10AF26DD88B1777E9FF94318F204928F9469B262D775E940CF55

Function 2269E170 Relevance: 4.6, APIs: 3, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5a03e9ba81b700f8cd50f424c2bdd5c1ac8fd8c9193973479620ce45d52db14
Instruction ID: 6d84b473edc317d18968b4acf79e4152d3ae7926a34b05d955ad32894b76b01c
Opcode Fuzzy Hash: a5a03e9ba81b700f8cd50f424c2bdd5c1ac8fd8c9193973479620ce45d52db14
Instruction Fuzzy Hash: 29110377600300BBE6019B688E44F6B77EEEF90B14F04086CFA41D3242EB76D9118BA6

Function 22622112 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

GetEnabledXStateFeatures, xrefs: 22800C61

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: GetEnabledXStateFeatures
API String ID: 0-1068256093
Opcode ID: 2694e2260bd11ab8d1734a4968667ce2d659db4006ed5c0edcd1bfe9bbf18ff1
Instruction ID: 0926481e3b951e218fa794759a974e4cdede765518fe69c807c83aadeabda808
Opcode Fuzzy Hash: 2694e2260bd11ab8d1734a4968667ce2d659db4006ed5c0edcd1bfe9bbf18ff1
Instruction Fuzzy Hash: 8AF0C839A0132CF7DB222F649C08EAE3A02AF50720F050420FE1966244DB79CA61D6C5

Function 22804A46 Relevance: 2.2, APIs: 1, Instructions: 660timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,22804F85,00000000,00000000,00000000), ref: 22804DEE

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID: InformationTimeZone
String ID:
API String ID: 565725191-0
Opcode ID: b83fc087d8d7373f16bf3df54acb1952d5d84d62b8461216cc744d712d55252a
Instruction ID: 672173435e445495c35af9e7503a96cc2deb013bfd730076504a816f7ead325e
Opcode Fuzzy Hash: b83fc087d8d7373f16bf3df54acb1952d5d84d62b8461216cc744d712d55252a
Instruction Fuzzy Hash: 15D1167B940325EBDB10ABA4CD01ABE7BB9EF14750F544266E909EB280E771CF40DB94

Function 22812D38 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(22812EA6,00000001,00000000,?,?,?,2281362E,00000000), ref: 22812DAA

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 33bf99dfc6ec8ae0321ea6dbadde5cd5952d0459cf7dc2fc304f63dac17b16db
Instruction ID: 553908af997c1bc2f9e9a020263babf96a0b6f674e7229062e9369484b65ade6
Opcode Fuzzy Hash: 33bf99dfc6ec8ae0321ea6dbadde5cd5952d0459cf7dc2fc304f63dac17b16db
Instruction Fuzzy Hash: 1411C23A2007159FDB189F39C9907AAB792FF80358B18452DE94B8BA85D7B5B542CB40

Function 22812DF9 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(2281318D,00000001,?,?,?,?,228135F6,?), ref: 22812E43

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: edb23e17bb548474ce00431b5d0ce6c61a04c474792aa3792ae8767dbb565293
Instruction ID: d74b3f367d5370a19029a3fe019ef65f3d7d7d93d70424ab1c2ade9923f804ab
Opcode Fuzzy Hash: edb23e17bb548474ce00431b5d0ce6c61a04c474792aa3792ae8767dbb565293
Instruction Fuzzy Hash: 06F0F63A2003049FDB145F799880B6A7B95FF80768F15442CFA0A4B6C5C7B1E842CF50

Function 227FFF17 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(227FFF01,00000001,2285D298,0000000C,22800A92,?), ref: 227FFF4F

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 7e2cffa91d5df3cbfee0ce3aae6eeeb142d2104a4d0926c54dcf332a42b37d72
Instruction ID: 899299ddc116e50a665ed970d1fb62374f86aedd552d1becec1aad22b12b7691
Opcode Fuzzy Hash: 7e2cffa91d5df3cbfee0ce3aae6eeeb142d2104a4d0926c54dcf332a42b37d72
Instruction Fuzzy Hash: 47F01F76A48300DFE710DFA8D440BAC7BB0FB19324F00566AE8169B3D0DB799944CF85

Function 22812CB6 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(22812BE6,00000001,?,?,?,22813650,?), ref: 22812CED

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 66c737f639b5b11ea949165434468a8dfc2247005729c5249e1c5979247ebdc8
Instruction ID: 4d77044ca9bdee960a179c7e1341377f297bb0b5058eeaf0d3cb1d4fba157bfb
Opcode Fuzzy Hash: 66c737f639b5b11ea949165434468a8dfc2247005729c5249e1c5979247ebdc8
Instruction Fuzzy Hash: 0CF0A03A3003559BD7049F39C944B6A7B94EF81750B0A4058EA1A8B285C675DA42CB90

Function 226242AF Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00004214), ref: 227C4A98

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9cea4fa293edf4ccbfcb3ef3b6eb3fe172edb52242b18e3e1e0fa3429599b4ea
Instruction ID: 2b5232b2aed00e4289a0d44456c8d26ca1517e5e991a452c0c40b031b3870fde
Opcode Fuzzy Hash: 9cea4fa293edf4ccbfcb3ef3b6eb3fe172edb52242b18e3e1e0fa3429599b4ea
Instruction Fuzzy Hash: 039002A16857025ADD0096629E99918762055557053441670640F6484D452D4541DA3A

Function 2262433C Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

GetSystemTimePreciseAsFileTime, xrefs: 22800CE9, 22800CF3

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: GetSystemTimePreciseAsFileTime
API String ID: 0-595813830
Opcode ID: e1dc922385e1bef70771ffa50afa9211998b7f9adc2889b1fa8436192cc51620
Instruction ID: 81627c0cdf4b45974be0e552ebed9048fee49c161be72df0c8b7da348289d125
Opcode Fuzzy Hash: e1dc922385e1bef70771ffa50afa9211998b7f9adc2889b1fa8436192cc51620
Instruction Fuzzy Hash: 42412131A08305EFC720CF68C980EEABBB1FF04324F404959E99697352DB31EA52CB95

Function 226246A6 Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 227FEFF3

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: a9b54660ef12c97621c13a756ca0be5dac5c17be4d383cd7cb73fe4cbf367c8d
Instruction ID: ff9122a6fbe57759dcd91d6855aa5f402fad5b98e438f92c8e37a4b2946611ca
Opcode Fuzzy Hash: a9b54660ef12c97621c13a756ca0be5dac5c17be4d383cd7cb73fe4cbf367c8d
Instruction Fuzzy Hash: 24B01230545301CF53C04F32850561D35E47E191907419515980AC5284D63CD0808F22

Function 22705660 Relevance: 53.0, APIs: 26, Strings: 4, Instructions: 452
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,%.*s, xrefs: 22705804, 22705835
CREATE TABLE x(%.*s INT, xrefs: 227057CA
_node, xrefs: 2270579E
Auxiliary rtree columns must be last, xrefs: 227056B3, 227058B3

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: ,%.*s$Auxiliary rtree columns must be last$CREATE TABLE x(%.*s INT$_node
API String ID: 0-209218429
Opcode ID: dceb154a1ccdd23cdd1195897872c539e6d7a94419de64f6b38fd300c56f5d02
Instruction ID: 559aa751f7da596d9c0dc0fe842b202efca48cbf673406e974f115f9c22bc0dd
Opcode Fuzzy Hash: dceb154a1ccdd23cdd1195897872c539e6d7a94419de64f6b38fd300c56f5d02
Instruction Fuzzy Hash: DDF10171508301DFD710CF25C980B6AB7E8FF54308F444A28FD4A97245DB7AEA59CBA6

Function 2264CC80 Relevance: 47.7, APIs: 15, Strings: 12, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%lld, xrefs: 2264D0EE
%2d, xrefs: 2264CE27
%.16g, xrefs: 2264CFB3
%02d, xrefs: 2264CE2C, 2264CE34, 2264CF27, 2264CF6F, 2264CFCE, 2264CFE9, 2264D10A
%06.3f, xrefs: 2264CE5F
%03d, xrefs: 2264CF81, 2264CF8B
%04d, xrefs: 2264D1CE
%02d:%02d, xrefs: 2264D080
%02d:%02d:%02d, xrefs: 2264D12E
%.3f, xrefs: 2264D0BF
%04d-%02d-%02d, xrefs: 2264CE82
u, xrefs: 2264D16D

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %.16g$%.3f$%02d$%02d:%02d$%02d:%02d:%02d$%03d$%04d$%04d-%02d-%02d$%06.3f$%2d$%lld$u
API String ID: 0-1613945299
Opcode ID: 15b4c3c5d9b80f313a2c67f3ef73c00a34e56a006c63fc4f7da685b3a6b6629a
Instruction ID: c1aa2ee05c2b90b5db380b9e185661d58c4f016e82164178105edab647863632
Opcode Fuzzy Hash: 15b4c3c5d9b80f313a2c67f3ef73c00a34e56a006c63fc4f7da685b3a6b6629a
Instruction Fuzzy Hash: CBF10572E08741ABD325CB64CC84FABB3EABF99304F048A1DF9C496251EB39D548C752

Function 226C9120 Relevance: 45.9, APIs: 23, Strings: 3, Instructions: 355
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_node, xrefs: 226C9202
CREATE TABLE x(_shape, xrefs: 226C9268
,%s, xrefs: 226C9297

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: ,%s$CREATE TABLE x(_shape$_node
API String ID: 0-1242591684
Opcode ID: b011b125d44f9634133c3c73df4831de8e1d4de62cf7976318e76d4e0a3fd7a6
Instruction ID: 78aac095e48be907f72b4a6886728d117f7ad580af78580ca673223a91c7a6f6
Opcode Fuzzy Hash: b011b125d44f9634133c3c73df4831de8e1d4de62cf7976318e76d4e0a3fd7a6
Instruction Fuzzy Hash: 69C11572501700DBD7209F25CD88B3777E8FF50308F044668ED4A8769AD77AE529CBA6

Function 2277B050 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 251
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%lld, xrefs: 2277B1DA, 2277B24C
%.16g, xrefs: 2277B217
%s(%d), xrefs: 2277B1B3
NULL, xrefs: 2277B267, 2277B324, 2277B325
vtab:%p, xrefs: 2277B283
k(%d, xrefs: 2277B0A5
,%s%s%s, xrefs: 2277B137
%.18s-%s, xrefs: 2277B192
program, xrefs: 2277B2FB
BINARY, xrefs: 2277B0D3
%c%u, xrefs: 2277B2C3
(blob), xrefs: 2277B26C

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %.16g$%.18s-%s$%c%u$%lld$%s(%d)$(blob)$,%s%s%s$BINARY$NULL$k(%d$program$vtab:%p
API String ID: 0-900822179
Opcode ID: 291db7954febed563db498f795bc76fd07a91dff4c955846d7e2c86500cc494b
Instruction ID: f8bdd32b14a81b275d61050bd372e7939699e9918d822776c42a0e9c201dcde4
Opcode Fuzzy Hash: 291db7954febed563db498f795bc76fd07a91dff4c955846d7e2c86500cc494b
Instruction Fuzzy Hash: 3391DBB1A0C305DBDB01DF14C880B6B77F5EF95308F549988E9949B253E336D94ACBA2

Function 2263D820 Relevance: 35.2, APIs: 8, Strings: 12, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fts4, xrefs: 2263D9F0
fts4aux, xrefs: 2263D840
snippet, xrefs: 2263D93C
fts3tokenize, xrefs: 2263DA27
fts3_tokenizer, xrefs: 2263D921
matchinfo, xrefs: 2263D970, 2263D98A
fts3, xrefs: 2263D9CA
offsets, xrefs: 2263D956
porter, xrefs: 2263D8EE
optimize, xrefs: 2263D9A4
unicode61, xrefs: 2263D90B
simple, xrefs: 2263D8A9

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 0-449611708
Opcode ID: f06ed5fba423aae0d9bb03aab723fc63c1f12297341a5d0c580aa7ae080012d2
Instruction ID: 4f40d9b98f08e0d0f7c87b488829aafe65f5a0974d9c42d40ba6a11200deb0f8
Opcode Fuzzy Hash: f06ed5fba423aae0d9bb03aab723fc63c1f12297341a5d0c580aa7ae080012d2
Instruction Fuzzy Hash: 31513A72F44305A7F3126A65EEC4F6B7794AF10B18F040134FE05A234AEBADE619C697

Function 227B7FB0 Relevance: 33.6, APIs: 14, Strings: 5, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

winGetTempname5, xrefs: 227B8233
winGetTempname2, xrefs: 227B8094
winGetTempname4, xrefs: 227B8355
etilqs_, xrefs: 227B824C
winGetTempname1, xrefs: 227B817B

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 0-2933911573
Opcode ID: 58f268c97274cb2ba0cae7bc29f4a4e0dadc5ee4385b5bde2871a448dbee2cf9
Instruction ID: 99257c067a78401aa6926e38cfd7a8c5f8cc1ff5201e102bedf0591f1b3a9b32
Opcode Fuzzy Hash: 58f268c97274cb2ba0cae7bc29f4a4e0dadc5ee4385b5bde2871a448dbee2cf9
Instruction Fuzzy Hash: 4FA1DF726483055BD3009B249C81BFA7795DF41315F8806A9ED859B287E6ABD20FC7B2

Function 22642BE0 Relevance: 31.8, APIs: 8, Strings: 10, Instructions: 346
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

unopened, xrefs: 22642E55
invalid, xrefs: 22642E4E
WHERE name=%Q, xrefs: 22642DB7
NULL, xrefs: 22642E38
%s at line %d of [%.10s], xrefs: 22642E78
ORDER BY name, xrefs: 22642DCC
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 22642E69
SELECT * FROM (SELECT 'sqlite_schema' AS name,1 AS rootpage,'table' AS type UNION ALL SELECT name,rootpage,type FROM "%w".sqlite_schema WHERE rootpage!=0), xrefs: 22642DA4
misuse, xrefs: 22642E73
API call with %s database connection pointer, xrefs: 22642E5A

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: ORDER BY name$%s at line %d of [%.10s]$API call with %s database connection pointer$NULL$SELECT * FROM (SELECT 'sqlite_schema' AS name,1 AS rootpage,'table' AS type UNION ALL SELECT name,rootpage,type FROM "%w".sqlite_schema WHERE rootpage!=0)$WHERE name=%Q$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse$unopened
API String ID: 0-1179878930
Opcode ID: 45399a7501b7da695b1cf8fdd5e8f9d0055689a992a63c4e527cd620f54b351b
Instruction ID: d61a7dd42198837095289c378c5b27bb1259794bc54eb262b3ddf5ef3a407932
Opcode Fuzzy Hash: 45399a7501b7da695b1cf8fdd5e8f9d0055689a992a63c4e527cd620f54b351b
Instruction Fuzzy Hash: BBC15772D04300DBD7218F14CD44B6737E0AF50348F644629EDD59B286EFB9E649C7A2

Function 22745D70 Relevance: 28.3, APIs: 8, Strings: 8, Instructions: 266COMMON

Download Yara Rule

Strings

rank, xrefs: 22745FBB
deletemerge, xrefs: 22745F64
usermerge, xrefs: 22745EAD
crisismerge, xrefs: 22745EF7
secure-delete, xrefs: 22746031
pgsz, xrefs: 22745D81
hashsize, xrefs: 22745DF0
automerge, xrefs: 22745E59

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: automerge$crisismerge$deletemerge$hashsize$pgsz$rank$secure-delete$usermerge
API String ID: 0-3330941169
Opcode ID: a15aa687efba05cfac221a3963f535f0375411c731ff5d50f3a556afa096360c
Instruction ID: 30b3e401616ef86cce37782314350ca15ad2e5793e413ea5066a948d82189640
Opcode Fuzzy Hash: a15aa687efba05cfac221a3963f535f0375411c731ff5d50f3a556afa096360c
Instruction Fuzzy Hash: 0C715AB6F083215BD7009A59AD40A5F3BE1EFA5312F040479F942C7212EF35EA4AC7A3

Function 22635E20 Relevance: 26.7, APIs: 8, Strings: 7, Instructions: 496COMMON

Download Yara Rule

Strings

SELECT t.%Q FROM %Q.%Q AS t WHERE t.%Q MATCH '*id', xrefs: 22635E6F
%s at line %d of [%.10s], xrefs: 22635F3A, 22636262, 22636394
no such fts5 table: %s.%s, xrefs: 226362EA
recursive definition for %s.%s, xrefs: 22635E4C
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 22635F2B, 22636253, 22636385
misuse, xrefs: 22635F35, 2263625D, 2263638F
API called with finalized prepared statement, xrefs: 22635F1F, 22636247, 22636379

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$SELECT t.%Q FROM %Q.%Q AS t WHERE t.%Q MATCH '*id'$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$no such fts5 table: %s.%s$recursive definition for %s.%s
API String ID: 0-1070437968
Opcode ID: 9f8faa1da98608102595dcda0c60a07336c95e067ddd97a07b0521fbe060d92b
Instruction ID: 07af2fc23cbd08e3e2ff822171808eba85274d45c7f82778033a871458a93840
Opcode Fuzzy Hash: 9f8faa1da98608102595dcda0c60a07336c95e067ddd97a07b0521fbe060d92b
Instruction Fuzzy Hash: 5F0214B2A047009BE712CF24CD84B6BB7E4FF54B18F00492CE95997342EB75E558CBA6

Function 226A9980 Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 429COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 226A9A44, 226A9D9F
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 226A9A35, 226A9D90
API called with NULL prepared statement, xrefs: 226A9A04
misuse, xrefs: 226A9A3F, 226A9D9A
SELECT %s, xrefs: 226A99B1
API called with finalized prepared statement, xrefs: 226A9A19, 226A9D84
no such function: %s, xrefs: 226A9E8C

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$SELECT %s$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$no such function: %s
API String ID: 0-3900766660
Opcode ID: 53a4ab85de44fe1e68b6c173f6fc194e75f66a0c38b5a26c8ab34c73c8f33b8a
Instruction ID: b0d79a1a91d08bca1442698a63a545abf6d549246347ddac6effa43ece2cbc70
Opcode Fuzzy Hash: 53a4ab85de44fe1e68b6c173f6fc194e75f66a0c38b5a26c8ab34c73c8f33b8a
Instruction Fuzzy Hash: B4E129B2A06701DBD720CF25C954B6B77E4BF94318F20052CE94A9B342E775ED45CBA2

Function 22663800 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 184COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 2266393F
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 22663930
no such rowid: %lld, xrefs: 226639F8
misuse, xrefs: 2266393A
integer, xrefs: 2266389A
null, xrefs: 226638E7
cannot open value of type %s, xrefs: 226638ED
API called with finalized prepared statement, xrefs: 22663924
real, xrefs: 22663895, 226638EC

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$cannot open value of type %s$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$integer$misuse$no such rowid: %lld$null$real
API String ID: 0-1477268580
Opcode ID: eaf5d81f95d177f176382ccf7d933884f0db0a0ced710be71bd073085c044b99
Instruction ID: f0ee1cc5ff27a2bcca84351870aaeb75550253c9b74d40729368971e5d275f8e
Opcode Fuzzy Hash: eaf5d81f95d177f176382ccf7d933884f0db0a0ced710be71bd073085c044b99
Instruction Fuzzy Hash: B551F2B26047019FD7159F28CC80B76B3E4FF94719F084A2DE9668B742E779E824CB91

Function 2274A150 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 226COMMON

Download Yara Rule

Strings

idx, xrefs: 2274A200
%s_data, xrefs: 2274A1BC
data, xrefs: 2274A1E4
id INTEGER PRIMARY KEY, block BLOB, xrefs: 2274A1DF
segid, term, pgno, PRIMARY KEY(segid, term), xrefs: 2274A1FB

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s_data$data$id INTEGER PRIMARY KEY, block BLOB$idx$segid, term, pgno, PRIMARY KEY(segid, term)
API String ID: 0-1009905541
Opcode ID: f8f949a4e68e87200d9674544536f661fea540f98e8feca04dc6be6b444c264a
Instruction ID: e8dbfa59ffa46bdf215569c075483f6c9bd5f8994a5928425c15822904b9a5a8
Opcode Fuzzy Hash: f8f949a4e68e87200d9674544536f661fea540f98e8feca04dc6be6b444c264a
Instruction Fuzzy Hash: E0719E71984300DBD7109F25DD58B2B37B8AF10349F001964ED0B96299EF7DE918EBA3

Function 2274F370 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 196COMMON

Download Yara Rule

Strings

id INTEGER PRIMARY KEY, sz BLOB, origin INTEGER, xrefs: 2274F51C
content, xrefs: 2274F49D
, c%d, xrefs: 2274F469
id INTEGER PRIMARY KEY, sz BLOB, xrefs: 2274F524, 2274F52C
k PRIMARY KEY, v, xrefs: 2274F544
version, xrefs: 2274F560
docsize, xrefs: 2274F52D
config, xrefs: 2274F549
id INTEGER PRIMARY KEY, xrefs: 2274F43E

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: , c%d$config$content$docsize$id INTEGER PRIMARY KEY$id INTEGER PRIMARY KEY, sz BLOB$id INTEGER PRIMARY KEY, sz BLOB, origin INTEGER$k PRIMARY KEY, v$version
API String ID: 0-3918257174
Opcode ID: 0bf31ffaa563fed38aab4484de8333939a878b3a1fd2020cdd4107f1e27d97c6
Instruction ID: 518534cb4438072ff7e81f4a792b7b178abeb10f55808adaa0155c91238415a3
Opcode Fuzzy Hash: 0bf31ffaa563fed38aab4484de8333939a878b3a1fd2020cdd4107f1e27d97c6
Instruction Fuzzy Hash: D4511372D443209BC3109F28DD44B6BBBB8EF44765F440668EC499B245DF39EA19CBA2

Function 2262A6C0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 195COMMON

Download Yara Rule

Strings

%s, xrefs: 2262A82E
></polyline>, xrefs: 2262A845
%g,%g', xrefs: 2262A7D1
%c%g,%g, xrefs: 2262A78E
<polyline points=, xrefs: 2262A74B

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %g,%g'$ %s$%c%g,%g$<polyline points=$></polyline>
API String ID: 0-3443809342
Opcode ID: 9ee3bcbe848b4eaca746bbb871c6a4ef66d5cb2db92b9817298ed789f03400a7
Instruction ID: 10c2956544d4ec308e433942e690c5da539f2c49cac8d09c85a7ae45bfff3b6a
Opcode Fuzzy Hash: 9ee3bcbe848b4eaca746bbb871c6a4ef66d5cb2db92b9817298ed789f03400a7
Instruction Fuzzy Hash: 3E614872904B019BE7008F24CD84B6673A5AF51304F048769EC195B285E7BEED9ACFD7

Function 22768F40 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 177COMMON

Download Yara Rule

Strings

%lld, xrefs: 2276900C
%!.20e, xrefs: 22768FF1
NULL, xrefs: 2276912E
NULL, xrefs: 22769148
%!.15g, xrefs: 22768F83

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %!.15g$%!.20e$%lld$NULL$NULL
API String ID: 0-2115304644
Opcode ID: aaa07527e62f4262afdbaa97f177f9ac1e66bd4848d64a25ed19b495cf3f7697
Instruction ID: cce081d42be2d1f3bda84c219bfbe49c7d43333df1b9cfb2c766ef7fc17fe467
Opcode Fuzzy Hash: aaa07527e62f4262afdbaa97f177f9ac1e66bd4848d64a25ed19b495cf3f7697
Instruction Fuzzy Hash: FD518876908B11DBD729DF18C841ABBB7E4EF95308F044A8CFC9967212E339D609C792

Function 22633420 Relevance: 21.4, APIs: 6, Strings: 6, Instructions: 392COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 22633557, 226335A3
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 22633548, 22633594
ATTACH x AS %Q, xrefs: 2263346F
API called with NULL prepared statement, xrefs: 22633517
misuse, xrefs: 22633552, 2263359E
API called with finalized prepared statement, xrefs: 2263352C, 22633588

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ATTACH x AS %Q$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-2988319395
Opcode ID: 1275129b7bc8f942e011bdefc2760367920dd8b24107025e4c799dcf5bb5f0a1
Instruction ID: e6f75eb75c06e960a5f7f143f97abbc5e09ae5c2a3cee5bdbbe2081afa36b42b
Opcode Fuzzy Hash: 1275129b7bc8f942e011bdefc2760367920dd8b24107025e4c799dcf5bb5f0a1
Instruction Fuzzy Hash: B0D1C4B29043019BD7128F24C948B2777E4BF90B19F084928F94A9F386E779D564CBE7

Function 226BEF60 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

,origin, xrefs: 226BF0D6, 226BF0DE

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: ,origin
API String ID: 0-4198660907
Opcode ID: 55668ebbbe96d833977cd2578ca30f63ed8c41a9a0f1ce0b2317f4e79a3cc2da
Instruction ID: a6e25f8e6412a64fc378d55000176fb3ca777c1e6888d56bc6b46769fe035601
Opcode Fuzzy Hash: 55668ebbbe96d833977cd2578ca30f63ed8c41a9a0f1ce0b2317f4e79a3cc2da
Instruction Fuzzy Hash: 11718BB6904304DFC7119F58C98092ABBE5FF94300F104E6CF98A96261EB76E864CF56

Function 22704B10 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 156COMMON

Download Yara Rule

Strings

rtree constraint failed: %s.(%s<=%s), xrefs: 22704BF9
%s at line %d of [%.10s], xrefs: 22704C39
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 22704C2A
SELECT * FROM %Q.%Q, xrefs: 22704B25
misuse, xrefs: 22704C34
UNIQUE constraint failed: %s.%s, xrefs: 22704BC9
API called with finalized prepared statement, xrefs: 22704C1E

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$SELECT * FROM %Q.%Q$UNIQUE constraint failed: %s.%s$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$rtree constraint failed: %s.(%s<=%s)
API String ID: 0-2013246442
Opcode ID: 616c42ca72b236c38a1dbb4cfa6269ae19a675dd67afb393b3238995dfd17655
Instruction ID: 15b33007f1c3aa24c21eec2c8e96a01204ea3f043fa62e419aa8d03175f14b42
Opcode Fuzzy Hash: 616c42ca72b236c38a1dbb4cfa6269ae19a675dd67afb393b3238995dfd17655
Instruction Fuzzy Hash: BC413772909304AFE7015F659D84F7B33ECEF51308F000938FD05A6289EB69EA58C6B6

Function 227B7C10 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 150COMMON

Download Yara Rule

Strings

winFullPathname1, xrefs: 227B7CC9
%s%c%s, xrefs: 227B7C7A
winFullPathname2, xrefs: 227B7D35

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s%c%s$winFullPathname1$winFullPathname2
API String ID: 0-2846052723
Opcode ID: b636f1e290612dab5d720965cf72e03fbc31f5c3af89dc67d5a891bb575697bb
Instruction ID: f7ef726cb7d0dacb77aeaacc5d2aabda18b1f2fb08eb61ace0525205f4d1e0d5
Opcode Fuzzy Hash: b636f1e290612dab5d720965cf72e03fbc31f5c3af89dc67d5a891bb575697bb
Instruction Fuzzy Hash: 4641BBA364D3002BF7129720BC85FBB37DE9F41356F04466CF98A56182E77AD942C762

Function 227AAAD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 130COMMON

Download Yara Rule

Strings

bind on a busy prepared statement: [%s], xrefs: 227AAB94
%s at line %d of [%.10s], xrefs: 227AAB1A, 227AAB5B, 227AABAF
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227AAB0B, 227AAB4C, 227AABA0
API called with NULL prepared statement, xrefs: 227AAAD9
misuse, xrefs: 227AAB15, 227AAB56, 227AABAA
API called with finalized prepared statement, xrefs: 227AAAEF

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$bind on a busy prepared statement: [%s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3679126755
Opcode ID: 92a15c3f03a3862c0b7d7d95ddbe859ae10119ec5e247ec738374427c5d2d5b7
Instruction ID: 5c155aa91a8f4392e88e739d539fec569b1a08f085458aae73b2601255807c4d
Opcode Fuzzy Hash: 92a15c3f03a3862c0b7d7d95ddbe859ae10119ec5e247ec738374427c5d2d5b7
Instruction Fuzzy Hash: AC41F371B18704DBF7108F68DC94F9673E4AF50329F044628FA59AB38AEB79D580C792

Function 2274ECF0 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 335COMMON

Download Yara Rule

Strings

content, xrefs: 2274EFDF
docsize, xrefs: 2274F020

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: content$docsize
API String ID: 0-1024698521
Opcode ID: e5248e549e249057d45f15e8489f8d665c5625e3c87bde21ec18e633206566a8
Instruction ID: ffbeed37536f460d994e958f32d412e3b38489500091c85ba2c6d202dc84552b
Opcode Fuzzy Hash: e5248e549e249057d45f15e8489f8d665c5625e3c87bde21ec18e633206566a8
Instruction Fuzzy Hash: 9EC1F172D08311ABD311CF14C980B6BB3F4AF94364F450A28FD45AB261EB75EA95CB93

Function 226D5470 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 225COMMON

Download Yara Rule

Strings

%lld, xrefs: 226D550D
%!0.15g, xrefs: 226D54D2
JSON cannot hold BLOB values, xrefs: 226D5697

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %!0.15g$%lld$JSON cannot hold BLOB values
API String ID: 0-1047910854
Opcode ID: 0ae7b07578834f7db2ac107003a212ffde47671a1d2fdbaa7a39b7659f55c40c
Instruction ID: 2e2c41b11ae4c1ff9ff1fec40262837f9c7fb2bff23aefa7c5b39e8b99914e95
Opcode Fuzzy Hash: 0ae7b07578834f7db2ac107003a212ffde47671a1d2fdbaa7a39b7659f55c40c
Instruction Fuzzy Hash: 7C510D776043086AE3116B28DC41FBB37A6DFD2325F28034DFA415B6C3EB67915182E2

Function 22652B70 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 183COMMON

Download Yara Rule

Strings

ABLE x, xrefs: 22652BB6
("%s", xrefs: 22652C4A
%c"%s", xrefs: 22652C1B
,arg HIDDEN, xrefs: 22652C7A
,schema HIDDEN, xrefs: 22652CD2

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %c"%s"$("%s"$,arg HIDDEN$,schema HIDDEN$ABLE x
API String ID: 0-1763475469
Opcode ID: 3e6ff102ec92287ca1a57c52914d2a46fb0c62787250228651fee8a79f111a47
Instruction ID: 74323b31f277d8471d581a7213cb752e0f0b76d6a2068df8d3809493d839bcf9
Opcode Fuzzy Hash: 3e6ff102ec92287ca1a57c52914d2a46fb0c62787250228651fee8a79f111a47
Instruction Fuzzy Hash: 7271A076908341DFD314CF24C980B5ABBE0FFA8308F008A5EF89997291E775D659CB96

Function 22706380 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

Kc", xrefs: 22706381, 227064AB, 227064BE, 227064DC

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: Kc"
API String ID: 0-3424656087
Opcode ID: f14c4e4db16b55b9f37e07b10dc8821215410913f6fb4510a472bd94f5adfc43
Instruction ID: 08c1fc76fd350cc1b5b8246cd2e34f7f7bc777b8cac9d6c52ea36603a37d900e
Opcode Fuzzy Hash: f14c4e4db16b55b9f37e07b10dc8821215410913f6fb4510a472bd94f5adfc43
Instruction Fuzzy Hash: B741A031484B109FC7109F26DD58A2677F8AF20318F002928FD079269DDB79E668CFA7

Function 226CAA40 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 334COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 226CAAC7, 226CAD91
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 226CAAB8, 226CAD82
API called with NULL prepared statement, xrefs: 226CAA87
misuse, xrefs: 226CAAC2, 226CAD8C
API called with finalized prepared statement, xrefs: 226CAA9C, 226CAD76

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-860711957
Opcode ID: fb2abe03be74e1bc925fcc4405bbf07196697f291bb808c26b69fee33e7d968f
Instruction ID: bde14aec738fff3823705c6e19bfea954e95147024e0316113f3a56bb9329736
Opcode Fuzzy Hash: fb2abe03be74e1bc925fcc4405bbf07196697f291bb808c26b69fee33e7d968f
Instruction Fuzzy Hash: B3B104B2A047059BE711AF64DD4CB5773D4EF50319F00062CE99697382EB7EE944C7A2

Function 2264A170 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 286COMMON

Download Yara Rule

Strings

JSON path error near '%q', xrefs: 2264A3D7
malformed JSON, xrefs: 2264A283

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: JSON path error near '%q'$malformed JSON
API String ID: 0-560895927
Opcode ID: a7fce2c4489597daa75ee69cc390e1dcfd02d0cb0111530b164098c5c0cb78db
Instruction ID: a30420a8fa2ca9bf1595c845d3075a17549355c810bcf13918583906943d7c0e
Opcode Fuzzy Hash: a7fce2c4489597daa75ee69cc390e1dcfd02d0cb0111530b164098c5c0cb78db
Instruction Fuzzy Hash: FBA127B3D04300ABD724CF24D894B6BB7E5AF90308F18456DE9C58B242EB7BE945DB91

Function 22653D20 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 223COMMON

Download Yara Rule

Strings

%Q., xrefs: 22653E11
=%Q, xrefs: 22653E7F
PRAGMA , xrefs: 22653DC5

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %Q.$=%Q$PRAGMA
API String ID: 0-2099833060
Opcode ID: ffeeb875066a94d56cbca7bc9068da44b7bf03b175fbfd9162b417ad40c539ce
Instruction ID: 0c0dd2d0827ac631efad50dd15a3e31717d6db5516988c6d1d4b5fc456bacbb9
Opcode Fuzzy Hash: ffeeb875066a94d56cbca7bc9068da44b7bf03b175fbfd9162b417ad40c539ce
Instruction Fuzzy Hash: E771C073A043019BD700CF24D944B5BB7E4AF54718F080A69FD459F286E735E9398BE2

Function 2263B980 Relevance: 16.7, APIs: 11, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0dad0434c8e3c81d0cb3835bd5340e61bc9c706b90cbc2a5dd1ef47cc2a81e7
Instruction ID: 3e1238a865eab92c7efbc2883c7346942f137f9d17176b2ac78dcffc9a06b2bb
Opcode Fuzzy Hash: b0dad0434c8e3c81d0cb3835bd5340e61bc9c706b90cbc2a5dd1ef47cc2a81e7
Instruction Fuzzy Hash: 198158738087438BD713AF2089507AABBE4EF51B04F4406A9E9D61B216DF35CA96C7D2

Function 2267F600 Relevance: 16.7, APIs: 11, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a70c7127cf5330d89c7d45b3115e672d80e76ffd15e8db3879d2d7a1d690e5da
Instruction ID: 5b0a0c33b8f857a0a67a072f3259c2f8d5b17e042e77c718f555fd0cce1a25bc
Opcode Fuzzy Hash: a70c7127cf5330d89c7d45b3115e672d80e76ffd15e8db3879d2d7a1d690e5da
Instruction Fuzzy Hash: 3251EF73A04305AFD700CF18EC80F6BB3E8EF94714F50066DF94496251EB26AA598BA6

Function 226A1940 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 345COMMON

Download Yara Rule

Strings

block, xrefs: 226A1A90
%s at line %d of [%.10s], xrefs: 226A1B26
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 226A1B17
misuse, xrefs: 226A1B21

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$block$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-4016964285
Opcode ID: 00c79331ea4be343a448b9de8898b5d595212958fe7636680be0df99c9189f36
Instruction ID: 1cfbdae04e614082c3b930a8920528f9facf61c6e7e4b7a1f2bcc98621735905
Opcode Fuzzy Hash: 00c79331ea4be343a448b9de8898b5d595212958fe7636680be0df99c9189f36
Instruction Fuzzy Hash: 65C1D3B2900314DFDB10DF28C994A6A77E4BF04318F0446A9FD4A9B266E735DE14CBA2

Function 2264FED0 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 257COMMON

Download Yara Rule

Strings

unknown error, xrefs: 2265003E
another row available, xrefs: 22650076, 22650081
abort due to ROLLBACK, xrefs: 22650068
%llu, xrefs: 2264FF3C
%llu, xrefs: 2264FFF7
no more rows available, xrefs: 2265006F

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %llu$%llu$abort due to ROLLBACK$another row available$no more rows available$unknown error
API String ID: 0-1539118790
Opcode ID: 03bb39645b99e32be7227d9d78acbf874e206675630e52e782a924e90e4b30ef
Instruction ID: 9d298d22607df2cb848cc074825cc93b9139ad52846e362dc467ac17c36a8a6d
Opcode Fuzzy Hash: 03bb39645b99e32be7227d9d78acbf874e206675630e52e782a924e90e4b30ef
Instruction Fuzzy Hash: 0C9123726043009BC714DF18C984BABB7E1BF88358F04466DFD899B391D73AD955CB92

Function 227570B0 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 227COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 2275721C
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2275720D
orphan index, xrefs: 227572C2
misuse, xrefs: 22757217
API called with finalized prepared statement, xrefs: 22757201
invalid rootpage, xrefs: 2275715C, 2275730E

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid rootpage$misuse$orphan index
API String ID: 0-165706444
Opcode ID: 68a70f4e54266e5ab3937da369e1e89fb8798e23449f57b7aa11f9190f458fa6
Instruction ID: 6e2c63c53f0176b701f0c6db2aac70c630b5e278dc87a79cf5c001cb78fe77be
Opcode Fuzzy Hash: 68a70f4e54266e5ab3937da369e1e89fb8798e23449f57b7aa11f9190f458fa6
Instruction Fuzzy Hash: 3A617CB2A083846BEB314F619D80FE7F7A89F91329F044479FD1496247E735E164C7A2

Function 22643A50 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 172COMMON

Download Yara Rule

Strings

cannot insert, xrefs: 22643BF1, 22643C52
no such schema, xrefs: 22643BEA
bad page value, xrefs: 22643BDC
read-only, xrefs: 22643A71
cannot delete, xrefs: 22643A82
bad page number, xrefs: 22643BE3

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: bad page number$bad page value$cannot delete$cannot insert$no such schema$read-only
API String ID: 0-1499782803
Opcode ID: 781fcb75fa37ef3e5a5ef3f13aca225d64929dd7491ff0b894e846fd77934519
Instruction ID: 76490ea967a6dc128e0802e9d53b7efe671625d67d0be7cff08d0af110854bab
Opcode Fuzzy Hash: 781fcb75fa37ef3e5a5ef3f13aca225d64929dd7491ff0b894e846fd77934519
Instruction Fuzzy Hash: 67512577E04300DBD720DF14E985B2637E4AB60318F284469FC8ACF246EB36D964CB52

Function 2275B0E0 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 117COMMON

Download Yara Rule

Strings

unopened, xrefs: 2275B145
invalid, xrefs: 2275B13E
NULL, xrefs: 2275B0F4
%s at line %d of [%.10s], xrefs: 2275B117
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2275B108
misuse, xrefs: 2275B112
API call with %s database connection pointer, xrefs: 2275B0F9

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$NULL$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse$unopened
API String ID: 0-538076154
Opcode ID: 6f4a8a4b3c1fbf6d263a9c2151fad5747e856e09385553d1cbcce511b1ad9940
Instruction ID: 82250e4870cbebad27db4ed2516d93284c7e9a7285f8e65bf53211643bd4b42b
Opcode Fuzzy Hash: 6f4a8a4b3c1fbf6d263a9c2151fad5747e856e09385553d1cbcce511b1ad9940
Instruction Fuzzy Hash: F33188F590C308ABE7510E549C40B7BF795AF45328F401628EDA57220EE775E626C393

Function 22656F30 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 83COMMON

Download Yara Rule

Strings

invalid, xrefs: 22656F4F
out of memory, xrefs: 22656F39, 22656FA0
%s at line %d of [%.10s], xrefs: 22656F6F
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 22656F60
bad parameter or other API misuse, xrefs: 22656F7E
misuse, xrefs: 22656F6A
API call with %s database connection pointer, xrefs: 22656F54

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$bad parameter or other API misuse$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse$out of memory
API String ID: 0-2911740470
Opcode ID: 649c2cc0dfb2b16828c27adbe97eee7f971929e7a896ad8a2c70f125bcbbcff4
Instruction ID: 6a485d5705627904e66fac73e5c6bcae425642ce88b9a645edfc56c3d5de9387
Opcode Fuzzy Hash: 649c2cc0dfb2b16828c27adbe97eee7f971929e7a896ad8a2c70f125bcbbcff4
Instruction Fuzzy Hash: 192176B7E0471097E7264714ED84F9B73E32BC0319F18852CF1865734AD675E8A6C382

Function 226406F0 Relevance: 15.2, APIs: 10, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 111352bc79037d048f3cc8b201bc47a8fb49536ce0746e735b6be9de523c95b7
Instruction ID: 0e764d241498692536651cb545ea1306c0f630ddd10f283a82bf2aadc8776e39
Opcode Fuzzy Hash: 111352bc79037d048f3cc8b201bc47a8fb49536ce0746e735b6be9de523c95b7
Instruction Fuzzy Hash: 8D7113B7D043148FDB28DF14C981B5A73E5AF94308F04066DED959B202EB36D955CBD2

Function 2267F4B0 Relevance: 15.1, APIs: 10, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d47789057f54d3d5d235375a09c406a209fee87bea1c44866fc0f5d3bf2f426b
Instruction ID: ebd0a3b38d553e7e4f8c83aa719858b5ddaf116d7a8d5ea085aa98368c5ffd45
Opcode Fuzzy Hash: d47789057f54d3d5d235375a09c406a209fee87bea1c44866fc0f5d3bf2f426b
Instruction Fuzzy Hash: 8221D1B39047417AF312AA20AD01FBF32ACAF71306F044958FE14A2142FB28D71986A7

Function 2263E170 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 445COMMON

Download Yara Rule

Strings

snippet, xrefs: 226B1200
fts5_source_id, xrefs: 226B148D, 226B14E0
porter, xrefs: 226B12BF
fts5, xrefs: 226B1053, 226B1395, 226B13E7
unicode61, xrefs: 226B1279, 226B130F
unable to delete/modify user-function due to active statements, xrefs: 226B13BF, 226B14B8
fts5vocab, xrefs: 226B1340

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: fts5$fts5_source_id$fts5vocab$porter$snippet$unable to delete/modify user-function due to active statements$unicode61
API String ID: 0-2986783930
Opcode ID: d6b00dc5391ab984f9c4b2a8627a5784a736cb5dd71a522e8d01f1d389913caf
Instruction ID: 08b901a739894d05d4f309887d1aafd5a7e30ea7133c9218aa6d4ae2354326f2
Opcode Fuzzy Hash: d6b00dc5391ab984f9c4b2a8627a5784a736cb5dd71a522e8d01f1d389913caf
Instruction Fuzzy Hash: 97F1B6B2944701EBD705CF25DE88B177BE4BF40344F0009A8FD0AA6299EB79D654CB97

Function 2273FB30 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 324COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 2273FBA5
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2273FB96
API called with NULL prepared statement, xrefs: 2273FB65
misuse, xrefs: 2273FBA0
API called with finalized prepared statement, xrefs: 2273FB7A

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-860711957
Opcode ID: 741d90e2912c87cc2ea73188e4cf3eb891602f3b138ac9b75c7443516315eaff
Instruction ID: e2fd7495e9fe7d8ff1d656edfe1d009e00c02d62e72fefba2a2e0a1520c2a4f2
Opcode Fuzzy Hash: 741d90e2912c87cc2ea73188e4cf3eb891602f3b138ac9b75c7443516315eaff
Instruction Fuzzy Hash: FEB1E4B19087009BE7128F35D948B5777E4BF55398F04092CE98A97343EB7AE505CB93

Function 226B1710 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 235COMMON

Download Yara Rule

Strings

rank, xrefs: 226B1824
%z, %Q HIDDEN, %s HIDDEN), xrefs: 226B1831
CREATE TABLE x(, xrefs: 226B17D9
%z%s%Q, xrefs: 226B180D

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %z%s%Q$%z, %Q HIDDEN, %s HIDDEN)$CREATE TABLE x($rank
API String ID: 0-3324442540
Opcode ID: 79a0c5d3fc0db0f39d6759f5bd7e507d4b5d3009f17b68bceb2d941776e9dc98
Instruction ID: 22c1ce4f298d62070075acf770a707b843d005803a2095fd4a3401388492f435
Opcode Fuzzy Hash: 79a0c5d3fc0db0f39d6759f5bd7e507d4b5d3009f17b68bceb2d941776e9dc98
Instruction Fuzzy Hash: 6D81E072E04300ABDB019F64DD44B1AB7E4FF44359F040AA9FC49A7265DB7AD924CBD2

Function 2267E320 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 177COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 2267E385
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2267E376
misuse, xrefs: 2267E380
API called with finalized prepared statement, xrefs: 2267E36A

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3620335220
Opcode ID: 39ef310a0e8e94562d21e601b2b21499e678ec00d9c79f97c12bc156a8c4153e
Instruction ID: 399e2fe6b861c79fdd840e657ea2aa4b938615ddb616c032191a4d54159d0e6b
Opcode Fuzzy Hash: 39ef310a0e8e94562d21e601b2b21499e678ec00d9c79f97c12bc156a8c4153e
Instruction Fuzzy Hash: F351D372940704EBE7018FA4E948B6A37B4EF10359F048465EE0A9A28DDB7DD55CCFA3

Function 227274A0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 175COMMON

Download Yara Rule

Strings

invalid, xrefs: 227274BC
unable to close due to unfinalized statements or unfinished backups, xrefs: 227275D1
%s at line %d of [%.10s], xrefs: 227274DC
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227274CD
misuse, xrefs: 227274D7
API call with %s database connection pointer, xrefs: 227274C1

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 0-3800776574
Opcode ID: 1c2b96c3f71ffe4831617f3b98af1f4927b3543f714df77aee5d81d4ac4b19dd
Instruction ID: b031663d55a6a9b29f8efa88a5c52866264a0b5ec4b21b9892698d26ef06211c
Opcode Fuzzy Hash: 1c2b96c3f71ffe4831617f3b98af1f4927b3543f714df77aee5d81d4ac4b19dd
Instruction Fuzzy Hash: 56515F71908F10ABE3118B35AF44FA7B7E9AF41318F044618ED4A93349E738F655C6A7

Function 226CBCF0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 103COMMON

Download Yara Rule

Strings

undersize RTree blobs in "%q_node", xrefs: 226CBDA1
SELECT length(data) FROM '%q'.'%q_node' WHERE nodeno = 1, xrefs: 226CBD67
PRAGMA %Q.page_size, xrefs: 226CBD03

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: PRAGMA %Q.page_size$SELECT length(data) FROM '%q'.'%q_node' WHERE nodeno = 1$undersize RTree blobs in "%q_node"
API String ID: 0-3485589083
Opcode ID: 0f02b221d9b51fdd38a4983ee590c642248784c89f7b24423cdaec05d66cb339
Instruction ID: b4ddcf6042ca481bd1aa0f076303c47296fe7b4c05c26db3cdfb9ed8c3b79b5e
Opcode Fuzzy Hash: 0f02b221d9b51fdd38a4983ee590c642248784c89f7b24423cdaec05d66cb339
Instruction Fuzzy Hash: 4B31F9B2A00302EBD3009F65CD88A6677A8EB4435AF040665FD0696285D77AE964CFE2

Function 227232F0 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 464COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 227236C7, 2272370C, 2272376C, 2272381D
database corruption, xrefs: 227236C2, 22723707, 22723767, 22723818
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227236B8, 227236FD, 2272375D, 2272380E

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 6af40280f2fbe9537934f6358f357a95cd873a26e500751a3013ff4fe3b0a0ff
Instruction ID: 357db0ddfdf3e84e1031fa584f281e63111a5dc3eb5018a421b37a90d65245e0
Opcode Fuzzy Hash: 6af40280f2fbe9537934f6358f357a95cd873a26e500751a3013ff4fe3b0a0ff
Instruction Fuzzy Hash: 2BF15771A08B519FD300DF29C980B67BBF0FF44318F844699E9489B346E735E959CBA2

Function 2264E420 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 380COMMON

Download Yara Rule

Strings

unknown error, xrefs: 2264E76B
another row available, xrefs: 2264E7A3, 2264E7AE
abort due to ROLLBACK, xrefs: 2264E795
d, xrefs: 2264E71D
%c%04d-%02d-%02d %02d:%02d:%06.3f, xrefs: 2264E717
no more rows available, xrefs: 2264E79C

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %c%04d-%02d-%02d %02d:%02d:%06.3f$abort due to ROLLBACK$another row available$d$no more rows available$unknown error
API String ID: 0-322231948
Opcode ID: f83310810c6fd3f21367c76cf48e98c8bf8d7d6fdf1c0cb14736396b133cf6de
Instruction ID: 5426e789f294d2c7584459cd01fb13e77238369ace3d441f82fb54c62cfac353
Opcode Fuzzy Hash: f83310810c6fd3f21367c76cf48e98c8bf8d7d6fdf1c0cb14736396b133cf6de
Instruction Fuzzy Hash: 91E1C272A083409FD724CFA4C984B6BB7E5AF88304F50592DF9C597241EB76E905CB93

Function 226528E5 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 346COMMON

Download Yara Rule

Strings

unable to validate the inverted index for FTS5 table %s.%s: %s, xrefs: 22652AA0
malformed inverted index for FTS5 table %s.%s, xrefs: 22652A8A
INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');, xrefs: 226529F1

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');$malformed inverted index for FTS5 table %s.%s$unable to validate the inverted index for FTS5 table %s.%s: %s
API String ID: 0-3572959941
Opcode ID: 1a4389669e3bdd1d80f04225bb6059e22ea65ef8c7a6f7ae33cb99b647003670
Instruction ID: 73d9d4a22084cdf4ab8148ad4db4f80b4d5a76d62045e413860f5eba38ba08d8
Opcode Fuzzy Hash: 1a4389669e3bdd1d80f04225bb6059e22ea65ef8c7a6f7ae33cb99b647003670
Instruction Fuzzy Hash: C9412772941301ABE3108F28DC48EBB77A8EF40359F040929FD46C6288DB79D664CFA3

Function 22639700 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 277COMMON

Download Yara Rule

Strings

(FK), xrefs: 226398D3

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: (FK)
API String ID: 0-1642768157
Opcode ID: b03a68913a83770a1178c5f100525e438063f1a81121cfbe7f8b196f73fe6a36
Instruction ID: c7c6dc07b95e90495298f22153b3e4cd465704caa50c239d2178955418378ac8
Opcode Fuzzy Hash: b03a68913a83770a1178c5f100525e438063f1a81121cfbe7f8b196f73fe6a36
Instruction Fuzzy Hash: 5C81B0B77093009FE7159F28EC40B66B3A1FF84735F240AAAEA46976A1E732D510CB50

Function 227B8D80 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 271COMMON

Download Yara Rule

Strings

readonly_shm, xrefs: 227B8F52
%s-shm, xrefs: 227B8DF2
winOpenShm, xrefs: 227B8FB9

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s-shm$readonly_shm$winOpenShm
API String ID: 0-2815843928
Opcode ID: de26c26d74caa5c7c14e9e45bb7a4e6cccf957e4eb781ff48357adcc2d929b15
Instruction ID: e00a3e7f460fdab0f2ee599a1645baae96cb46aa2df86d0e88817be202c2d67b
Opcode Fuzzy Hash: de26c26d74caa5c7c14e9e45bb7a4e6cccf957e4eb781ff48357adcc2d929b15
Instruction Fuzzy Hash: BE91CFB1948701DFDB109F64CD48B2677A8BF00304F440A69FD4A97289E77AE918CBA3

Function 2264EB00 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 187COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 2264ECDA
database corruption, xrefs: 2264ECD5
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2264ECCB
%.*s%s, xrefs: 2264EC88

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %.*s%s$%s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-894757972
Opcode ID: 1a0b6a06b71789a7c03039193d590d79f3f18a195457f7a25dc40554e941572d
Instruction ID: 91744155889dbaf03b633f08cd560c1f08246165203cae7d9de592a9752d03d2
Opcode Fuzzy Hash: 1a0b6a06b71789a7c03039193d590d79f3f18a195457f7a25dc40554e941572d
Instruction Fuzzy Hash: C161D372E04311CBD725CF64CA80A9BB7E2FF84314F044A6DE8999B341DB35EA05CB91

Function 22629DA0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 160COMMON

Download Yara Rule

Strings

[%!g,%!g]], xrefs: 22629EC0
[%!g,%!g],, xrefs: 22629E7E

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: [%!g,%!g],$[%!g,%!g]]
API String ID: 0-3388633204
Opcode ID: 1124b529b49bad012de1a1506e4c65e7726281a919476549b39c70101e807b85
Instruction ID: ba9637e04dadd77ab73bdf1fd2f3960278aa17f27202f59bcc4d025af37c7238
Opcode Fuzzy Hash: 1124b529b49bad012de1a1506e4c65e7726281a919476549b39c70101e807b85
Instruction Fuzzy Hash: AE513432901B019BD320CF29C9C4B27B7B0AF82304F104768FC4A9A249E7B5E559CF93

Function 2264F330 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 126COMMON

Download Yara Rule

Strings

malformed inverted index for FTS%d table %s.%s, xrefs: 2264F3F3
unable to validate the inverted index for FTS%d table %s.%s: %s, xrefs: 2264F418
INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');, xrefs: 2264F33F

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');$malformed inverted index for FTS%d table %s.%s$unable to validate the inverted index for FTS%d table %s.%s: %s
API String ID: 0-2809892521
Opcode ID: ebacadaae09e52bfe29492ddcf389470fc955c9f105bde91b00e4e6802dbfe5e
Instruction ID: c123f10b282aa9fb05f2914be1891f1b510c67ba154a15d716942977960b7b1b
Opcode Fuzzy Hash: ebacadaae09e52bfe29492ddcf389470fc955c9f105bde91b00e4e6802dbfe5e
Instruction Fuzzy Hash: 8B41E1729413019FE320DB24DC48A6B37A8EF40259F041929FD46C628DDF29D659CBA3

Function 22656E30 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 30COMMON

Download Yara Rule

Strings

invalid, xrefs: 22656E47
%s at line %d of [%.10s], xrefs: 22656E67
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 22656E58
misuse, xrefs: 22656E62
API call with %s database connection pointer, xrefs: 22656E4C

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse
API String ID: 0-3670841456
Opcode ID: 3478ce557b27325c98c2404b73eca05cdc5cc8c3c167048d97404b3c0c1ffd07
Instruction ID: 019b185bae48a4525ce9c15255fbec89d480f93cf6c42aff8be349c85c120084
Opcode Fuzzy Hash: 3478ce557b27325c98c2404b73eca05cdc5cc8c3c167048d97404b3c0c1ffd07
Instruction Fuzzy Hash: 74F0E52AB49788EBFB085304CEC1FAA3B962B9070EF80404CE3506E29FC21EC453D6C5

Function 22656EB0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 29COMMON

Download Yara Rule

Strings

invalid, xrefs: 22656ECA
%s at line %d of [%.10s], xrefs: 22656EEA
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 22656EDB
misuse, xrefs: 22656EE5
API call with %s database connection pointer, xrefs: 22656ECF

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse
API String ID: 0-3670841456
Opcode ID: 567280285dc256081fddd2a6582f4bd10742765747110a0be5dbedb2e803c3f3
Instruction ID: 78c232652d7a7a7e4609c6e7085604084062fb7a3d26bf229b4ed498df7f8315
Opcode Fuzzy Hash: 567280285dc256081fddd2a6582f4bd10742765747110a0be5dbedb2e803c3f3
Instruction Fuzzy Hash: 78F06525F08B88EFFB104254DEA1FA677C61790716F805195F3546E7E6E918C460C281

Function 226430F0 Relevance: 12.2, APIs: 8, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a8fc7e541dc324356669d66c7b9776e645d1b6e00e10fa43f84d6ed67a5977
Instruction ID: c693eb7f3e3c91ac3d40f1d03f5cea6660a026f122ead266659931c81da5cedb
Opcode Fuzzy Hash: 99a8fc7e541dc324356669d66c7b9776e645d1b6e00e10fa43f84d6ed67a5977
Instruction Fuzzy Hash: 4F517F72608310AFDB41EB68FC44FAB7BE2AF85320F1945A8F5588B2B1E731C951DB51

Function 2263B6E0 Relevance: 12.1, APIs: 8, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f50080ebf14ab86c904c205585b2249ab0df2760bdd08fe72b53682cf8b8ef8a
Instruction ID: 52cb822bebc170e0ebfa5e049f3d70c89b8c3bc61166074fd1f06daa5495f366
Opcode Fuzzy Hash: f50080ebf14ab86c904c205585b2249ab0df2760bdd08fe72b53682cf8b8ef8a
Instruction Fuzzy Hash: 80110BF78087007FD604AB10EC40E6B77B9EFA1704F4406D4F84997221E736DA15DAA6

Function 22697920 Relevance: 10.8, APIs: 7, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c0a64c567377825aa826e38cd61e7aab24cd6bc2d57a6723dcf8eefeade29f
Instruction ID: c52855caa93997bd8c469fea255fb5d3d79a9d12c600d5c1d1a87c4f777c15e8
Opcode Fuzzy Hash: d7c0a64c567377825aa826e38cd61e7aab24cd6bc2d57a6723dcf8eefeade29f
Instruction Fuzzy Hash: C5B1C0B2A04701AFD705DF28CD80AAAB7E5FF88314F444A29F948D7711EB35E924CB95

Function 226C6180 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 335COMMON

Download Yara Rule

Strings

fts5: syntax error near "%.*s", xrefs: 226C6436
NEAR, xrefs: 226C642A
fts5 expression tree is too large (maximum depth %d), xrefs: 226C6349
UVx, xrefs: 226C6331
expected integer, got "%.*s", xrefs: 226C648D

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: NEAR$UVx$expected integer, got "%.*s"$fts5 expression tree is too large (maximum depth %d)$fts5: syntax error near "%.*s"
API String ID: 0-3351665570
Opcode ID: 443190528f4da7d7f1209c0f26428491cd0f7e4b6c07957f0bce5a6a9c913cad
Instruction ID: f0f5e03aa01320fa338bf1d418519ca7ec16eb5b09159163afb1f778119d3766
Opcode Fuzzy Hash: 443190528f4da7d7f1209c0f26428491cd0f7e4b6c07957f0bce5a6a9c913cad
Instruction Fuzzy Hash: 6FC1C1B6904316EFD711EF60C984F1AF7A4FF58304F048A19E9559B202E770E960CBE8

Function 2263E260 Relevance: 10.8, APIs: 7, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2160f4a4a7dc7f8ef2b20778cb661d5727bc4fd994a247014fe6df3c0d78d8ad
Instruction ID: 9c4cef3410b381fd884d5589a635f9f3bcecfca1b4edd2cb80144f501e9ba4f8
Opcode Fuzzy Hash: 2160f4a4a7dc7f8ef2b20778cb661d5727bc4fd994a247014fe6df3c0d78d8ad
Instruction Fuzzy Hash: DBA13B73A083508FD705CF68C99075BBBE1AF84728F044A6DF99497392E336D945CB62

Function 22635930 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 234COMMON

Download Yara Rule

Strings

CREATE TABLE x(input, token, start, end, position), xrefs: 22635933
unknown tokenizer: %s, xrefs: 22635B28
simple, xrefs: 22635A38, 22635A84, 22635A95, 22635B27

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: CREATE TABLE x(input, token, start, end, position)$simple$unknown tokenizer: %s
API String ID: 0-2679805236
Opcode ID: 869e702811ab1b788e0afdc89ad7f52c0887d501b581f36fbd17fe54c9cff43e
Instruction ID: 0fd02fcf8c61ceb9aa50c53da139aaf15ad4aaa8a08fdf5bedbc90a16e9c4548
Opcode Fuzzy Hash: 869e702811ab1b788e0afdc89ad7f52c0887d501b581f36fbd17fe54c9cff43e
Instruction Fuzzy Hash: 2A7118B29043468FC705CF28CD84A66B7E4FF88754F04066DEC5AD7245EB75EA09CB92

Function 2273F0E0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 216COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 2273F1EB, 2273F32C
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2273F1DC, 2273F31D
misuse, xrefs: 2273F1E6, 2273F327
unable to delete/modify user-function due to active statements, xrefs: 2273F157, 2273F298

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$unable to delete/modify user-function due to active statements
API String ID: 0-3864549341
Opcode ID: 5019ca7f2382b4cac7f3f07291674113c6811aea862f0e43568edfcb245c7d66
Instruction ID: da75ec680737f5bd2dc3cef710966e2cbc816c5077fc1a7059f3bb07837f5a07
Opcode Fuzzy Hash: 5019ca7f2382b4cac7f3f07291674113c6811aea862f0e43568edfcb245c7d66
Instruction Fuzzy Hash: 986158B1608B01ABE3038B20DD45F977794AF51388F004228E9195B6C3EFB9E554C7E7

Function 226C44F0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 208COMMON

Download Yara Rule

Strings

col, xrefs: 226C4679
instance, xrefs: 226C46BF
row, xrefs: 226C46A1
fts5vocab: unknown table type: %Q, xrefs: 226C46DE

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: col$fts5vocab: unknown table type: %Q$instance$row
API String ID: 0-195232091
Opcode ID: 4643eed702f7ed155b200dc2f98dcb8062a50ed56ae82c5e27ea1e38162adc34
Instruction ID: a422d858cadb514979636e5468dfb8e8d18d2a450b66cda6ae64aba7f873f3b1
Opcode Fuzzy Hash: 4643eed702f7ed155b200dc2f98dcb8062a50ed56ae82c5e27ea1e38162adc34
Instruction Fuzzy Hash: 476104729813118BD700FF259A4866A37E0EB00349F801939ED0AD778CD739D959CFA7

Function 226509C2 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

cannot UPDATE a subset of columns on fts5 contentless-delete table: %s, xrefs: 22650B3B

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: cannot UPDATE a subset of columns on fts5 contentless-delete table: %s
API String ID: 0-2869280805
Opcode ID: 1b92070b9dffb66f1aa4fc2d81c22f7172ad0b9cf2a88e3a12aeb36e3e2a6fed
Instruction ID: 6410086119d6254f11a60161df05f2774d94f89b707a6912c5be871ac9eda466
Opcode Fuzzy Hash: 1b92070b9dffb66f1aa4fc2d81c22f7172ad0b9cf2a88e3a12aeb36e3e2a6fed
Instruction Fuzzy Hash: F641BF77605701AFD7109F58ED80A66F3E4FF98325B044ABAFA0487612F772E964CB90

Function 22641120 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 169COMMON

Download Yara Rule

Strings

rbu_memory, xrefs: 226411F5
main, xrefs: 226411A6

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: main$rbu_memory
API String ID: 0-3973752345
Opcode ID: 798a99292bbe22c08a098f9a3bbd86ca695d27f7456fc201ba606ed6b7689ada
Instruction ID: ddc72198c66d4c1945218bbc76545fb02b78c0d03c74d4854afa8666e6d10e03
Opcode Fuzzy Hash: 798a99292bbe22c08a098f9a3bbd86ca695d27f7456fc201ba606ed6b7689ada
Instruction Fuzzy Hash: C0512272A003019FD720CF65D980B67B3E8EF40314F0045AAED86E7661DB75E949CF56

Function 22643F30 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 169COMMON

Download Yara Rule

Strings

remove_diacritics=1, xrefs: 22643FA2
separators=, xrefs: 226440A3
remove_diacritics=0, xrefs: 22643FE1
tokenchars=, xrefs: 2264406A
remove_diacritics=2, xrefs: 22644021

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: remove_diacritics=0$remove_diacritics=1$remove_diacritics=2$separators=$tokenchars=
API String ID: 0-131617836
Opcode ID: 87d2587d0d1091b9bfff55f69781da3510a1d4d5a4c03b5c96c5f30a6a526338
Instruction ID: 73a77f8ab9a4af6683ecc44b9d2a9dafef5812846953cbfed683aaccddfa00c1
Opcode Fuzzy Hash: 87d2587d0d1091b9bfff55f69781da3510a1d4d5a4c03b5c96c5f30a6a526338
Instruction Fuzzy Hash: 1E512477E043818BD3208F14D4817A6B7B1BB42724F9441A8E8C65FA02DF32FE96CB51

Function 22638C40 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

winAccess, xrefs: 22638D60
delayed %dms for lock/sharing conflict at line %d, xrefs: 22638D35

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 0-1873940834
Opcode ID: 589968a2e33ef0d285e95f3cd0f9147ffb2417f71d54f0337aafc6c1790f7448
Instruction ID: 2d5ab4339f9c1eb680ef0f2ce9c5dd331b2c91ee401e30f44c20acc8ec313bac
Opcode Fuzzy Hash: 589968a2e33ef0d285e95f3cd0f9147ffb2417f71d54f0337aafc6c1790f7448
Instruction Fuzzy Hash: 0C4149B39057019BC302DF388981A9AFBE0AFA4754FC10A29FD66532D5E770D544CA83

Function 22749350 Relevance: 10.6, APIs: 7, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26ab8679b8ba63847481d2a3349b6e6980278f1c4e0f73ccc3e677a452fe267e
Instruction ID: 030c82b1a81d32b7cf217589a1a9ba955a207c021e4c25fc241c666f40c522b3
Opcode Fuzzy Hash: 26ab8679b8ba63847481d2a3349b6e6980278f1c4e0f73ccc3e677a452fe267e
Instruction Fuzzy Hash: 0F516A70884700DBD7209B79DA4CA3B37B8BF10249F406964ED0BD229DDB79E468CE67

Function 226D15C0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 135COMMON

Download Yara Rule

Strings

null, xrefs: 226D15EE
%!0.15g, xrefs: 226D160A
JSON cannot hold BLOB values, xrefs: 226D16D9

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %!0.15g$JSON cannot hold BLOB values$null
API String ID: 0-3074873597
Opcode ID: 9ec12e5b5559973708ac31746bbefcb13a839ceda95a69996235d45c1be368f6
Instruction ID: 5a11d8367e4d5c29dbc6dfee369c604458d9494cd0e1a3ee6b449fa66daed188
Opcode Fuzzy Hash: 9ec12e5b5559973708ac31746bbefcb13a839ceda95a69996235d45c1be368f6
Instruction Fuzzy Hash: 3241EDF7A04744ABE3104B50DC81BAB73A4DB19329F1806A9F150C21F3D3EA9598C3E1

Function 22641D50 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 132COMMON

Download Yara Rule

Strings

no such database: %s, xrefs: 22641E05
CREATE TABLE x( name TEXT, path TEXT, pageno INTEGER, pagetype TEXT, ncell INTEGER, payload INTEGER, unused INTEGER, mx_payload INTEGER, pgoffset INTEGER, pgsize INTEGER, schema TEXT HIDDEN, aggregate BOOLEAN HIDDEN), xrefs: 22641E2C

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: CREATE TABLE x( name TEXT, path TEXT, pageno INTEGER, pagetype TEXT, ncell INTEGER, payload INTEGER, unused INTEGER, mx_payload INTEGER, pgoffset INTEGER, pgsize INTEGER, schema TEXT HIDDEN, aggregate BOOLEAN HIDDEN)$no such database: %s
API String ID: 0-1404816483
Opcode ID: 8204d6d19b4a1ef4c1cd4f4dacd2c87f3a67b412e338c2ded26cea73ca453c71
Instruction ID: 5497b1cbae817014f59e43dcd079f5b4946c706c42707271c5b679afcabedc67
Opcode Fuzzy Hash: 8204d6d19b4a1ef4c1cd4f4dacd2c87f3a67b412e338c2ded26cea73ca453c71
Instruction Fuzzy Hash: AE31F6B36043096BC3215F69DC40B5BB7D8EF95315F010669FD98AB241EA76E9108BE1

Function 226AC650 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

PRAGMA %Q.data_version, xrefs: 226AC67C

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: PRAGMA %Q.data_version
API String ID: 0-2870853266
Opcode ID: 21032aba7a9052f0195b15569fe64e5b8582b836cfb844a7f77a33a9f11c2cc1
Instruction ID: 32f2ee6273abc70656b34880d448cdd959a9ba75153e63d47b9bf69016b502a9
Opcode Fuzzy Hash: 21032aba7a9052f0195b15569fe64e5b8582b836cfb844a7f77a33a9f11c2cc1
Instruction Fuzzy Hash: 9211A477B007049FD700DE19EC40656F7D5EF98322F544539E90492611EB36A91D8BA6

Function 228005B4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,?,?,?,0E16153E,?,228006F5,?,?), ref: 22800675

Strings

api-ms-, xrefs: 2280060B
ext-ms-, xrefs: 2280061F

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 9e4e16ce30189c8aba48487631ffa9cc053b7768582cf2575378ac1400a431b8
Instruction ID: 5421898a975b156d8b4cc7e20a22b73b2edc08efe1d537cc22e7fe81fbf575dc
Opcode Fuzzy Hash: 9e4e16ce30189c8aba48487631ffa9cc053b7768582cf2575378ac1400a431b8
Instruction Fuzzy Hash: 1021087AA00321EBD7119AA48D44F5A37699F81360F100610EE1EAB2C2D738FF04CAD4

Function 2275C6F0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 70COMMON

Download Yara Rule

Strings

a generated column, xrefs: 2275C722
F9n", xrefs: 2275C6F1, 2275C74E
a CHECK constraint, xrefs: 2275C714, 2275C72B
non-deterministic use of %s() in %s, xrefs: 2275C732
an index, xrefs: 2275C71D

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: F9n"$a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s
API String ID: 0-2279739937
Opcode ID: afe1ec8e134d69d96059e3a73ba36b1e2464522c41264fc12afa783cc0ee5a65
Instruction ID: 95af95d9db94a8c84a6f6c3a08024f3f019f7d1b30a530a1b8739db0f888a4a1
Opcode Fuzzy Hash: afe1ec8e134d69d96059e3a73ba36b1e2464522c41264fc12afa783cc0ee5a65
Instruction Fuzzy Hash: 5A2127B16082129BD7009F28DD44F6677A4AF01369F040B68FD16D72DCDB79D8A5CBD2

Function 226D31F0 Relevance: 9.5, APIs: 6, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa87eee454ad60666c4e793d92dad803d23b1a7f8b091d0e9f46e8b0880ce7b5
Instruction ID: 78c918cbfa86de4d21edf9de29e6dee263d508a0fbd2b86ccad0a500f2aaee1a
Opcode Fuzzy Hash: aa87eee454ad60666c4e793d92dad803d23b1a7f8b091d0e9f46e8b0880ce7b5
Instruction Fuzzy Hash: 0EF11473A043488FC305CF14DA8076ABBE0BF84328F08466DE9999F281D735E965CF92

Function 22654E00 Relevance: 9.2, APIs: 6, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89eb6f7932881218d6f87158e054f1bab56dc27f96570ae15f38e1ef250846d3
Instruction ID: 54e29d886beec7ebebf417d3cd0b3288f28c8e8a723a52a40ba457a1ae6e47fe
Opcode Fuzzy Hash: 89eb6f7932881218d6f87158e054f1bab56dc27f96570ae15f38e1ef250846d3
Instruction Fuzzy Hash: E381AF72544301DBD700DF18D948B6A77E4FF80359F440869FE49A7289D73AE928CBA3

Function 227573E0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 369COMMON

Download Yara Rule

Strings

sqlite_master, xrefs: 227573FD
ase, xrefs: 2275768D
sqlite_temp_master, xrefs: 227573F2
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 2275776D

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: SELECT*FROM"%w".%s ORDER BY rowid$ase$sqlite_master$sqlite_temp_master
API String ID: 0-231581592
Opcode ID: 2f35be1d395d5f0e095fb94a9d66b5460951528b921db97e612c1eb2204d4b8b
Instruction ID: 3b1f964ba5b4ef64aeb06f245f72abe34c3abed948da9d44d0a9058a0a4ce2ba
Opcode Fuzzy Hash: 2f35be1d395d5f0e095fb94a9d66b5460951528b921db97e612c1eb2204d4b8b
Instruction Fuzzy Hash: 81E1E4B0A087419FD721CF24C984BAAFBE4BF55308F044A2CFD5897252E775E964CB92

Function 22646DA0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 364COMMON

Download Yara Rule

Strings

recursively defined fts5 content table, xrefs: 22646DE2

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: recursively defined fts5 content table
API String ID: 0-437020801
Opcode ID: 55904ad05a1d88c01c0482104cacbce14bde46cace082a293cc61407067b67da
Instruction ID: 7b0cd5f70ca7a2d90853a6df73d3f9ee28253709b45acd9623c4300e6640f5b0
Opcode Fuzzy Hash: 55904ad05a1d88c01c0482104cacbce14bde46cace082a293cc61407067b67da
Instruction Fuzzy Hash: 91D1E0B2905340CFD725CF19C480B96BBF1EF88318F440A5EE8C59B246DB79E589CB92

Function 2265C0F0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 276COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 2265C124, 2265C16F
database corruption, xrefs: 2265C11F, 2265C16A
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2265C115, 2265C160

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 72e471a3a393866455d869cd02c9c35a9e4bb4ac8873ad6f6c12b2f6844dd5ac
Instruction ID: 2167e2f8b29b4ac6feef9ab9d605ddbae7de47722f7c532c8dd4b42d8c401123
Opcode Fuzzy Hash: 72e471a3a393866455d869cd02c9c35a9e4bb4ac8873ad6f6c12b2f6844dd5ac
Instruction Fuzzy Hash: 3DA1AC766083019BC704DF28D980A6BBBE2FFD8714F444A6DF9489B306E735E915CB92

Function 2272ABF0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 204COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 2272AE1D
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2272AE0E
misuse, xrefs: 2272AE18
unable to delete/modify user-function due to active statements, xrefs: 2272AD61

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$unable to delete/modify user-function due to active statements
API String ID: 0-3864549341
Opcode ID: 72aa5b7eaa0d0f2bcc5b0565508e234fb83bab54d52ff4f1292bfb6bd81773f4
Instruction ID: 27e69ee15f150ea1410e069cd397c2a23a82b0786db4a6f1309a07f3971d0ef4
Opcode Fuzzy Hash: 72aa5b7eaa0d0f2bcc5b0565508e234fb83bab54d52ff4f1292bfb6bd81773f4
Instruction Fuzzy Hash: E8510272608B04AFE7118E25DD80B2FB7F4EF89719F044A2DF68597251E736D901CB62

Function 2262A230 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 201COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 2262A46E, 2262A4AC
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2262A45F, 2262A49D
misuse, xrefs: 2262A469, 2262A4A7

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: 7255e69e50161eecafa9c10b6c536a3f3553cb0d430ee0bf4ec5b6c89fde2ffd
Instruction ID: 7eb9e71f40262feba5ef40bd0041824ed0f49e77a760364ec467e1f2b052bff3
Opcode Fuzzy Hash: 7255e69e50161eecafa9c10b6c536a3f3553cb0d430ee0bf4ec5b6c89fde2ffd
Instruction Fuzzy Hash: 4E711672604B419FF711CF24CA44BAB77E4AF54308F04862CE959CB242E7BAE955CF92

Function 2263A860 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 180COMMON

Download Yara Rule

Strings

argument to %s() is not a valid SQL statement, xrefs: 2263A97C
stmt-pointer, xrefs: 2263A928
bytecode, xrefs: 2263A96E
tables_used, xrefs: 2263A973, 2263A97B

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: argument to %s() is not a valid SQL statement$bytecode$stmt-pointer$tables_used
API String ID: 0-361449301
Opcode ID: f6c79254eeabe3ce83536e443b63c3d12371f9495dbfbe276e771ffbadc635b5
Instruction ID: 65da1ff6d06f263908997be0e70bbc9d3bffa50df776f48baa88ae40c68bd530
Opcode Fuzzy Hash: f6c79254eeabe3ce83536e443b63c3d12371f9495dbfbe276e771ffbadc635b5
Instruction Fuzzy Hash: BD61C1B25107019FE711CF24CA85B62B7E4EF44705F010A2DE986DB282E77BE948DB92

Function 2274BF00 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 156COMMON

Download Yara Rule

Strings

NEAR, xrefs: 2274C03A
fts5 expression tree is too large (maximum depth %d), xrefs: 2274C070
phrase, xrefs: 2274C035, 2274C042
fts5: %s queries are not supported (detail!=full), xrefs: 2274C043

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: NEAR$fts5 expression tree is too large (maximum depth %d)$fts5: %s queries are not supported (detail!=full)$phrase
API String ID: 0-593389478
Opcode ID: f8daed610bad77339ea05f005dc97726c842a613d9d85fc36a8c5f7c6e7d98bd
Instruction ID: 8130559173276af98a5c13c2477ede8f0614d34ca20f98c341a5efc05127b693
Opcode Fuzzy Hash: f8daed610bad77339ea05f005dc97726c842a613d9d85fc36a8c5f7c6e7d98bd
Instruction Fuzzy Hash: 4141F135E083149FD715CE24CA80B1EB3B4EF96324F10566EE94947222EF72ED45CBA1

Function 226523D0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 150COMMON

Download Yara Rule

Strings

database %s is locked, xrefs: 22652541
no such database: %s, xrefs: 226524B4
main, xrefs: 22652491
cannot detach database %s, xrefs: 226524C3, 22652547

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: cannot detach database %s$database %s is locked$main$no such database: %s
API String ID: 0-3838832555
Opcode ID: b6ae989f1ccfa5369524fb4652caf42eac909a224e81894f4a2fdfbae9e84473
Instruction ID: 90bb97d50008c42f2cc4991f024f37f55e2df0c7413e3c84747bcb9f606b7864
Opcode Fuzzy Hash: b6ae989f1ccfa5369524fb4652caf42eac909a224e81894f4a2fdfbae9e84473
Instruction Fuzzy Hash: CB51F5B2604300DFE718CF14C990F16B7E5BF94318F11865DE8588B392DBB1E965CBA2

Function 22654C00 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 143COMMON

Download Yara Rule

Strings

invalid arguments to fts4aux constructor, xrefs: 22654C9E
CREATE TABLE x(term, col, documents, occurrences, languageid HIDDEN), xrefs: 22654CCB
temp, xrefs: 22654C3E

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: CREATE TABLE x(term, col, documents, occurrences, languageid HIDDEN)$invalid arguments to fts4aux constructor$temp
API String ID: 0-537686372
Opcode ID: 997b56d342bd64c702df4152a88e0f1f015c720ced28ff2e869c0d9f3c8f68c3
Instruction ID: ef3db1a4e21432fb620d80f337903a34ee3a1831509ba75e227c15ee2187715f
Opcode Fuzzy Hash: 997b56d342bd64c702df4152a88e0f1f015c720ced28ff2e869c0d9f3c8f68c3
Instruction Fuzzy Hash: 0E4127772043549FC7158F18D980AA67BE0EF85324F1485E9EDE9AB602D732EA21CB70

Function 2266F490 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 143COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 2266F4BF
unable to delete/modify collation sequence due to active statements, xrefs: 2266F533
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2266F4B0
misuse, xrefs: 2266F4BA

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 0-3348720253
Opcode ID: 0b52e96825e8350062592291abf5faf3a35b13c99a3ec9309be79b4091335fe9
Instruction ID: 2a93b2593051cd4833062706e8c331383fec0b256935fa8a6c5156e2d4fc1e25
Opcode Fuzzy Hash: 0b52e96825e8350062592291abf5faf3a35b13c99a3ec9309be79b4091335fe9
Instruction Fuzzy Hash: DE4136736043009FD7118F28EC80B7AB7E4EF91329F14456EF6559B282EB3AE915CB61

Function 2263C2B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

%!.*f, xrefs: 2263C3AE

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %!.*f
API String ID: 0-786758813
Opcode ID: 4947f0eb81da8eaf70f267789a04e595d51680fbf21312828d0c93f58dc65ced
Instruction ID: 7508e2faf444aec1878c9be38b910fac02a265b45bebb7523b45ffb20181074c
Opcode Fuzzy Hash: 4947f0eb81da8eaf70f267789a04e595d51680fbf21312828d0c93f58dc65ced
Instruction Fuzzy Hash: 96316C33804F208BD3079B38991265B73E6AF96B95F048755FC867B002EB3A94D7C2D6

Function 226FEBD0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 226FEC51
database corruption, xrefs: 226FEC4C
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 226FEC42
CREATE , xrefs: 226FEBFF

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$CREATE $database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-1360532505
Opcode ID: 7efd1d9659667a04ab5ce2cfdb7e9ca2834cfaa40db9a222caa9f1e75288987e
Instruction ID: bc5eb812f8f1c9a266f1f5dfc04930bdda040ab898fd5103641f69734765272c
Opcode Fuzzy Hash: 7efd1d9659667a04ab5ce2cfdb7e9ca2834cfaa40db9a222caa9f1e75288987e
Instruction Fuzzy Hash: 4C314CA36083C5DEEF120A999940BA27FD5AF5521DF1401BBF9DE4E243E726D280C731

Function 22657050 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 98COMMON

Download Yara Rule

Strings

invalid, xrefs: 2265706F
out of memory, xrefs: 22657059, 226570A2
bad parameter or other API misuse, xrefs: 22657083
API call with %s database connection pointer, xrefs: 22657074

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: API call with %s database connection pointer$bad parameter or other API misuse$invalid$out of memory
API String ID: 0-453588374
Opcode ID: f0bfc85ebb7db561172883a2b8e0bc9505d968c2fe5a40d3e0914eefa877fcfe
Instruction ID: fa12e2fe7dfd9815c5d6859827ebc9e604aaf5c491a4ece4f7316be0ed50eb65
Opcode Fuzzy Hash: f0bfc85ebb7db561172883a2b8e0bc9505d968c2fe5a40d3e0914eefa877fcfe
Instruction Fuzzy Hash: 3A315AE3A0475087EB3B47249D0ABEB33D69F80319F2C0519E8459B34BE639D967C392

Function 226D93A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 93COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 226D9455, 226D9499
database corruption, xrefs: 226D9450, 226D9494
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 226D9446, 226D948A

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: c095e4a48e573d6edd585478b61ab5d7843f1e03d83953a1f8ce2e664aa8dc63
Instruction ID: f345dbfa944b620977e4f8ce2249683d16baf8d76d9da3cef742c347b278c17a
Opcode Fuzzy Hash: c095e4a48e573d6edd585478b61ab5d7843f1e03d83953a1f8ce2e664aa8dc63
Instruction Fuzzy Hash: E431483BA00B548BD3289F28C890AB3BBF29F55305B50845CE6C24B74AE722E941C750

Function 22664F40 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 91COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 22664F71, 22665002
database corruption, xrefs: 22664F6C, 22664FFD
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 22664F62, 22664FF3

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: cba068c0315f533c0052e68ef56e75d107688eab50c2b56bd73ca2235f0111a7
Instruction ID: 2a4fdffedd2800e439e0d4c46069a5c443c4b5bc008afee6c11f370597e4c989
Opcode Fuzzy Hash: cba068c0315f533c0052e68ef56e75d107688eab50c2b56bd73ca2235f0111a7
Instruction Fuzzy Hash: E2315976600745ABD3019F29D980BB6BBE0FF55315F084266F458CBB82D729E960DBA0

Function 22631C60 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 88COMMON

Download Yara Rule

Strings

unknown database: %s, xrefs: 22631CBD
%s at line %d of [%.10s], xrefs: 22631D4B
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 22631D3C
misuse, xrefs: 22631D46

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$unknown database: %s
API String ID: 0-142545749
Opcode ID: 4fd1fc1219c4b29f1ce3faa58aee6479759354d24f657db040c259204507d995
Instruction ID: b98dc3f347eeefdf296d809de633a8fcefe16bb479b217f93e53d35af9fe0101
Opcode Fuzzy Hash: 4fd1fc1219c4b29f1ce3faa58aee6479759354d24f657db040c259204507d995
Instruction Fuzzy Hash: A82175B2A00744ABE3129B259C44FAB7BA9AFD2B5CF0006ACF85457296DB38D501C763

Function 22663FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 85COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 2266408C, 226640B7
database corruption, xrefs: 22664087, 226640B2
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2266407D, 226640A8

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: b4490a841621348df3601dae20f8dcb966d333acc498145244905731b7fa32d5
Instruction ID: 683efe985000f2f9c2925003491b3fff4bb0ddbf33864f9ec7bc3db1c6c3727b
Opcode Fuzzy Hash: b4490a841621348df3601dae20f8dcb966d333acc498145244905731b7fa32d5
Instruction Fuzzy Hash: 452103B7A00365ABD700DF18DC80ABB7BD0EB94615F418526FD44D7309E729D649C7E2

Function 226D9290 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 226D92AB, 226D9339
database corruption, xrefs: 226D92A6, 226D9334
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 226D929C, 226D932A

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 55f6709b6c78ad107468ab1aa2b74654b732a73e8185b82d246abff1364dca33
Instruction ID: 0af0cc5915886911f31a161abe0d9128ed5a6f33b3ad42c479fb2ce1f0dc40c5
Opcode Fuzzy Hash: 55f6709b6c78ad107468ab1aa2b74654b732a73e8185b82d246abff1364dca33
Instruction Fuzzy Hash: ED21682B604B949BD3219F3899C0BB3BFF19F15304B45899CE6D29779AE232E981C750

Function 2267D6F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 70COMMON

Download Yara Rule

Strings

i@i", xrefs: 2267D702, 2267D707, 2267D706
%s%s, xrefs: 2267D725

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s%s$i@i"
API String ID: 0-2133393890
Opcode ID: 8635f0ee0a73d2b54931ca24d7140d52b609ba0124b1db4ce4734505fd5994fb
Instruction ID: d55a4e7332a872e4f1ea233b01f4579874f528a90cd7bbcc1c9e85e520d68cb9
Opcode Fuzzy Hash: 8635f0ee0a73d2b54931ca24d7140d52b609ba0124b1db4ce4734505fd5994fb
Instruction Fuzzy Hash: 4C11B1769403109BD7019B29ED88B6B33B8FF8025AF040965FE09D628CE739D514CBA3

Function 226433C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

CREATE TABLE x(pgno INTEGER PRIMARY KEY, data BLOB, schema HIDDEN), xrefs: 226433D6

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: CREATE TABLE x(pgno INTEGER PRIMARY KEY, data BLOB, schema HIDDEN)
API String ID: 0-1935849370
Opcode ID: 8e095df76855aa528fd1271cc66d72f6d29c60afda01ab89f169762f4f61523a
Instruction ID: 9c298be3a28a8106335667b911b85285cddec35d96a032a276744030bce85d1e
Opcode Fuzzy Hash: 8e095df76855aa528fd1271cc66d72f6d29c60afda01ab89f169762f4f61523a
Instruction Fuzzy Hash: 1101D276B047168BD301DF19E800B8AB3E9EFD5311F588176F6408B240EBB0A5978BA1

Function 227D5BC1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,0E16153E,?,?,00000000,2282D1CB,000000FF,?,227D5B30,?,?,227D5ADF,?), ref: 227D5BF6
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 227D5C08
FreeLibrary.KERNEL32(00000000,?,?,00000000,2282D1CB,000000FF,?,227D5B30,?,?,227D5ADF,?), ref: 227D5C2A

Strings

mscoree.dll, xrefs: 227D5BEF
CorExitProcess, xrefs: 227D5C00

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: dd213526fe3bfa8b7a14e1dd8aabc76e7267a9ff831d73cceeccad9ad2bec7d3
Instruction ID: 16869a25b53e824b2d501191a48be37ce42c79960ca6f54b100daa887ce263fd
Opcode Fuzzy Hash: dd213526fe3bfa8b7a14e1dd8aabc76e7267a9ff831d73cceeccad9ad2bec7d3
Instruction Fuzzy Hash: F6014436954659EFDB018F50CD44BBEB7B8FB08715F000E25ED16A26C4DB7CD540CA91

Function 22746A20 Relevance: 8.0, APIs: 5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4317c5ffe5ee57ae26dca5216e202e7a570a87b35b07371616966781ac393fa3
Instruction ID: 701e895eb82b99e8b582bd1faa02aa6621d55c98202cfa05f6933c9cd3bfa7f7
Opcode Fuzzy Hash: 4317c5ffe5ee57ae26dca5216e202e7a570a87b35b07371616966781ac393fa3
Instruction Fuzzy Hash: 12028AB0A08305CFD700DF25D944B2ABBF4BF44308F444A6DED4997285EB78EA58CB92

Function 226AAF80 Relevance: 7.8, APIs: 5, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2ee86135faab9893eafa2e76ed625a0179caf4d83dddee292c7285a0550aa94
Instruction ID: 04e67d748949f3b4a841e35f42c40850b86e1b953a62da327398734535e11cca
Opcode Fuzzy Hash: d2ee86135faab9893eafa2e76ed625a0179caf4d83dddee292c7285a0550aa94
Instruction Fuzzy Hash: 00A1AF72981712DBD7109F21C959A2A33B4BF20349F041965ED0BD228CD779ED68CFA7

Function 227473C0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

fts5: syntax error near "%.*s", xrefs: 2274751C

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: fts5: syntax error near "%.*s"
API String ID: 0-498961494
Opcode ID: 10323979ec9f039a14dba5842d6498d97c3b9f793bee4a95a32d75438aa532ab
Instruction ID: 93916b642a804d215f50acca858948fcc88c7cf69aba57a6010a4e3acf384165
Opcode Fuzzy Hash: 10323979ec9f039a14dba5842d6498d97c3b9f793bee4a95a32d75438aa532ab
Instruction Fuzzy Hash: E4B1A0B0908351DFD311CF28C984BAABBF4EF44348F84491DF8899B245DB75E645CB96

Function 2263F7F0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

integer overflow, xrefs: 2263F8ED

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: integer overflow
API String ID: 0-1678498654
Opcode ID: 1c90f45a08117ed020d399c82259b424342c1bad8431d6270e55b9fbbe2319f3
Instruction ID: 40c43ba1b53b9a308589ff27a5e36e5d45a451199f5d1eb18954872383f2de0a
Opcode Fuzzy Hash: 1c90f45a08117ed020d399c82259b424342c1bad8431d6270e55b9fbbe2319f3
Instruction Fuzzy Hash: 8C11E273808B11AEDB02AF24BD04B8A37A1AF26724F154799E4581A1E2EB71C5D5C7D2

Function 226482E0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

[%d], xrefs: 226484C7

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: [%d]
API String ID: 0-394612830
Opcode ID: d5eac84a00203dfdb4b23a48b3f7248a245d111bc91d7b56665eef07e3b11263
Instruction ID: 6e29771f559481d972213fa737751b7db7c18a7f0dd8525b7da375130ef9b27d
Opcode Fuzzy Hash: d5eac84a00203dfdb4b23a48b3f7248a245d111bc91d7b56665eef07e3b11263
Instruction Fuzzy Hash: 7F7104B3D04384AFDB34CB64CC80FA777E9AF85704F844A19E9C896581EB71E509C762

Function 22726180 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 216COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 22726396
database corruption, xrefs: 22726391
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 22726387

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: a87b7bf16bd9b10ebb4f08a0c465651ba943f7b7de1b5a4e6433ea1dafea06f6
Instruction ID: 405d263ab3413753e8648c4de2952243d523ec48945044f09dd0918c9182b4b9
Opcode Fuzzy Hash: a87b7bf16bd9b10ebb4f08a0c465651ba943f7b7de1b5a4e6433ea1dafea06f6
Instruction Fuzzy Hash: F271C172A0C7508BDB00DF24CAC07AB7BE1EB58324F941A9AE895CB283E735DD45C791

Function 22637D30 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 199COMMON

Download Yara Rule

Strings

winShmMap3, xrefs: 22637F1D
winShmMap1, xrefs: 22637DC5
winShmMap2, xrefs: 22637E1F

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: winShmMap1$winShmMap2$winShmMap3
API String ID: 0-3826999013
Opcode ID: 76e834cd31cd1f8b8bc768f632c02ccb152493221ea37cd3072d4b1aa0f3c6dc
Instruction ID: 4ce8609aca9f9caefef38a22e548fa03c27b7900a52664e80743c8a59075431d
Opcode Fuzzy Hash: 76e834cd31cd1f8b8bc768f632c02ccb152493221ea37cd3072d4b1aa0f3c6dc
Instruction Fuzzy Hash: 9261FD726047019FD716CF24CD84BA7B7E5BF94B44F00096DEA8297292EB74E904CB92

Function 227D0FC2 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 227D0FE7
CatchIt.LIBVCRUNTIME ref: 227D10CD

Strings

MOC, xrefs: 227D0FF9
RCC, xrefs: 227D1001

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: c9905245f0a939d71218b3498b4e630cb4a794d5bcd86444ba3ad37d05babedb
Instruction ID: 401735738553382a4e8210e600dc39c2b798cfec30b60cad687f7ff4b34d7da8
Opcode Fuzzy Hash: c9905245f0a939d71218b3498b4e630cb4a794d5bcd86444ba3ad37d05babedb
Instruction Fuzzy Hash: 74412772A00349EFCF06DF94CA80AAE7BB5FF48304F548199FA14B7261D3359A50DB50

Function 22634CE0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 160COMMON

Download Yara Rule

Strings

wrong number of vtable arguments, xrefs: 226C3FA9
temp, xrefs: 226C3F91

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: temp$wrong number of vtable arguments
API String ID: 0-2849069181
Opcode ID: 06e0b5e628c9c462408ccb4579e652c961d0757ca7915680a09416ae014cacd9
Instruction ID: 7f22c2bd1edee64e9fb44bb25ab36d2dad0ad49fe5839d72a82f8ea05b02b8bd
Opcode Fuzzy Hash: 06e0b5e628c9c462408ccb4579e652c961d0757ca7915680a09416ae014cacd9
Instruction Fuzzy Hash: D75110B6A043458FC704DF24D58095ABBF1FF89308F044A6DE5855B702D732EA4ACF96

Function 226635E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 226635F9
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 226635EA
misuse, xrefs: 226635F4

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: 9830a7422bb48b3e975b49ca1babbd5e577430bd53618b5ec32253e3a3245ea0
Instruction ID: 76b784210dbe0ecf7b436fb101882206cfe097df0369e35149a82dbaf1fa5569
Opcode Fuzzy Hash: 9830a7422bb48b3e975b49ca1babbd5e577430bd53618b5ec32253e3a3245ea0
Instruction Fuzzy Hash: 2251D7F2A04314AFD7048F14C984A36BFE4FF14B24F184268F9299F252D739E920C796

Function 226D96B0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 136COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 226D97EF
database corruption, xrefs: 226D97EA
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 226D97E0

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: a3338d8d22d9e4d27b8333379c3a0765bd6a0ef6f624dff89216b6dfd27c6aa1
Instruction ID: 950debf2dfa03517589a93b7955f94028b3160b3fc1726bde2dafcb4870f0a6b
Opcode Fuzzy Hash: a3338d8d22d9e4d27b8333379c3a0765bd6a0ef6f624dff89216b6dfd27c6aa1
Instruction Fuzzy Hash: 0A414677206B948FD3328F3894807E3FFE0DF51215F1849AAD2D58B652E222E481D361

Function 22630300 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 128COMMON

Download Yara Rule

Strings

winWrite1, xrefs: 2263045E
winWrite2, xrefs: 2263043B
delayed %dms for lock/sharing conflict at line %d, xrefs: 226303FF

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: delayed %dms for lock/sharing conflict at line %d$winWrite1$winWrite2
API String ID: 0-1808655853
Opcode ID: a99e2c88d7eb2fd61a233a0dcfdf98b75b7c6ad1ec02f61e7c1c57db8b22492e
Instruction ID: c7b8831e3ef675caa51a587c5176c25ca8d4546dd19de7464f7919107ccecc22
Opcode Fuzzy Hash: a99e2c88d7eb2fd61a233a0dcfdf98b75b7c6ad1ec02f61e7c1c57db8b22492e
Instruction Fuzzy Hash: E0416A73E08302DFD7058F18CD80A6FB7D4EB84B14F500A6AFA11C7295D735D6488792

Function 227A5960 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 126COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 227A5985
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227A5976
misuse, xrefs: 227A5980

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: 8b66563c52b0a3107009e8c796d49e880a0967c380c8a7964d35f2fae5aa3aa7
Instruction ID: b359d54a37dfcd1595052a5ab73a8011351a6a9721a5e7c0b24516ebefb5adc0
Opcode Fuzzy Hash: 8b66563c52b0a3107009e8c796d49e880a0967c380c8a7964d35f2fae5aa3aa7
Instruction Fuzzy Hash: D2411772E083109BD3018B54CD90B9ABBE4BF95334F840729F9855B241E729EA98C792

Function 227B8850 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 227B895F
os_win.c:%d: (%lu) %s(%s) - %s, xrefs: 227B88E2

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: delayed %dms for lock/sharing conflict at line %d$os_win.c:%d: (%lu) %s(%s) - %s
API String ID: 0-1037342196
Opcode ID: f667e22408fef444b203ffc10d2e0175ce1ecbff5c879ddf727eb675c8e4475b
Instruction ID: a14328406b1755de6580fe2e8118b5df6d38ef0295deb08565cf6e885d8706fd
Opcode Fuzzy Hash: f667e22408fef444b203ffc10d2e0175ce1ecbff5c879ddf727eb675c8e4475b
Instruction Fuzzy Hash: 0221AD7160C346AFEB219B14C989BFBBBD9AFD4304F844C2CE588C7292C235D8448793

Function 22665390 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 117COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 2266540D
database corruption, xrefs: 22665408
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 226653FE

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 5ab0b7c1dfb4ae45a413d6bf69a49abf643c665541dc709eea56e1cd65098826
Instruction ID: 23ab16ae27139fd50ea5eccb8d52f08b823c2b6987974e723f4b5b8c65489148
Opcode Fuzzy Hash: 5ab0b7c1dfb4ae45a413d6bf69a49abf643c665541dc709eea56e1cd65098826
Instruction Fuzzy Hash: A431AE6764079086E3218F3899417F7B7E09F51717F4804AEEBC5E7A82F32AE496C361

Function 22747ED0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 111COMMON

Download Yara Rule

Strings

error in tokenizer constructor, xrefs: 22747F92
no such tokenizer: %s, xrefs: 22747F1B

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: error in tokenizer constructor$no such tokenizer: %s
API String ID: 0-815501780
Opcode ID: 6cfc1c2582b67edfc675896201c5ecdb668e28e62e825ff6d9c03431c92d373f
Instruction ID: b93f97c1d757f31ae32e9ce9461e5aefe3783424488b4bbd296c927178a978a4
Opcode Fuzzy Hash: 6cfc1c2582b67edfc675896201c5ecdb668e28e62e825ff6d9c03431c92d373f
Instruction Fuzzy Hash: 3C318276B053159FC720CE19D880B9AB3F4EF85659F14466DE948AB300E732E906CB51

Function 2262F000 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

second argument to nth_value must be a positive integer, xrefs: 2262F0C4

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: second argument to nth_value must be a positive integer
API String ID: 0-2620530100
Opcode ID: 4ffc16aadc0ed02904e2c56f0d8fef1738459bd7238f706b282059f0551fd72a
Instruction ID: 1669712f47bc3113078dda5754af136bc6039121c3a1e18e661eb33dd2eca378
Opcode Fuzzy Hash: 4ffc16aadc0ed02904e2c56f0d8fef1738459bd7238f706b282059f0551fd72a
Instruction Fuzzy Hash: 82315AB3904B119FC7019F24DD8172A73E0BF20320F444B28FC6566281EB32EA54CE92

Function 226405D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMON

Download Yara Rule

Strings

rbu(%s)/%z, xrefs: 22640697
rbu/zipvfs setup error, xrefs: 2264061A

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: rbu(%s)/%z$rbu/zipvfs setup error
API String ID: 0-199214844
Opcode ID: d45690e6381a4294df2d1546dd3b23fd4ea7614f3faab3ff682038f7fa256bbd
Instruction ID: 822e5bc08d44bd8554bc464a97f81f965cf55dcaf3e6fd1f65ce2a8f85e1f48d
Opcode Fuzzy Hash: d45690e6381a4294df2d1546dd3b23fd4ea7614f3faab3ff682038f7fa256bbd
Instruction Fuzzy Hash: 3B2104B7A003159FC320CF19ED80B46B3E9EFC9320F25443AE95A87202EB32E814CB55

Function 22665280 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 22665301
database corruption, xrefs: 226652FC
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 226652F2

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: be201281af63a87c5cad95421732c2b1cdf126f836d0d0088d1806958b65f8d5
Instruction ID: 0da5519458e0b394312f03a506bdf313f834f2b0b6fd8d09c54011b9a02231f6
Opcode Fuzzy Hash: be201281af63a87c5cad95421732c2b1cdf126f836d0d0088d1806958b65f8d5
Instruction Fuzzy Hash: B011577760031067CB115B49FC40CEBBFE9DFD42B6F094665FB0857222E622C921D3A2

Function 22788490 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 80COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 227884D0
database corruption, xrefs: 227884CB
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227884C1

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 82b83f6fda6b6994d8ed47de812815f66841ea1651d51a8972cab2d59db1a50f
Instruction ID: f1a6ecc6de08909720763f4484a6d4460b2a8da9cca0f06d7a886302719e8148
Opcode Fuzzy Hash: 82b83f6fda6b6994d8ed47de812815f66841ea1651d51a8972cab2d59db1a50f
Instruction Fuzzy Hash: 9421347A3047089BD7208F58C880B57B3E6EF94321F40492EF94AD7342E731EA04D762

Function 2266FD60 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 2266FE82
database corruption, xrefs: 2266FE7D
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2266FDE6, 2266FE61

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 15a9ec8990ba773e6137a7940da0673b25a788827469c46d0dd7657ecf3c4c49
Instruction ID: 737d82cd467d36d88fc74dc0b35808e5407bdd77d5b1e6b8942d79658c19195f
Opcode Fuzzy Hash: 15a9ec8990ba773e6137a7940da0673b25a788827469c46d0dd7657ecf3c4c49
Instruction Fuzzy Hash: DC3126A9614381CAD3188F248280372BAA1BF11308F24C6CDD5488F797E77BC483DB96

Function 22746140 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

Strings

CREATE TABLE %Q.'%q_%q'(%s)%s, xrefs: 22746175
WITHOUT ROWID, xrefs: 22746150, 22746162
fts5: error creating shadow table %q_%s: %s, xrefs: 22746197

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: WITHOUT ROWID$CREATE TABLE %Q.'%q_%q'(%s)%s$fts5: error creating shadow table %q_%s: %s
API String ID: 0-1971204597
Opcode ID: 96551fe8f0ac8a025fd19bc32b7ea277c439bbdb5290f89d80a3672a60396217
Instruction ID: 30025e6f3b3ebe21efa92e76e7acae0654be96741950c76ad392552a49f45360
Opcode Fuzzy Hash: 96551fe8f0ac8a025fd19bc32b7ea277c439bbdb5290f89d80a3672a60396217
Instruction Fuzzy Hash: 48119371A04200EFD7014F58DC88A2B77B4FB84349F044869FE0AD6289DB39C928DBA3

Function 226CA6B0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 226CA6D2
database corruption, xrefs: 226CA6CD
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 226CA6C3

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: a1a53c35dc6e42e786269e983c4c03b93a39fd329da9a2438ae789a53af754c5
Instruction ID: a080e5f1efc25af86e0d967a970de14d50f74fc08bc2714f04b21b0ab750d3cb
Opcode Fuzzy Hash: a1a53c35dc6e42e786269e983c4c03b93a39fd329da9a2438ae789a53af754c5
Instruction Fuzzy Hash: 41118BB66043019FD700DF59DC80B6BB7E8EBC0310F4408A9F6449B251D73AD845CB62

Function 22632380 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 62COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 2263240B
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 226323FC
misuse, xrefs: 22632406

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: 0ded564abc1bca45626eef30f4b09684df934fd1ef8c2ec6f0d8006066309766
Instruction ID: c7ca5a1229ab9c309d05924150961b8492a3c16e2265e2326b93b4369f6acfad
Opcode Fuzzy Hash: 0ded564abc1bca45626eef30f4b09684df934fd1ef8c2ec6f0d8006066309766
Instruction Fuzzy Hash: F9119776604342EFE709CF08D880E5ABBA4AF98708F414498E6419B396D631ED86CB90

Function 226D1F70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

JSON path error near '%q', xrefs: 226D1F92

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: JSON path error near '%q'
API String ID: 0-481711382
Opcode ID: 10b118df1447b9055c805d42cb4027198450f8a8b1c0b61af5790993aaa47bff
Instruction ID: 33f9e7b353bbf940b4ffc81ba569b5af4e4928285efef88c53fe4029ede627fd
Opcode Fuzzy Hash: 10b118df1447b9055c805d42cb4027198450f8a8b1c0b61af5790993aaa47bff
Instruction Fuzzy Hash: 83010473A093116FDB149A548C00B9B7BC4DF41320F1006ACF9A5A62E1EBB1D801C7E2

Function 2264F0E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

INSERT INTO %Q.%Q(%Q) VALUES('flush'), xrefs: 2264F105

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: INSERT INTO %Q.%Q(%Q) VALUES('flush')
API String ID: 0-2312637080
Opcode ID: 13147e6b2a492c3fff1abddaf119cde85fc9e400762f4714bf9466ade9ac429e
Instruction ID: 8b0818c009a2bc1694ddfcd3eaca8edc7d9c2f5f56a4fa1f37125881d1eaee72
Opcode Fuzzy Hash: 13147e6b2a492c3fff1abddaf119cde85fc9e400762f4714bf9466ade9ac429e
Instruction Fuzzy Hash: CD019E37B047415EE3218A6EFC80F97B7E8EBD4725F08056AF5EDC3201DB61A88587A1

Function 22631DF0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 22631E63
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 22631E53
misuse, xrefs: 22631E59

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: ac5b94fa3e4bc0175e78fb87fef2337a637142084dedc98bed4b481e65a15483
Instruction ID: 5ea99aed4cefaf74bbf863ea5f8360df7c5c21e56250f68664737bc79b37e285
Opcode Fuzzy Hash: ac5b94fa3e4bc0175e78fb87fef2337a637142084dedc98bed4b481e65a15483
Instruction Fuzzy Hash: FC11C175608B509BE309CE28D844E56BBE8AF52A08F040599E0058B332C7B6D505C7D2

Function 22650D70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

INSERT INTO %Q.%Q(%Q) VALUES('flush'), xrefs: 22650D87

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: INSERT INTO %Q.%Q(%Q) VALUES('flush')
API String ID: 0-2312637080
Opcode ID: b487878242a9805c744fcaf9a9bda1f0d61e443f77e5a0b6b370be7a05b33fa5
Instruction ID: b28686cd66a84d3e9d7e28e46ec723ddba5714d44ee8d17fc5172f65548819db
Opcode Fuzzy Hash: b487878242a9805c744fcaf9a9bda1f0d61e443f77e5a0b6b370be7a05b33fa5
Instruction Fuzzy Hash: 53018C77604700AFE3509A5DED80F43B7E9EB88724F044558F68DEB280E7B6EC558B94

Function 2262EF30 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 2262EFB5
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2262EFA6
misuse, xrefs: 2262EFB0

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: fb4f241db419338aad947de1a460a16720c2f29fb3c04ad74e08be1edafe66f4
Instruction ID: 07c9471f4f5b99a3e9f988a61beb1d041faca7baf9e7a548f3f9169e9478770c
Opcode Fuzzy Hash: fb4f241db419338aad947de1a460a16720c2f29fb3c04ad74e08be1edafe66f4
Instruction Fuzzy Hash: 8501B5B2A45B119FE700CF08D944B5B7BE1AF81308F498568E9096B389C379E849CF97

Function 22699180 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

Strings

%s_stat, xrefs: 22699192

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s_stat
API String ID: 0-920702477
Opcode ID: f34d6889e7b676ced58ff426785f3ab81c7fae61a52c3629fb5fbc49428ef8f4
Instruction ID: dfbce20c75c5a48b4b3f150be4b55c009a62d9208e54128417832494f080d0fa
Opcode Fuzzy Hash: f34d6889e7b676ced58ff426785f3ab81c7fae61a52c3629fb5fbc49428ef8f4
Instruction Fuzzy Hash: EEF02733B057513BE71086B9BD80B4AFBD9BB50260F088726E40CA2104D716ACA187D1

Function 22647F70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

CREATE TABLE x(key,value,type,atom,id,parent,fullkey,path,json HIDDEN,root HIDDEN), xrefs: 22647F76

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: CREATE TABLE x(key,value,type,atom,id,parent,fullkey,path,json HIDDEN,root HIDDEN)
API String ID: 0-3072645960
Opcode ID: 72867f4ed30481d01edbe7a4a2e97b246d2cb61046b0fdd6ff29befc704d6c75
Instruction ID: 29c1a5f6136a55cee5c19968556cb74869e7a63b06dad1c4ef58369098be30e8
Opcode Fuzzy Hash: 72867f4ed30481d01edbe7a4a2e97b246d2cb61046b0fdd6ff29befc704d6c75
Instruction Fuzzy Hash: DDF02B77B0470287D7515F18FC01BC9B7E4AFE0311F590235F8849A250EB60D995C7A1

Function 227D066B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,227D0513,?,?,?,?,?,?,227D07BD,00000003,FlsSetValue,22847770,22847778), ref: 227D0678
GetLastError.KERNEL32(?,227D0513,?,?,?,?,?,?,227D07BD,00000003,FlsSetValue,22847770,22847778), ref: 227D0682
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 227D06AA

Strings

api-ms-, xrefs: 227D068F

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 030955b26960ca78dc88941686864ac950d6d9fcb4134261fbdb156a4d3ce618
Instruction ID: 8d5b64f7499c05b1383115c17431b99b9da1c8dd08d35f1c4d3651eced984e42
Opcode Fuzzy Hash: 030955b26960ca78dc88941686864ac950d6d9fcb4134261fbdb156a4d3ce618
Instruction Fuzzy Hash: 34E04871684315B7EB111E61DC05B593F549F40750F505820FD0DE81D6D776E9948949

Function 2275C1F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 9COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 2275C1FE
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2275C1F0
misuse, xrefs: 2275C1F9

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: be51f1aca8b5185d356f30c3daed57b3bbe1b6618f189ad041c3aa7ddd8e3047
Instruction ID: 9280f6114b9c33cec3da57a33f206b437572e8940f856b725f026924ddfa1559
Opcode Fuzzy Hash: be51f1aca8b5185d356f30c3daed57b3bbe1b6618f189ad041c3aa7ddd8e3047
Instruction Fuzzy Hash: F5B092AEF24B4CF7FB0522448CC1EDB7A505BE030AFC1C468F2556D7AEE869C110EA16

Function 2272A570 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 9COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 2272A57E
database corruption, xrefs: 2272A579
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2272A570

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 2528b9fd9fcb8dacb64a0f82b63ab5591cb2ad243f3511e74bdc2e9cc7eb7377
Instruction ID: a8d7cf575c2966914daf3c067e521aaa1cb1da986b1debe2ecdcfadc76ce96a0
Opcode Fuzzy Hash: 2528b9fd9fcb8dacb64a0f82b63ab5591cb2ad243f3511e74bdc2e9cc7eb7377
Instruction Fuzzy Hash: 25B092AEF20308B3FA0522548D81F9B3E505760608FC2C954F1092A39EEA29C510D652

Function 22726B50 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 9COMMON

Download Yara Rule

Strings

cannot open file, xrefs: 22726B59
%s at line %d of [%.10s], xrefs: 22726B5E
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 22726B50

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$cannot open file$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-1799306995
Opcode ID: abeefbe918edd267a7d70d99eaa982b0db8f69755f2e4b69e1b0a6d4d5f5eb96
Instruction ID: 2ee3f892549bfac016523bd89d11b8158abcf52a9579dfc9f645d7c584f03412
Opcode Fuzzy Hash: abeefbe918edd267a7d70d99eaa982b0db8f69755f2e4b69e1b0a6d4d5f5eb96
Instruction Fuzzy Hash: C9B0929EF24388B7FA052A54CC81F9B3E5067A0608FC1C894F149393AEE89AC190CA16

Function 226825E0 Relevance: 6.4, APIs: 4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d069a9abd7bedab09f3fe516bd8b1ae306ced2871dfb2fc8918d1c12b2218281
Instruction ID: 9124ac66ddf3aa9e78e1ec796720ea9dbec1839c9ebb39804102d71c237073d4
Opcode Fuzzy Hash: d069a9abd7bedab09f3fe516bd8b1ae306ced2871dfb2fc8918d1c12b2218281
Instruction Fuzzy Hash: A2D194B16443419FD700DF65CA48A2A77A8FF04349F401929FE06C2289DBB9D95CCFA3

Function 228167F5 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(0E16153E,00000000,00000000,?), ref: 22816858
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 22816AAA
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 22816AF0
GetLastError.KERNEL32 ref: 22816B93

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 913a7deff9160acc393f2850cacde33f361fee14a34aa3db8f7dcd16fb9a04c5
Instruction ID: d639911a3b2d5a74cad154cad8f979010a750ff30cb5d7945043d7f2e7df2a33
Opcode Fuzzy Hash: 913a7deff9160acc393f2850cacde33f361fee14a34aa3db8f7dcd16fb9a04c5
Instruction Fuzzy Hash: 0CD159B9D00268DFCB05CFA8C9809EDBBB5FF09314F14456AE996EB291D734E941CB50

Function 226C8EB0 Relevance: 6.2, APIs: 4, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0132aa0ddf72b5e9ad9540845ad80019a4112ac57e8733fb90583d0c93ba3758
Instruction ID: 05fb7900f73db1a76d24e412c683e96414df21e334e46f9530d0d3b005f956c7
Opcode Fuzzy Hash: 0132aa0ddf72b5e9ad9540845ad80019a4112ac57e8733fb90583d0c93ba3758
Instruction Fuzzy Hash: 625157737093D18AD7319F34994C7AAFBE8DF16324F0806ADE9D48B242E369D588C361

Function 22647DA0 Relevance: 6.2, APIs: 4, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa8b90d46f4615fc8693062fb051e3fcb4a0599d4b5d697ae82a6c445077dfff
Instruction ID: 81e360f3ddc801b150f7bf0d9d618925ad5a57f8e583d0689253a37a12d9ecc9
Opcode Fuzzy Hash: aa8b90d46f4615fc8693062fb051e3fcb4a0599d4b5d697ae82a6c445077dfff
Instruction Fuzzy Hash: C941A177A017019FD325CF18DA80A92F7F5FF84324F144669E9868BA52DB72F851CB90

Function 2264CAE0 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6321413b228e2399db9d85729e9f7a90e277a2b509474dc15cd733278e3e436
Instruction ID: 455d20270ca9577841f44c644d7bb84c53066fec2e8004d1cceee96114de1a8b
Opcode Fuzzy Hash: d6321413b228e2399db9d85729e9f7a90e277a2b509474dc15cd733278e3e436
Instruction Fuzzy Hash: 1931CEB3B047019BD724CF68E944B5AB3E5FF94321F000ABAE944CB750EB21E954D7A2

Function 2264B1F0 Relevance: 6.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c84fadece956eb82bcd06ee462d33b28814fba88082786c6e23e5494ba88420
Instruction ID: 42b0e0dc59e79c46ea3dede34e078dcfd5101de07ecbec47ff52ae0ed97762bd
Opcode Fuzzy Hash: 2c84fadece956eb82bcd06ee462d33b28814fba88082786c6e23e5494ba88420
Instruction Fuzzy Hash: D931A176D04B429BD330CF29E9807ABB7E0BF95314F044A6DD8DA86901D771F498CB55

Function 226BCFE0 Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67f155ee4936aae19aec06cb809ffc92085dd37a0bce870209c165f40ac7d322
Instruction ID: c9e37d317cfb0d75634ddf4bc0f399a5d5d7f33899ef89f4f7e72fdeb5ab58cf
Opcode Fuzzy Hash: 67f155ee4936aae19aec06cb809ffc92085dd37a0bce870209c165f40ac7d322
Instruction Fuzzy Hash: 2A21B3725047059FD750EF68C980A5BBBF0EFA8340F50482DF585D7212E771E6588F92

Function 2281F4CA Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,?,00000001,00000000,?,?,00000000), ref: 2281F4E0
GetLastError.KERNEL32(?,?,?,?), ref: 2281F4ED
SetFilePointerEx.KERNEL32(?,?,?,?,?), ref: 2281F513
SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,?,?,?), ref: 2281F539

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID: FilePointer$ErrorLast
String ID:
API String ID: 142388799-0
Opcode ID: e86704473ee46076efde1919534877c0161bbf4acfed5d51160e94134421cdfd
Instruction ID: 66e3d1c8fc8961c49e060c470197f451cf2bd219c6a7dc81da40ddab3c93e879
Opcode Fuzzy Hash: e86704473ee46076efde1919534877c0161bbf4acfed5d51160e94134421cdfd
Instruction Fuzzy Hash: 8C114275800319EBDF108FA4CC48DEE3FB9EB00360F108644F929A62A0DB35DA90DBA0

Function 22622ABD Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 22821382
GetLastError.KERNEL32 ref: 2282138E
___initconout.LIBCMT ref: 2282139E

Part of subcall function 22821303: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,228213A3), ref: 22821316

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 228213B3

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID: ConsoleWrite$CreateErrorFileLast___initconout
String ID:
API String ID: 3431868840-0
Opcode ID: 60b7074bc437875a1ffcef87dfc3bcc4c66f03873997d8bde949d76d83dc3ade
Instruction ID: 722df865756ead0469971ee3ecb55161c5e6933a3008f9d2b5676df2cc8569ea
Opcode Fuzzy Hash: 60b7074bc437875a1ffcef87dfc3bcc4c66f03873997d8bde949d76d83dc3ade
Instruction Fuzzy Hash: 74F0823A140655FBCF221F95CD089E93F67FB083A0F144610FD1985565CA3AC9A0DBC0

Function 2263BE80 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

string or blob too big, xrefs: 2263C1B5

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: string or blob too big
API String ID: 0-2803948771
Opcode ID: 484fe6d3af0d5dc6871dec36b840eb3e68e87b5e3990c6fd490c08a6fd9ded53
Instruction ID: 84b05eb17af0b7d90903a16a1581d32ff07ad0a34fe8f7f3996f71361618b804
Opcode Fuzzy Hash: 484fe6d3af0d5dc6871dec36b840eb3e68e87b5e3990c6fd490c08a6fd9ded53
Instruction Fuzzy Hash: D3A146775087C68FD3068F28894071AB7D2AF99B28F141B6DF9A1873E2E771C5C5CA81

Function 2264DB30 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

Po", xrefs: 2264DD3E, 2264DCC0, 2264DCC4, 2264DD42

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: Po"
API String ID: 0-2824535129
Opcode ID: b942b408d651a42a16b67b602f4250532d4d232e72a5ba338d7a6af9461f9e28
Instruction ID: 44ff8549bf08c0a3ff35832d34f637aa003c89e529f146ee9916383975a0f165
Opcode Fuzzy Hash: b942b408d651a42a16b67b602f4250532d4d232e72a5ba338d7a6af9461f9e28
Instruction Fuzzy Hash: 5F91E4B3D083449BC721CF64C984B9B7BE9AF8A314F04096DF9C99B282EB35D545C792

Function 227A7300 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 242COMMON

Download Yara Rule

Strings

-, xrefs: 227A7538
%!.15g, xrefs: 227A75C3

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %!.15g$-
API String ID: 0-583212262
Opcode ID: a0d3f94c168709613224cf095e99fa4ca7f2adfc325c57368e01feba3a7b66b4
Instruction ID: f0c0dcccb817508bb65be0c363295a1e1b08482000a48695334cb78eef3e718c
Opcode Fuzzy Hash: a0d3f94c168709613224cf095e99fa4ca7f2adfc325c57368e01feba3a7b66b4
Instruction Fuzzy Hash: 1D917C71A083458FD304DF6DD9A179AFBE0EBC8314F444A2DE588CB351E7B9D9098B92

Function 2266CBF0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

string or blob too big, xrefs: 2266CE39

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: string or blob too big
API String ID: 0-2803948771
Opcode ID: 5a5381ab6d48cd92210170ce6b0daaa03be06034c224635754a9ec9ec4ddcc8c
Instruction ID: d91606c2c39483e46e942669eab60e25bb59b9cd5825f5cb6ae70ead0e42a4b5
Opcode Fuzzy Hash: 5a5381ab6d48cd92210170ce6b0daaa03be06034c224635754a9ec9ec4ddcc8c
Instruction Fuzzy Hash: 0581F2B3A08B058FC304CF18C989B77B7E7AF94314F444A58FA44972A2E379E955C792

Function 227478F0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 214COMMON

Download Yara Rule

Strings

?, xrefs: 2274794A
*, xrefs: 22747982

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: *$?
API String ID: 0-2367018687
Opcode ID: e7c0f212a7f3695b966d1e4064a8255824d5006b3f5c4d46c114681b03237c42
Instruction ID: b2689cf27929984c8e0df212274a3deb2407704a0652140ddb22dd0b0e9f9ffe
Opcode Fuzzy Hash: e7c0f212a7f3695b966d1e4064a8255824d5006b3f5c4d46c114681b03237c42
Instruction Fuzzy Hash: 6A71E1B0E0C3418FD3118F28CD8476BBBF6AB89204F44596EE98587306DB75DA45CB96

Function 2263C8E0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 206COMMON

Download Yara Rule

Strings

LIKE or GLOB pattern too complex, xrefs: 2263C94F
ESCAPE expression must be a single character, xrefs: 2263CA43

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 0-264706735
Opcode ID: ffa9e3a6f550f89eb1a71db53c36527bb8fc3c1f8b98d5f646eb3048e2e718ad
Instruction ID: 33e062b52b49c90f66c562f26c18128ce25cd2c8e1098bf5967e8968e74a852c
Opcode Fuzzy Hash: ffa9e3a6f550f89eb1a71db53c36527bb8fc3c1f8b98d5f646eb3048e2e718ad
Instruction Fuzzy Hash: 72618673A083548FDB0BCB24CD91B6677E3AB41B28F244288F8959B2D3D636C6C5C391

Function 2263D0F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

string or blob too big, xrefs: 2263D213

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: string or blob too big
API String ID: 0-2803948771
Opcode ID: 587930c4b651a470d4af173eec235bcd515595956445b466b49f5d64ddb0480c
Instruction ID: c016f5acd7aab056aa68b5350024fc146b3fe1749ef681066fdb0e595e19ef9f
Opcode Fuzzy Hash: 587930c4b651a470d4af173eec235bcd515595956445b466b49f5d64ddb0480c
Instruction Fuzzy Hash: 00417C739083418FE3128A389C8179B7B96AF65720F044A3CFDA5533D3E666D648C393

Function 226355D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 226356D1
winDelete, xrefs: 2263569C

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: delayed %dms for lock/sharing conflict at line %d$winDelete
API String ID: 0-1405699761
Opcode ID: ee081179571b1f51d6de0bce932d83c3fa76932071954d87d932105c73ec5170
Instruction ID: eed44443fed811c5c03dae16a5adcf835f7ea415f42e62c5284a2b29407a0cf5
Opcode Fuzzy Hash: ee081179571b1f51d6de0bce932d83c3fa76932071954d87d932105c73ec5170
Instruction Fuzzy Hash: 05316C736803108BE7112B389F889767758E74A6A5F111E72EE17C32EED669C844CBD3

Function 2263D300 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

string or blob too big, xrefs: 2263D3D5

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: string or blob too big
API String ID: 0-2803948771
Opcode ID: 45cb00c7e858a7545d5726921d54fe0bf76c3ee59717089d2bb258ff0090125b
Instruction ID: 0c96af6e17da2fcd4d504917176cd24f64f566470d930cdbfa1a7797eeffaffb
Opcode Fuzzy Hash: 45cb00c7e858a7545d5726921d54fe0bf76c3ee59717089d2bb258ff0090125b
Instruction Fuzzy Hash: 13319BB3A483245BF7164A249D40B66375A9B93738F1803A8FD54BB3C2D26BDD16C3E1

Function 2271DEE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87COMMON

Download Yara Rule

Strings

SELECT tbl,idx,stat FROM %Q.sqlite_stat1, xrefs: 2271DF4F
sqlite_stat1, xrefs: 2271DF30

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: SELECT tbl,idx,stat FROM %Q.sqlite_stat1$sqlite_stat1
API String ID: 0-3572622772
Opcode ID: 0e740a6371eb45b123a02975653d0dd57eec0bd970ffe16fc5c4eadd55a0a64e
Instruction ID: 9361fd877dd946b3fe06d0da3d4534d2672793632de06bac00a40d6992b4f3e3
Opcode Fuzzy Hash: 0e740a6371eb45b123a02975653d0dd57eec0bd970ffe16fc5c4eadd55a0a64e
Instruction Fuzzy Hash: B721D371A093115FDB15DE29DC80F2AB7B8AF92724F05426CFC54AB252E320EE15CB91

Function 227B7E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

OsError 0x%lx (%lu), xrefs: 227B7ED9

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: OsError 0x%lx (%lu)
API String ID: 0-3720535092
Opcode ID: 9a3daaa51745324c585528b6c720068ad812d1959e80fc8e67cd28d32d516677
Instruction ID: 38087ef105fd5f412b1bbf6fa532a68987531957f75a8bc4d2dac1d348b92637
Opcode Fuzzy Hash: 9a3daaa51745324c585528b6c720068ad812d1959e80fc8e67cd28d32d516677
Instruction Fuzzy Hash: 92210432648301AFE7009B64DD09FAB37A4EF00349F000964FE0AD51D8DB79D914DB93

Function 2264F740 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

DROP TABLE '%q'.'%q_node';DROP TABLE '%q'.'%q_rowid';DROP TABLE '%q'.'%q_parent';, xrefs: 2264F752

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: DROP TABLE '%q'.'%q_node';DROP TABLE '%q'.'%q_rowid';DROP TABLE '%q'.'%q_parent';
API String ID: 0-2071071404
Opcode ID: 9e5e79871d49a78c7a55ef2da9e303fb4be1eef5bee456ddfba09cf07d59cf50
Instruction ID: f207f655409a6bd65fc4178129d5f07be5aa8563baf49405b4aac2ffd4178f03
Opcode Fuzzy Hash: 9e5e79871d49a78c7a55ef2da9e303fb4be1eef5bee456ddfba09cf07d59cf50
Instruction Fuzzy Hash: AD119472A40300AFE3109B29ED88F7773ACEB44245F440529FD46D2289EF68E955CB67

Function 2262141F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

InitializeCriticalSectionEx, xrefs: 22800E84
GetXStateFeaturesMask, xrefs: 22800E34

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: GetXStateFeaturesMask$InitializeCriticalSectionEx
API String ID: 0-4196971266
Opcode ID: bcfd95de9fefe990d0121839f33471c7b53f02f1f68e1931eb66a8f031e4e36c
Instruction ID: eb3a391b6c4c4efbcdf298b6c183e2fe1633a8985d1c70060ebcdead590b6ff4
Opcode Fuzzy Hash: bcfd95de9fefe990d0121839f33471c7b53f02f1f68e1931eb66a8f031e4e36c
Instruction Fuzzy Hash: 4B018F3AA4032CF7DB212A958C09E9A3F16EB507A2F014421FE1D69358DA76CA70DAD1

Function 22655350 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

F, xrefs: 2265539B

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-1304234792
Opcode ID: b777acb5220240ea1055e2e6e8b7c57b8b2b57a59b1ec1427caf07939a724392
Instruction ID: 3bcc4a1a9c83f561f42948e53f7c206e80c0046b5c51144fbab6bb29c8180ae5
Opcode Fuzzy Hash: b777acb5220240ea1055e2e6e8b7c57b8b2b57a59b1ec1427caf07939a724392
Instruction Fuzzy Hash: 78116DB66083408BC704CF29C41575FBBE4AFE8318F84492EE88A97290E778D508CB97

Function 2267EFE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

SELECT %s WHERE rowid = ?, xrefs: 2267F017

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: SELECT %s WHERE rowid = ?
API String ID: 0-866778640
Opcode ID: 4bc1471251e9292aacff6783cbccb8b39480a177d0af86bcbb6ea46f4f617335
Instruction ID: eb8a106cfd3a4d266e588e939f856f8425f738e3ab5b77f01787b4b174615536
Opcode Fuzzy Hash: 4bc1471251e9292aacff6783cbccb8b39480a177d0af86bcbb6ea46f4f617335
Instruction Fuzzy Hash: 281125322007499FD7208F9AEC80F96F7A4EF50331F10852EF55996640EB72B4518BA0

Function 22657200 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

Strings

invalid, xrefs: 2265721B
API call with %s database connection pointer, xrefs: 22657220

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: API call with %s database connection pointer$invalid
API String ID: 0-3574585026
Opcode ID: 1244f32963ac2c3df38f4067ec6c62da0f5d789c165305d692263ef79f8394a4
Instruction ID: aa0d381013f49a34141ab9b407344a9ca939e5d4fcd988950aa0e3bb5ba3b8e1
Opcode Fuzzy Hash: 1244f32963ac2c3df38f4067ec6c62da0f5d789c165305d692263ef79f8394a4
Instruction Fuzzy Hash: D1F0F672B05B104BD6314728AD54BE777DA6F50325F000A95F795D23D4C225E464C6D2

Function 226385B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

CREATE TABLE x(sql,ncol,ro,busy,nscan,nsort,naidx,nstep,reprep,run,mem), xrefs: 226385B6

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: CREATE TABLE x(sql,ncol,ro,busy,nscan,nsort,naidx,nstep,reprep,run,mem)
API String ID: 0-3640693396
Opcode ID: 4250b7a839be34dcdee4e7a369a967415313ff6f1a98983a314ef2a49032691c
Instruction ID: 83a15b849cac1f8d0940af966218b59bf14b332649220be42a0e521135b46be8
Opcode Fuzzy Hash: 4250b7a839be34dcdee4e7a369a967415313ff6f1a98983a314ef2a49032691c
Instruction Fuzzy Hash: 61F0B433A047118BD2425B1DF900BCAF3D59FE1735F454166F844DB250EBB4EA828BD1

Function 2262B224 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11COMMON

Download Yara Rule

Strings

%s at line %d of [%.10s], xrefs: 2262B238
misuse, xrefs: 2262B233

Memory Dump Source

Source File: 00000001.00000002.2895768055.0000000022628000.00000020.00001000.00020000.00000000.sdmp, Offset: 22620000, based on PE: true

Associated: 00000001.00000002.2895752808.0000000022620000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022621000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.0000000022786000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2895768055.000000002282D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.000000002282F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897105578.0000000022838000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897246509.0000000022862000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2897278202.000000002286F000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_22620000_kat99F5.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$misuse
API String ID: 0-2530468415
Opcode ID: 92e571aeae21cb41b07c9baad252fc91bf0ac89375f2f24a8abcb36427fb552e
Instruction ID: 67770d93ca0f9803ffcd1ac4dd871500282e7c234cc29f4a9c6457d8cca4b5b7
Opcode Fuzzy Hash: 92e571aeae21cb41b07c9baad252fc91bf0ac89375f2f24a8abcb36427fb552e
Instruction Fuzzy Hash: FDC02222A0430CE3C708AA58A885CCB37208FA4B44F80C220E3281868A9610C028C242

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report M9dfZzH3qn.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\KEBKJDBAAKJD\CBFCBK

C:\ProgramData\KEBKJDBAAKJD\DBFBFB

C:\ProgramData\KEBKJDBAAKJD\DGHIDA

C:\ProgramData\KEBKJDBAAKJD\DGHJEH

C:\ProgramData\KEBKJDBAAKJD\GIIIIJ

C:\ProgramData\KEBKJDBAAKJD\IDBAFH

C:\ProgramData\KEBKJDBAAKJD\KEBKJD

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll

C:\Users\user\AppData\Local\Temp\kat99F5.tmp

Static File Info

General

File Icon

Windows Analysis Report
M9dfZzH3qn.exe

Function 02B5BEF0 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 317
threadmemoryfileCOMMON

Function 02B5B250 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191
filenativeCOMMON

Function 02B5B510 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115
COMMON

Function 02B5B9B0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 46
memoryCOMMON

Function 02B5C510 Relevance: .1, Instructions: 92
COMMON

Function 22634CF0 Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 461
fileCOMMON

Function 2262FD40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 134
fileCOMMON

Function 226504D0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15
COMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre