Edit tour

Windows Analysis Report
S8co1ACRdn.exe

Overview

General Information

Sample name:	S8co1ACRdn.exe renamed because original name is a hash value
Original sample name:	6a605bfcf8816ab1a6e21238fcb55747.exe
Analysis ID:	1464579
MD5:	6a605bfcf8816ab1a6e21238fcb55747
SHA1:	3e3a35e578c8a3faf88abe8fd7791ecc4bca538d
SHA256:	07be352dde09851de71ce7c763537e2b5c567e52fd161304cbaa54895dcd5c8f
Tags:	32exetrojan
Infos:

Detection

CryptOne, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Multi AV Scanner detection for submitted file

Yara detected CryptOne packer

Yara detected Powershell download and execute

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Sample uses process hollowing technique

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

S8co1ACRdn.exe (PID: 5812 cmdline: "C:\Users\user\Desktop\S8co1ACRdn.exe" MD5: 6A605BFCF8816AB1A6E21238FCB55747)

katAE61.tmp (PID: 2568 cmdline: C:\Users\user\AppData\Local\Temp\katAE61.tmp MD5: 66064DBDB70A5EB15EBF3BF65ABA254B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199707802586", "https://t.me/g067n"], "Botnet": "f5b5622f4f4fc7235c0e9e6367cafc13"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2027781260.00000000023C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2028089019.0000000002CBB000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Crypt	Yara detected CryptOne packer	Joe Security
00000000.00000002.2028621267.0000000004200000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2028089019.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2028089019.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: S8co1ACRdn.exe PID: 5812	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: S8co1ACRdn.exe PID: 5812	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: S8co1ACRdn.exe PID: 5812	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: katAE61.tmp PID: 2568	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: katAE61.tmp PID: 2568	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.S8co1ACRdn.exe.4200000.4.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.S8co1ACRdn.exe.4200000.4.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.S8co1ACRdn.exe.23c0000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.S8co1ACRdn.exe.2c87719.3.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.S8co1ACRdn.exe.23c0000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Click to see the 1 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199707802586	Avira URL Cloud: Label: malware
Source: https://t.me/g067n	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.2027781260.00000000023C0000.00000040.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199707802586", "https://t.me/g067n"], "Botnet": "f5b5622f4f4fc7235c0e9e6367cafc13"}

Multi AV Scanner detection for submitted file

Source: S8co1ACRdn.exe

Virustotal: Detection: 35%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for sample

Source: S8co1ACRdn.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetProcAddress
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: LoadLibraryA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: lstrcatA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: OpenEventA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: CreateEventA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: CloseHandle
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Sleep
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: VirtualFree
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetSystemInfo
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: VirtualAlloc
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: HeapAlloc
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetComputerNameA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: lstrcpyA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetProcessHeap
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetCurrentProcess
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: lstrlenA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: ExitProcess
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetSystemTime
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: advapi32.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: gdi32.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: user32.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: crypt32.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: ntdll.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetUserNameA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: CreateDCA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetDeviceCaps
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: ReleaseDC
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: sscanf
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: NtQueryInformationProcess
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: VMwareVMware
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: HAL9TH
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: JohnDoe
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: DISPLAY
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetFileAttributesA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GlobalLock
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: HeapFree
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetFileSize
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GlobalSize
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: IsWow64Process
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Process32Next
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetLocalTime
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: FreeLibrary
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Process32First
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: DeleteFileA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: FindNextFileA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: LocalFree
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: FindClose
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: LocalAlloc
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetFileSizeEx
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: ReadFile
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: SetFilePointer
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: WriteFile
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: CreateFileA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: FindFirstFileA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: CopyFileA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: VirtualProtect
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetLastError
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: lstrcpynA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GlobalFree
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GlobalAlloc
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: OpenProcess
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: TerminateProcess
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: gdiplus.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: ole32.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: bcrypt.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: wininet.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: shlwapi.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: shell32.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: psapi.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: SelectObject
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: BitBlt
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: DeleteObject
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GdiplusStartup
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GdiplusShutdown
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GdipDisposeImage
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GdipFree
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: CoUninitialize
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: CoInitialize
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: CoCreateInstance
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: BCryptDecrypt
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: BCryptSetProperty
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetWindowRect
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetDesktopWindow
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetDC
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: CloseWindow
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: wsprintfA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: CharToOemW
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: wsprintfW
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: RegQueryValueExA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: RegCloseKey
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: RegEnumValueA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: CryptUnprotectData
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: ShellExecuteExA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: InternetConnectA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: InternetCloseHandle
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: InternetOpenA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: HttpSendRequestA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: InternetReadFile
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: StrCmpCA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: StrStrA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: StrCmpCW
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: PathMatchSpecA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: RmStartSession
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: RmRegisterResources
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: RmGetList
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: RmEndSession
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: sqlite3_open
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: sqlite3_step
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: sqlite3_column_text
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: sqlite3_finalize
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: sqlite3_close
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: encrypted_key
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: PATH
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: NSS_Init
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: NSS_Shutdown
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: PK11_Authenticate
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: C:\ProgramData\
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Soft:
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: profile:
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Host:
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Login:
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Password:
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Opera
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: OperaGX
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Network
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Cookies
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: .txt
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: TRUE
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: FALSE
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Autofill
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: History
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Name:
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Month:
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Year:
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Card:
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Cookies
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Login Data
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Web Data
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: History
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: logins.json
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: formSubmitURL
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: usernameField
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: encryptedUsername
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: encryptedPassword
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: guid
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: cookies.sqlite
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: formhistory.sqlite
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: places.sqlite
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Plugins
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Local Extension Settings
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Sync Extension Settings
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: IndexedDB
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Opera Stable
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Opera GX Stable
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: CURRENT
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: chrome-extension_
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Local State
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: profiles.ini
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: chrome
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: opera
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: firefox
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Wallets
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: ProductName
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: ProcessorNameString
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: DisplayName
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: DisplayVersion
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: freebl3.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: mozglue.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: msvcp140.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: nss3.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: softokn3.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: vcruntime140.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: \Temp\
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: .exe
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: runas
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: open
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: /c start
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: %DESKTOP%
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: %APPDATA%
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: %USERPROFILE%
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: %RECENT%
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: *.lnk
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Files
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: \discord\
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: key_datas
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: map*
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Telegram
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: *.tox
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: *.ini
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Password
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: 00000001
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: 00000002
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: 00000003
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: 00000004
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Pidgin
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: \.purple\
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: accounts.xml
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: token:
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: SteamPath
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: \config\
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: ssfn*
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: config.vdf
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: loginusers.vdf
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: \Steam\
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: sqlite3.dll
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: browsers
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: done
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Soft
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: https
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: POST
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: HTTP/1.1
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: hwid
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: build
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: token
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: file_name
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: file
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: message
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack	String decryptor: screenshot.jpg

Source: S8co1ACRdn.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown

HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49705 version: TLS 1.2

Source:

Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr

Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199707802586
Source: Malware configuration extractor	URLs: https://t.me/g067n

Source: global traffic

TCP traffic: 192.168.2.5:49706 -> 195.201.251.214:9000

Source: global traffic

HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Source: Joe Sandbox View

ASN Name: TELEGRAMRU TELEGRAMRU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214

Source: global traffic

HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: t.me

Source: katAE61.tmp, 00000002.00000003.2086185950.00000000008C3000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2085986701.00000000008C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windows
Source: katAE61.tmp, 00000002.00000003.2086185950.00000000008C3000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2085986701.00000000008C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsC
Source: katAE61.tmp, 00000002.00000003.2085268359.00000000008BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: katAE61.tmp, 00000002.00000003.2086185950.00000000008C3000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2085268359.00000000008BC000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2085986701.00000000008C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/A
Source: katAE61.tmp, 00000002.00000003.2086185950.00000000008C3000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2085268359.00000000008BC000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2085986701.00000000008C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/E
Source: katAE61.tmp, 00000002.00000002.3275958131.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: katAE61.tmp, 00000002.00000003.2226729619.000000000082D000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.000000000082C000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2230396036.000000000082C000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3276341113.000000000082D000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2223471284.000000000082A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab-
Source: S8co1ACRdn.exe, 00000000.00000002.2028089019.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000000.2026581948.00000000004B4000.00000002.00000001.01000000.00000004.sdmp, katAE61.tmp.0.dr	String found in binary or memory: http://rpi.net.au/~ajohnson/resourcehacker
Source: S8co1ACRdn.exe	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types
Source: S8co1ACRdn.exe, 00000000.00000002.2027655481.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/_non
Source: S8co1ACRdn.exe, 00000000.00000002.2027655481.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Types
Source: S8co1ACRdn.exe, 00000000.00000002.2027655481.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/TypesX8
Source: S8co1ACRdn.exe, 00000000.00000002.2027655481.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesc0da53
Source: S8co1ACRdn.exe, 00000000.00000002.2027655481.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesm
Source: S8co1ACRdn.exe, 00000000.00000002.2027655481.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesmmon-c
Source: katAE61.tmp, 00000002.00000003.2067033169.000000000080F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.cO
Source: katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: katAE61.tmp, 00000002.00000003.2355518326.0000000000834000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2223471284.0000000000833000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2226729619.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214/
Source: katAE61.tmp, 00000002.00000003.2223471284.0000000000833000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214/$)l
Source: katAE61.tmp, 00000002.00000002.3274621904.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000
Source: katAE61.tmp, 00000002.00000003.2198311850.000000000088A000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355392839.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2226729619.0000000000889000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3276341113.000000000088B000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2199439660.00000000008AC000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2199882169.000000000088B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/
Source: katAE61.tmp, 00000002.00000003.2198311850.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/$
Source: katAE61.tmp, 00000002.00000003.2355392839.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/0
Source: katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/40rosoft
Source: katAE61.tmp, 00000002.00000003.2355518326.000000000088B000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3276341113.000000000088B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/9T
Source: katAE61.tmp, 00000002.00000003.2229881928.00000000008D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/:900014:9000/freebl3.dll
Source: katAE61.tmp, 00000002.00000002.3276644612.00000000008D6000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355392839.00000000008D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/Mac
Source: katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/Microsoft
Source: katAE61.tmp, 00000002.00000003.2198311850.000000000088A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/TT
Source: katAE61.tmp, 00000002.00000003.2230396036.000000000081C000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.0000000000823000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3276231993.0000000000824000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2230396036.000000000088A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/X/
Source: katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3275958131.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/c
Source: katAE61.tmp, 00000002.00000003.2211467190.000000000088B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/d
Source: katAE61.tmp, 00000002.00000003.2229881928.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/date_1
Source: katAE61.tmp, 00000002.00000003.2230396036.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3276341113.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2229881928.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dll
Source: katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dlldge
Source: katAE61.tmp, 00000002.00000003.2229881928.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dlle
Source: katAE61.tmp, 00000002.00000003.2229881928.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllffsets
Source: katAE61.tmp, 00000002.00000003.2230396036.0000000000842000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dlllt
Source: katAE61.tmp, 00000002.00000003.2355518326.000000000088B000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3276341113.000000000088B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/l
Source: katAE61.tmp, 00000002.00000002.3276341113.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dll
Source: katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dll.15;
Source: katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dlldge
Source: katAE61.tmp, 00000002.00000002.3276341113.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.0000000000842000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dllw
Source: katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/msvcp140.dll
Source: katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/msvcp140.dllge
Source: katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/nss3.dll
Source: katAE61.tmp, 00000002.00000002.3275958131.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/nss3.dll8
Source: katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/nss3.dllt
Source: katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3275958131.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/q
Source: katAE61.tmp, 00000002.00000002.3276341113.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.0000000000823000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/softokn3.dll
Source: katAE61.tmp, 00000002.00000002.3276341113.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.0000000000842000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/softokn3.dll7
Source: katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/softokn3.dllge
Source: katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3275958131.00000000007D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/softokn3.dllo
Source: katAE61.tmp, 00000002.00000003.2230396036.000000000085F000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.000000000085F000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3276341113.0000000000863000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2226729619.0000000000862000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2223471284.000000000085C000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3275958131.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3275787684.000000000078E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/sqlt.dll
Source: katAE61.tmp, 00000002.00000002.3275958131.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3276644612.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355392839.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355392839.00000000008AC000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dll
Source: katAE61.tmp, 00000002.00000003.2355392839.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dll_
Source: katAE61.tmp, 00000002.00000002.3274621904.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dllrv:129.0)
Source: katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dllser
Source: katAE61.tmp, 00000002.00000002.3274621904.0000000000539000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000040gle
Source: katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000ng
Source: katAE61.tmp, 00000002.00000002.3274621904.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000ontent-Disposition:
Source: HDGIEB.2.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: HDGIEB.2.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: HDGIEB.2.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: HDGIEB.2.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: HDGIEB.2.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: HDGIEB.2.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: HDGIEB.2.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: S8co1ACRdn.exe, 00000000.00000002.2027781260.00000000023C0000.00000040.00001000.00020000.00000000.sdmp, S8co1ACRdn.exe, 00000000.00000002.2028621267.0000000004200000.00000004.00001000.00020000.00000000.sdmp, S8co1ACRdn.exe, 00000000.00000002.2028089019.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.0000000000425000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586
Source: S8co1ACRdn.exe, 00000000.00000002.2027781260.00000000023C0000.00000040.00001000.00020000.00000000.sdmp, S8co1ACRdn.exe, 00000000.00000002.2028621267.0000000004200000.00000004.00001000.00020000.00000000.sdmp, S8co1ACRdn.exe, 00000000.00000002.2028089019.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.0000000000425000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll
Source: katAE61.tmp, 00000002.00000002.3275787684.000000000078E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: katAE61.tmp, 00000002.00000002.3275787684.000000000078E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/K3b
Source: S8co1ACRdn.exe, 00000000.00000002.2027781260.00000000023C0000.00000040.00001000.00020000.00000000.sdmp, S8co1ACRdn.exe, 00000000.00000002.2028621267.0000000004200000.00000004.00001000.00020000.00000000.sdmp, S8co1ACRdn.exe, 00000000.00000002.2028089019.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.0000000000425000.00000040.00000400.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2067033169.0000000000800000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2067033169.000000000080F000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2230396036.0000000000801000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g067n
Source: katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g067nI
Source: S8co1ACRdn.exe, 00000000.00000002.2027781260.00000000023C0000.00000040.00001000.00020000.00000000.sdmp, S8co1ACRdn.exe, 00000000.00000002.2028621267.0000000004200000.00000004.00001000.00020000.00000000.sdmp, S8co1ACRdn.exe, 00000000.00000002.2028089019.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.0000000000425000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g067nry1neMozilla/5.0
Source: katAE61.tmp, 00000002.00000003.2067033169.000000000080F000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2230396036.0000000000801000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: HDGIEB.2.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: HDGIEB.2.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: unknown

HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49705 version: TLS 1.2

Source: Yara match	File source: 00000000.00000002.2028089019.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: S8co1ACRdn.exe PID: 5812, type: MEMORYSTR

Source: C:\Users\user\Desktop\S8co1ACRdn.exe	Code function: 0_2_02CBB250 NtCreateFile,CreateFileMappingA,MapViewOfFile,FindCloseChangeNotification,	0_2_02CBB250
Source: C:\Users\user\Desktop\S8co1ACRdn.exe	Code function: 0_2_02CBBEF0 NtAllocateVirtualMemory,GetTempFileNameA,CreateFileA,WriteFile,CreateProcessA,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64GetThreadContext,Wow64SetThreadContext,ResumeThread,ExitProcess,	0_2_02CBBEF0
Source: C:\Users\user\Desktop\S8co1ACRdn.exe	Code function: 0_2_02CBB510 NtProtectVirtualMemory,NtProtectVirtualMemory,	0_2_02CBB510

Source: C:\Users\user\Desktop\S8co1ACRdn.exe	Code function: 0_2_02CBC510	0_2_02CBC510
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227B4CF0	2_2_227B4CF0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227A209F	2_2_227A209F
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_2282A0B0	2_2_2282A0B0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227B66C0	2_2_227B66C0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227A47AF	2_2_227A47AF
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_2289A590	2_2_2289A590
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227CA560	2_2_227CA560
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227AAA40	2_2_227AAA40
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227AEA80	2_2_227AEA80
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227A481D	2_2_227A481D
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_228DE800	2_2_228DE800
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227A3E3B	2_2_227A3E3B
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_228869C0	2_2_228869C0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_228BA900	2_2_228BA900
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_2289A940	2_2_2289A940
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_2297AEBE	2_2_2297AEBE
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_22802EE0	2_2_22802EE0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227E6E80	2_2_227E6E80
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227A19DD	2_2_227A19DD
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227D3370	2_2_227D3370
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227AF160	2_2_227AF160
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227A174E	2_2_227A174E
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227CBAB0	2_2_227CBAB0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227D7810	2_2_227D7810
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227A251D	2_2_227A251D
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227A290A	2_2_227A290A
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227A3AB2	2_2_227A3AB2
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_22820090	2_2_22820090
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_228C8030	2_2_228C8030
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_22828120	2_2_22828120
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227C8680	2_2_227C8680
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227C8763	2_2_227C8763
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_22804760	2_2_22804760
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_22838760	2_2_22838760
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_228E0480	2_2_228E0480
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_228A4A60	2_2_228A4A60
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227AC800	2_2_227AC800
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227A1EF1	2_2_227A1EF1
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227DCE10	2_2_227DCE10
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227C8D2A	2_2_227C8D2A
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_2297D209	2_2_2297D209
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227A3580	2_2_227A3580
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_228353B0	2_2_228353B0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227B9000	2_2_227B9000
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_228C5040	2_2_228C5040
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_22849690	2_2_22849690
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_2285D6D0	2_2_2285D6D0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_22909430	2_2_22909430
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227AD4C0	2_2_227AD4C0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_228C9A20	2_2_228C9A20
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227A2018	2_2_227A2018
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227A1C9E	2_2_227A1C9E
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_22855940	2_2_22855940
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227A2AA9	2_2_227A2AA9
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227A12A8	2_2_227A12A8
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227D1C50	2_2_227D1C50
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_22909CC0	2_2_22909CC0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227A292D	2_2_227A292D

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\katAE61.tmp 6A94DBDA2DD1EDCFF2331061D65E1BAF09D4861CC7BA590C5EC754F3AC96A795

Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: String function: 227A1C2B appears 47 times
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: String function: 227A415B appears 173 times
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: String function: 227A1F5A appears 36 times
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: String function: 227A395E appears 81 times
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: String function: 227A3AF3 appears 37 times
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: String function: 229806B1 appears 36 times

Source: S8co1ACRdn.exe, 00000000.00000002.2028089019.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameResHack! vs S8co1ACRdn.exe

Source: S8co1ACRdn.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/12@1/2

Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\JPD9URQO.htm

Jump to behavior

Source: C:\Users\user\Desktop\S8co1ACRdn.exe

File created: C:\Users\user\AppData\Local\Temp\katAE61.tmp

Jump to behavior

Source: C:\Users\user\Desktop\S8co1ACRdn.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: C:\Users\user\Desktop\S8co1ACRdn.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: katAE61.tmp, katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: katAE61.tmp, katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: katAE61.tmp, 00000002.00000003.2223994933.0000000000907000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2226457928.0000000000907000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2211467190.0000000000873000.00000004.00000020.00020000.00000000.sdmp, GCBKEC.2.dr, GHCAAA.2.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: katAE61.tmp, katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: S8co1ACRdn.exe

Virustotal: Detection: 35%

Source: unknown	Process created: C:\Users\user\Desktop\S8co1ACRdn.exe "C:\Users\user\Desktop\S8co1ACRdn.exe"
Source: C:\Users\user\Desktop\S8co1ACRdn.exe	Process created: C:\Users\user\AppData\Local\Temp\katAE61.tmp C:\Users\user\AppData\Local\Temp\katAE61.tmp
Source: C:\Users\user\Desktop\S8co1ACRdn.exe	Process created: C:\Users\user\AppData\Local\Temp\katAE61.tmp C:\Users\user\AppData\Local\Temp\katAE61.tmp	Jump to behavior

Source: C:\Users\user\Desktop\S8co1ACRdn.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\S8co1ACRdn.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\S8co1ACRdn.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\S8co1ACRdn.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\S8co1ACRdn.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: S8co1ACRdn.exe

Static file information: File size 2288128 > 1048576

Source: S8co1ACRdn.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x127800

Source:

Source: sqlt[1].dll.2.dr

Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\S8co1ACRdn.exe	Code function: 0_2_02CBCA10 push edx; ret	0_2_02CBCC1F
Source: C:\Users\user\Desktop\S8co1ACRdn.exe	Code function: 0_2_02CBC310 push edx; ret	0_2_02CBC31B
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227A10C8 push ecx; ret	2_2_229A3552
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227A1BF9 push ecx; ret	2_2_22944C03

Source: C:\Users\user\Desktop\S8co1ACRdn.exe	File created: C:\Users\user\AppData\Local\Temp\katAE61.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqlt[1].dll			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: icon.png

Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqlt[1].dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp

API coverage: 0.8 %

Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: EBFBFB.2.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: EBFBFB.2.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: EBFBFB.2.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: EBFBFB.2.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: EBFBFB.2.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: EBFBFB.2.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: katAE61.tmp, 00000002.00000003.2355884366.00000000007BF000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355884366.00000000007F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: EBFBFB.2.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: EBFBFB.2.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: EBFBFB.2.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: EBFBFB.2.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: EBFBFB.2.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: EBFBFB.2.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: EBFBFB.2.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: EBFBFB.2.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: katAE61.tmp, 00000002.00000002.3275787684.000000000078E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware)
Source: EBFBFB.2.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: EBFBFB.2.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: EBFBFB.2.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: EBFBFB.2.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: EBFBFB.2.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: EBFBFB.2.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: EBFBFB.2.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: EBFBFB.2.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: EBFBFB.2.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: katAE61.tmp, 00000002.00000003.2355884366.00000000007F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWM
Source: EBFBFB.2.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: EBFBFB.2.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: EBFBFB.2.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: EBFBFB.2.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: katAE61.tmp, 00000002.00000002.3275787684.000000000078E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: EBFBFB.2.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: EBFBFB.2.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: EBFBFB.2.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: EBFBFB.2.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp

Code function: 2_2_227A2C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_227A2C8E

Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp

Code function: 2_2_227A46A6 GetProcessHeap,

2_2_227A46A6

Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227A42AF SetUnhandledExceptionFilter,		2_2_227A42AF
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227A2C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		2_2_227A2C8E

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: S8co1ACRdn.exe PID: 5812, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\S8co1ACRdn.exe

Memory allocated: C:\Users\user\AppData\Local\Temp\katAE61.tmp base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\S8co1ACRdn.exe

Code function: 0_2_02CBBEF0 NtAllocateVirtualMemory,GetTempFileNameA,CreateFileA,WriteFile,CreateProcessA,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64GetThreadContext,Wow64SetThreadContext,ResumeThread,ExitProcess,

0_2_02CBBEF0

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\S8co1ACRdn.exe

Memory written: C:\Users\user\AppData\Local\Temp\katAE61.tmp base: 400000 value starts with: 4D5A

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\S8co1ACRdn.exe

Section unmapped: C:\Users\user\AppData\Local\Temp\katAE61.tmp base address: 400000

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\S8co1ACRdn.exe	Memory written: C:\Users\user\AppData\Local\Temp\katAE61.tmp base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\S8co1ACRdn.exe	Memory written: C:\Users\user\AppData\Local\Temp\katAE61.tmp base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\S8co1ACRdn.exe	Memory written: C:\Users\user\AppData\Local\Temp\katAE61.tmp base: 425000	Jump to behavior
Source: C:\Users\user\Desktop\S8co1ACRdn.exe	Memory written: C:\Users\user\AppData\Local\Temp\katAE61.tmp base: 42E000	Jump to behavior
Source: C:\Users\user\Desktop\S8co1ACRdn.exe	Memory written: C:\Users\user\AppData\Local\Temp\katAE61.tmp base: 643000	Jump to behavior

Source: C:\Users\user\Desktop\S8co1ACRdn.exe

Process created: C:\Users\user\AppData\Local\Temp\katAE61.tmp C:\Users\user\AppData\Local\Temp\katAE61.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	2_2_227A298C
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: EnumSystemLocalesW,	2_2_2297FF17
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: GetLocaleInfoW,	2_2_227A2112
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: GetLocaleInfoW,	2_2_227A2112

Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp

Code function: 2_2_227A433C GetSystemTimeAsFileTime,

2_2_227A433C

Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp

Code function: 2_2_22984A46 GetTimeZoneInformation,

2_2_22984A46

Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: katAE61.tmp, 00000002.00000003.2223471284.0000000000850000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected CryptOne packer

Source: Yara match

File source: 00000000.00000002.2028089019.0000000002CBB000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.S8co1ACRdn.exe.4200000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.S8co1ACRdn.exe.4200000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.S8co1ACRdn.exe.23c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.S8co1ACRdn.exe.2c87719.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.S8co1ACRdn.exe.23c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2027781260.00000000023C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2028621267.0000000004200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2028089019.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: S8co1ACRdn.exe PID: 5812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: katAE61.tmp PID: 2568, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Source: Yara match

File source: Process Memory Space: katAE61.tmp PID: 2568, type: MEMORYSTR

Remote Access Functionality

Yara detected CryptOne packer

Source: Yara match

File source: 00000000.00000002.2028089019.0000000002CBB000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.S8co1ACRdn.exe.2c87719.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.S8co1ACRdn.exe.4200000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.S8co1ACRdn.exe.4200000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.S8co1ACRdn.exe.23c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.S8co1ACRdn.exe.2c87719.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.S8co1ACRdn.exe.23c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2027781260.00000000023C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2028621267.0000000004200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2028089019.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: S8co1ACRdn.exe PID: 5812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: katAE61.tmp PID: 2568, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_2280E200 sqlite3_initialize,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	2_2_2280E200
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_2280E090 sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	2_2_2280E090
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_2281E170 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_2281E170
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_2281A6F0 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,	2_2_2281A6F0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227B66C0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_bind_value,sqlite3_free,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	2_2_227B66C0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227FEF30 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,	2_2_227FEF30
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_228837E0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_228837E0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_22863770 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_22863770
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227CB400 sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,sqlite3_reset,sqlite3_step,sqlite3_reset,sqlite3_column_int64,	2_2_227CB400
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227D7810 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	2_2_227D7810
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_22818200 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,	2_2_22818200
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_22884140 sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_initialize,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	2_2_22884140
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227F06E0 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	2_2_227F06E0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227C8680 sqlite3_mprintf,sqlite3_mprintf,sqlite3_initialize,sqlite3_finalize,sqlite3_free,sqlite3_mprintf,sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_int64,	2_2_227C8680
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227D8430 sqlite3_bind_int64,	2_2_227D8430
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227F8550 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,	2_2_227F8550
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227B4820 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_initialize,	2_2_227B4820
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227D8970 sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	2_2_227D8970
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227D0FB0 sqlite3_result_int64,sqlite3_result_double,sqlite3_result_int,sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	2_2_227D0FB0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227D8CB0 sqlite3_bind_zeroblob,	2_2_227D8CB0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_22884D40 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	2_2_22884D40
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_2285D3B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_2285D3B0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_22839090 sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_errmsg,sqlite3_mprintf,	2_2_22839090
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_228451D0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_228451D0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_2287D610 sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_2287D610
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_228C14D0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	2_2_228C14D0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_228CD4F0 sqlite3_bind_value,sqlite3_log,sqlite3_log,sqlite3_log,	2_2_228CD4F0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_228455B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_228455B0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_2281DB10 sqlite3_initialize,sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	2_2_2281DB10
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_228CD9E0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	2_2_228CD9E0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_22845910 sqlite3_mprintf,sqlite3_bind_int64,	2_2_22845910
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_2281DFC0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_mprintf,sqlite3_bind_text,sqlite3_step,sqlite3_reset,	2_2_2281DFC0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_22821FE0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_22821FE0
Source: C:\Users\user\AppData\Local\Temp\katAE61.tmp	Code function: 2_2_227B5C70 sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	2_2_227B5C70

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	511 Process Injection	11 Masquerading	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Shared Modules	Boot or Logon Initialization Scripts	1 DLL Side-Loading	511 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	1 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	41 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
S8co1ACRdn.exe	36%	Virustotal		Browse
S8co1ACRdn.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqlt[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\katAE61.tmp	4%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
t.me	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://195.201.251.214:9000/vcruntime140.dllser	0%	Avira URL Cloud	safe
https://t.me/	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
https://195.201.251.214:9000/mozglue.dll	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/nss3.dll	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
https://web.telegram.org	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/	0%	Avira URL Cloud	safe
https://t.me/	0%	Virustotal		Browse
https://195.201.251.214:9000/X/	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/softokn3.dll7	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/nss3.dll	0%	Virustotal		Browse
https://web.telegram.org	0%	Virustotal		Browse
https://195.201.251.214:9000/mozglue.dll	0%	Virustotal		Browse
https://195.201.251.214:9000/l	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/msvcp140.dllge	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/	0%	Virustotal		Browse
https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll	0%	Virustotal		Browse
https://195.201.251.214:9000/Mac	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/freebl3.dlllt	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/9T	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types	0%	Virustotal		Browse
http://ctldl.windowsC	0%	Avira URL Cloud	safe
https://195.201.251.214:9000040gle	0%	Avira URL Cloud	safe
https://t.me/K3b	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/nss3.dll8	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/q	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/l	0%	Virustotal		Browse
https://195.201.251.214:9000/q	0%	Virustotal		Browse
http://ctldl.windows	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Typesm	0%	Virustotal		Browse
http://www.borland.com/namespaces/Typesm	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/freebl3.dlldge	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Types	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/$	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/soap/encoding/_non	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/freebl3.dllffsets	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/freebl3.dlle	0%	Avira URL Cloud	safe
http://www.microsoft.cO	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Types	0%	Virustotal		Browse
http://ctldl.windows	0%	Virustotal		Browse
https://195.201.251.214:9000/freebl3.dll	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/soap/encoding/_non	0%	Virustotal		Browse
https://195.201.251.214:9000ng	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/mozglue.dllw	0%	Avira URL Cloud	safe
http://www.microsoft.cO	1%	Virustotal		Browse
https://195.201.251.214:9000/softokn3.dll	0%	Avira URL Cloud	safe
https://t.me/g067nry1neMozilla/5.0	0%	Avira URL Cloud	safe
http://www.sqlite.org/copyright.html.	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/freebl3.dll	0%	Virustotal		Browse
https://195.201.251.214:9000/40rosoft	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/Microsoft	0%	Avira URL Cloud	safe
https://t.me/g067nry1neMozilla/5.0	0%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/msvcp140.dll	0%	Avira URL Cloud	safe
http://www.sqlite.org/copyright.html.	0%	Virustotal		Browse
https://195.201.251.214:9000/softokn3.dllge	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/:900014:9000/freebl3.dll	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/mozglue.dlldge	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://rpi.net.au/~ajohnson/resourcehacker	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/vcruntime140.dllrv:129.0)	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/softokn3.dllo	0%	Avira URL Cloud	safe
https://t.me/g067nI	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/TypesX8	0%	Avira URL Cloud	safe
https://195.201.251.214/$)l	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/nss3.dllt	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/softokn3.dll	0%	Virustotal		Browse
https://195.201.251.214:9000/TT	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/0	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/vcruntime140.dll	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199707802586	100%	Avira URL Cloud	malware
https://195.201.251.214:9000/date_1	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/d	0%	Avira URL Cloud	safe
https://t.me/g067n	100%	Avira URL Cloud	malware
https://195.201.251.214:9000/c	0%	Avira URL Cloud	safe
https://195.201.251.214/	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/mozglue.dll.15;	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Typesmmon-c	0%	Avira URL Cloud	safe
https://195.201.251.214:9000	0%	Avira URL Cloud	safe
http://www.borland.com/namespaces/Typesc0da53	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/vcruntime140.dll_	0%	Avira URL Cloud	safe
https://195.201.251.214:9000/sqlt.dll	0%	Avira URL Cloud	safe
https://195.201.251.214:9000ontent-Disposition:	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
t.me	149.154.167.99	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/profiles/76561199707802586	true	Avira URL Cloud: malware	unknown
https://t.me/g067n	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	HDGIEB.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t.me/	katAE61.tmp, 00000002.00000002.3275787684.000000000078E000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	HDGIEB.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/vcruntime140.dllser	katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types	S8co1ACRdn.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/mozglue.dll	katAE61.tmp, 00000002.00000002.3276341113.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/nss3.dll	katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://web.telegram.org	katAE61.tmp, 00000002.00000003.2067033169.000000000080F000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2230396036.0000000000801000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll	S8co1ACRdn.exe, 00000000.00000002.2027781260.00000000023C0000.00000040.00001000.00020000.00000000.sdmp, S8co1ACRdn.exe, 00000000.00000002.2028621267.0000000004200000.00000004.00001000.00020000.00000000.sdmp, S8co1ACRdn.exe, 00000000.00000002.2028089019.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.0000000000425000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/	katAE61.tmp, 00000002.00000003.2198311850.000000000088A000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355392839.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2226729619.0000000000889000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3276341113.000000000088B000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2199439660.00000000008AC000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2199882169.000000000088B000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/X/	katAE61.tmp, 00000002.00000003.2230396036.000000000081C000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.0000000000823000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3276231993.0000000000824000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2230396036.000000000088A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/softokn3.dll7	katAE61.tmp, 00000002.00000002.3276341113.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.0000000000842000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/l	katAE61.tmp, 00000002.00000003.2355518326.000000000088B000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3276341113.000000000088B000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/msvcp140.dllge	katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	HDGIEB.2.dr	false	URL Reputation: safe	unknown
https://195.201.251.214:9000/Mac	katAE61.tmp, 00000002.00000002.3276644612.00000000008D6000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355392839.00000000008D4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/freebl3.dlllt	katAE61.tmp, 00000002.00000003.2230396036.0000000000842000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/9T	katAE61.tmp, 00000002.00000003.2355518326.000000000088B000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3276341113.000000000088B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ctldl.windowsC	katAE61.tmp, 00000002.00000003.2086185950.00000000008C3000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2085986701.00000000008C3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000040gle	katAE61.tmp, 00000002.00000002.3274621904.0000000000539000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/K3b	katAE61.tmp, 00000002.00000002.3275787684.000000000078E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/nss3.dll8	katAE61.tmp, 00000002.00000002.3275958131.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/q	katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3275958131.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ctldl.windows	katAE61.tmp, 00000002.00000003.2086185950.00000000008C3000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2085986701.00000000008C3000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.borland.com/namespaces/Typesm	S8co1ACRdn.exe, 00000000.00000002.2027655481.000000000084E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.borland.com/namespaces/Types	S8co1ACRdn.exe, 00000000.00000002.2027655481.000000000084E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/freebl3.dlldge	katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/$	katAE61.tmp, 00000002.00000003.2198311850.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/_non	S8co1ACRdn.exe, 00000000.00000002.2027655481.000000000084E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/freebl3.dlle	katAE61.tmp, 00000002.00000003.2229881928.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	HDGIEB.2.dr	false	URL Reputation: safe	unknown
https://195.201.251.214:9000/freebl3.dllffsets	katAE61.tmp, 00000002.00000003.2229881928.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoft.cO	katAE61.tmp, 00000002.00000003.2067033169.000000000080F000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/freebl3.dll	katAE61.tmp, 00000002.00000003.2230396036.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3276341113.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2229881928.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/mozglue.dllw	katAE61.tmp, 00000002.00000002.3276341113.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.0000000000842000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000ng	katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/softokn3.dll	katAE61.tmp, 00000002.00000002.3276341113.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.0000000000842000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.0000000000823000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t.me/g067nry1neMozilla/5.0	S8co1ACRdn.exe, 00000000.00000002.2027781260.00000000023C0000.00000040.00001000.00020000.00000000.sdmp, S8co1ACRdn.exe, 00000000.00000002.2028621267.0000000004200000.00000004.00001000.00020000.00000000.sdmp, S8co1ACRdn.exe, 00000000.00000002.2028089019.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.0000000000425000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	katAE61.tmp, 00000002.00000002.3283720151.00000000296AD000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/40rosoft	katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/Microsoft	katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	HDGIEB.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/msvcp140.dll	katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/softokn3.dllge	katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/:900014:9000/freebl3.dll	katAE61.tmp, 00000002.00000003.2229881928.00000000008D4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/mozglue.dlldge	katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	HDGIEB.2.dr	false	Avira URL Cloud: safe	unknown
http://rpi.net.au/~ajohnson/resourcehacker	S8co1ACRdn.exe, 00000000.00000002.2028089019.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000000.2026581948.00000000004B4000.00000002.00000001.01000000.00000004.sdmp, katAE61.tmp.0.dr	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/vcruntime140.dllrv:129.0)	katAE61.tmp, 00000002.00000002.3274621904.0000000000445000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/softokn3.dllo	katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3275958131.00000000007D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	HDGIEB.2.dr	false	URL Reputation: safe	unknown
https://t.me/g067nI	katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.borland.com/namespaces/TypesX8	S8co1ACRdn.exe, 00000000.00000002.2027655481.000000000084E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214/$)l	katAE61.tmp, 00000002.00000003.2223471284.0000000000833000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/nss3.dllt	katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/TT	katAE61.tmp, 00000002.00000003.2198311850.000000000088A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/0	katAE61.tmp, 00000002.00000003.2355392839.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/vcruntime140.dll	katAE61.tmp, 00000002.00000002.3275958131.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3276644612.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355392839.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355392839.00000000008AC000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3274621904.0000000000445000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	HDGIEB.2.dr	false	URL Reputation: safe	unknown
https://195.201.251.214:9000/date_1	katAE61.tmp, 00000002.00000003.2229881928.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/d	katAE61.tmp, 00000002.00000003.2211467190.000000000088B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/c	katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3275958131.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214/	katAE61.tmp, 00000002.00000003.2355518326.0000000000834000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2223471284.0000000000833000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2226729619.0000000000834000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/mozglue.dll.15;	katAE61.tmp, 00000002.00000002.3274621904.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.borland.com/namespaces/Typesmmon-c	S8co1ACRdn.exe, 00000000.00000002.2027655481.000000000084E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000	katAE61.tmp, 00000002.00000002.3274621904.0000000000445000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.borland.com/namespaces/Typesc0da53	S8co1ACRdn.exe, 00000000.00000002.2027655481.000000000084E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000/vcruntime140.dll_	katAE61.tmp, 00000002.00000003.2355392839.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	HDGIEB.2.dr	false	URL Reputation: safe	unknown
https://195.201.251.214:9000/sqlt.dll	katAE61.tmp, 00000002.00000003.2230396036.000000000085F000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355518326.000000000085F000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3276341113.0000000000863000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2226729619.0000000000862000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2223471284.000000000085C000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000003.2355884366.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3275958131.00000000007EB000.00000004.00000020.00020000.00000000.sdmp, katAE61.tmp, 00000002.00000002.3275787684.000000000078E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://195.201.251.214:9000ontent-Disposition:	katAE61.tmp, 00000002.00000002.3274621904.0000000000445000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
195.201.251.214	unknown	Germany		24940	HETZNER-ASDE	false
149.154.167.99	t.me	United Kingdom		62041	TELEGRAMRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1464579
Start date and time:	2024-06-29 05:41:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	S8co1ACRdn.exe renamed because original name is a hash value
Original Sample Name:	6a605bfcf8816ab1a6e21238fcb55747.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/12@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 85% Number of executed functions: 7 Number of non-executed functions: 230
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.16.164.105, 2.16.164.72, 93.184.221.240
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu.azureedge.net, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ocsp.digicert.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, wu-b-net.trafficmanager.net
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
23:42:10	API Interceptor	1x Sleep call for process: katAE61.tmp modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
195.201.251.214	M9dfZzH3qn.exe	Get hash	malicious	CryptOne, Vidar	Browse
	5IRIk4f1PO.exe	Get hash	malicious	CryptOne, Vidar	Browse
	1719520929.094843_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse
	1Cvd8TyYPm.exe	Get hash	malicious	LummaC, Mars Stealer, PureLog Stealer, Stealc, Vidar, Xmrig, zgRAT	Browse
149.154.167.99	http://telegramtw1.org/	Get hash	malicious	Unknown	Browse	telegram.org/?setln=pl
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegram.dog	Get hash	malicious	Unknown	Browse	telegram.dog/
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot
	jtfCFDmLdX.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot
	vSlVoTPrmP.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot
	RO67OsrIWi.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot
	KeyboardRGB.exe	Get hash	malicious	Unknown	Browse	t.me/cinoshibot
	file.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	M9dfZzH3qn.exe	Get hash	malicious	CryptOne, Vidar	Browse	149.154.167.99
	5IRIk4f1PO.exe	Get hash	malicious	CryptOne, Vidar	Browse	149.154.167.99
	1719520929.094843_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse	149.154.167.99
	1Cvd8TyYPm.exe	Get hash	malicious	LummaC, Mars Stealer, PureLog Stealer, Stealc, Vidar, Xmrig, zgRAT	Browse	149.154.167.99
	project.exe	Get hash	malicious	RedLine	Browse	149.154.167.99
	WR0fuHnEVW.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	BRWgvKaqbg.exe	Get hash	malicious	PureLog Stealer, RisePro Stealer, Vidar, zgRAT	Browse	149.154.167.99
	Resolucion Juridica Bloqueo Cuentas y servicios SRI.vbs.xz	Get hash	malicious	Unknown	Browse	104.21.51.236
	vidar2406.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	RW3MLiFPzL.exe	Get hash	malicious	PureLog Stealer, Vidar, zgRAT	Browse	149.154.167.99

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	M9dfZzH3qn.exe	Get hash	malicious	CryptOne, Vidar	Browse	149.154.167.99
	5IRIk4f1PO.exe	Get hash	malicious	CryptOne, Vidar	Browse	149.154.167.99
	https://telegrambot-resolved.pages.dev/	Get hash	malicious	Unknown	Browse	149.154.167.99
	1719520929.094843_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse	149.154.167.99
	Kyeryong Construction - Products List & Spec.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	zrrHgsDzgS.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, StormKitty, WorldWind Stealer, zgRAT	Browse	149.154.167.220
	1Cvd8TyYPm.exe	Get hash	malicious	LummaC, Mars Stealer, PureLog Stealer, Stealc, Vidar, Xmrig, zgRAT	Browse	149.154.167.99
	H1XdsfkcgU.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	w5APKwp5DD.exe	Get hash	malicious	AsyncRAT, HTMLPhisher, MicroClip, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	https://telegrambot-resolved.pages.dev/	Get hash	malicious	Unknown	Browse	149.154.167.99
HETZNER-ASDE	M9dfZzH3qn.exe	Get hash	malicious	CryptOne, Vidar	Browse	195.201.251.214
	5IRIk4f1PO.exe	Get hash	malicious	CryptOne, Vidar	Browse	195.201.251.214
	https://he110ca11he1lpn0wwb112.pages.dev/	Get hash	malicious	TechSupportScam	Browse	195.201.57.90
	Find-DscResource_QoS.ps1	Get hash	malicious	Unknown	Browse	5.161.214.209
	https://serviceca11he1pn0waa12.pages.dev/	Get hash	malicious	TechSupportScam	Browse	195.201.57.90
	Find-DscResource_QoS.ps1	Get hash	malicious	Unknown	Browse	5.161.214.209
	1719520929.094843_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse	195.201.251.214
	http://hostedonsporestack.com	Get hash	malicious	Unknown	Browse	95.216.25.250
	https://email.abad-ca.com/	Get hash	malicious	Unknown	Browse	135.181.16.82
	QUjE2KgAq6.exe	Get hash	malicious	Quasar	Browse	195.201.57.90

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	M9dfZzH3qn.exe	Get hash	malicious	CryptOne, Vidar	Browse	149.154.167.99
	5IRIk4f1PO.exe	Get hash	malicious	CryptOne, Vidar	Browse	149.154.167.99
	1719520929.094843_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse	149.154.167.99
	3443424611#U00b7pdf.exe	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.99
	UTN RFP_24-0676#U00b7pdf.exe	Get hash	malicious	GuLoader, Lokibot	Browse	149.154.167.99
	RFQ_22Q7305A-N23A-01#U00b7pdf.exe	Get hash	malicious	Remcos	Browse	149.154.167.99
	UPS_Bill_of_lading_291098829T_28_06_2024_000000_pdf.vbs	Get hash	malicious	GuLoader, Remcos	Browse	149.154.167.99
	PLANT PROJECT PROPOSAL BID_24-0676#U00b7pdf.exe	Get hash	malicious	GuLoader, Lokibot	Browse	149.154.167.99
	1Cvd8TyYPm.exe	Get hash	malicious	LummaC, Mars Stealer, PureLog Stealer, Stealc, Vidar, Xmrig, zgRAT	Browse	149.154.167.99
	w5APKwp5DD.exe	Get hash	malicious	AsyncRAT, HTMLPhisher, MicroClip, StormKitty, WorldWind Stealer	Browse	149.154.167.99

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqlt[1].dll	M9dfZzH3qn.exe	Get hash	malicious	CryptOne, Vidar	Browse
	5IRIk4f1PO.exe	Get hash	malicious	CryptOne, Vidar	Browse
	1719520929.094843_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse
	1Cvd8TyYPm.exe	Get hash	malicious	LummaC, Mars Stealer, PureLog Stealer, Stealc, Vidar, Xmrig, zgRAT	Browse
	WR0fuHnEVW.exe	Get hash	malicious	Vidar	Browse
	BRWgvKaqbg.exe	Get hash	malicious	PureLog Stealer, RisePro Stealer, Vidar, zgRAT	Browse
	vidar2406.exe	Get hash	malicious	Vidar	Browse
	RW3MLiFPzL.exe	Get hash	malicious	PureLog Stealer, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	Setup.exe	Get hash	malicious	Vidar	Browse
C:\Users\user\AppData\Local\Temp\katAE61.tmp	M9dfZzH3qn.exe	Get hash	malicious	CryptOne, Vidar	Browse
	5IRIk4f1PO.exe	Get hash	malicious	CryptOne, Vidar	Browse
	unKdkI2OE7.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
	igGqB0yylQ.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
	I71ylA9bM6.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
	RPI1VJ83ui.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
	l3gMFGppEi.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
	eyduk1OwKt.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
	8Scta2jVt5.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse
	38XY6jzm6P.exe	Get hash	malicious	CryptOne, Mars Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFHDAEGHDGDB\AAEBAK

Download File

Process:	C:\Users\user\AppData\Local\Temp\katAE61.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFHDAEGHDGDB\BGDHDA

Download File

Process:	C:\Users\user\AppData\Local\Temp\katAE61.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFHDAEGHDGDB\DHDAKF

Download File

Process:	C:\Users\user\AppData\Local\Temp\katAE61.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFHDAEGHDGDB\EBFBFB

Download File

Process:	C:\Users\user\AppData\Local\Temp\katAE61.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	modified
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFHDAEGHDGDB\GCBKEC

Download File

Process:	C:\Users\user\AppData\Local\Temp\katAE61.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFHDAEGHDGDB\GHCAAA

Download File

Process:	C:\Users\user\AppData\Local\Temp\katAE61.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFHDAEGHDGDB\HDBKJE

Download File

Process:	C:\Users\user\AppData\Local\Temp\katAE61.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFHDAEGHDGDB\HDGIEB

Download File

Process:	C:\Users\user\AppData\Local\Temp\katAE61.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Local\Temp\katAE61.tmp
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Local\Temp\katAE61.tmp
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.144086598890895
Encrypted:	false
SSDEEP:	6:kKFO9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:LDnLNkPlE99SNxAhUe/3
MD5:	0B413B7D875915C590EB7E0B34D75FDD
SHA1:	5964E14B5CD60188C807CC319B3B82FEDB60E6D2
SHA-256:	0DD968F556916FF977F1FBF78D0F13B0C70F73F38E7D984C1266A1EE39F7EBF9
SHA-512:	9C1C5B74C34C6F9FCAFA5A3EAA53879F5744BA7D8DDC20A363C6406C5F6CEC672E90AB72482A29D507AF046F5354EF586BD76592A808BA111946001BCEE9F521
Malicious:	false
Preview:	p...... ........R-.N....(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqlt[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\katAE61.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: M9dfZzH3qn.exe, Detection: malicious, Browse Filename: 5IRIk4f1PO.exe, Detection: malicious, Browse Filename: 1719520929.094843_setup.exe, Detection: malicious, Browse Filename: 1Cvd8TyYPm.exe, Detection: malicious, Browse Filename: WR0fuHnEVW.exe, Detection: malicious, Browse Filename: BRWgvKaqbg.exe, Detection: malicious, Browse Filename: vidar2406.exe, Detection: malicious, Browse Filename: RW3MLiFPzL.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\katAE61.tmp

Download File

Process:	C:\Users\user\Desktop\S8co1ACRdn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	881664
Entropy (8bit):	6.555251818096116
Encrypted:	false
SSDEEP:	24576:o0ESdQpglO1CxDyawn27h+9hrlgKQY9SGcZwCdTp:o0RIglO1CuL9VNcaCd9
MD5:	66064DBDB70A5EB15EBF3BF65ABA254B
SHA1:	0284FD320F99F62ACA800FB1251EFF4C31EC4ED7
SHA-256:	6A94DBDA2DD1EDCFF2331061D65E1BAF09D4861CC7BA590C5EC754F3AC96A795
SHA-512:	B05C6C09AE7372C381FBA591C3CB13A69A2451B9D38DA1A95AAC89413D7438083475D06796ACB5440CD6EC65B030C9FA6CBDAA0D2FE91A926BAE6499C360F17F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: M9dfZzH3qn.exe, Detection: malicious, Browse Filename: 5IRIk4f1PO.exe, Detection: malicious, Browse Filename: unKdkI2OE7.exe, Detection: malicious, Browse Filename: igGqB0yylQ.exe, Detection: malicious, Browse Filename: I71ylA9bM6.exe, Detection: malicious, Browse Filename: RPI1VJ83ui.exe, Detection: malicious, Browse Filename: l3gMFGppEi.exe, Detection: malicious, Browse Filename: eyduk1OwKt.exe, Detection: malicious, Browse Filename: 8Scta2jVt5.exe, Detection: malicious, Browse Filename: 38XY6jzm6P.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*............................0.............@..............................................@..............................2'...........................@..p............................0......................................................CODE....d........................... ..`DATA................................@...BSS......................................idata..2'.......(..................@....tls......... ...........................rdata.......0......................@..P.reloc..p....@......................@..P.rsrc...............................@..P.....................t..............@..P........................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.128835092420416
TrID:	Win32 Executable (generic) a (10002005/4) 93.58% Win32 Executable Borland Delphi 7 (665061/41) 6.22% Win32 Executable Delphi generic (14689/80) 0.14% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	S8co1ACRdn.exe
File size:	2'288'128 bytes
MD5:	6a605bfcf8816ab1a6e21238fcb55747
SHA1:	3e3a35e578c8a3faf88abe8fd7791ecc4bca538d
SHA256:	07be352dde09851de71ce7c763537e2b5c567e52fd161304cbaa54895dcd5c8f
SHA512:	a6f7c16fe752905dd9305ba7e46b0cc5de054f1dafd8ba836f61a50781f5f089bcf2e49961fa886de4efc2c6c972313bfd2770558131c360bcb8b2823ea1db0a
SSDEEP:	49152:qpjNvr9ySAOmw4dHHO+SASagXkJr4MDkUwm:qpjNp7p4dHH8n5A
TLSH:	8CB5AE26F392C537C0723A789D1AB26994357D111D3874467BE85F4CDF3AA823F2E292
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	c1692e1f373f1307

Static PE Info

General

Entrypoint:	0x4f0b24
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1b5ec46ea5b288abd35faaa6c5e29620

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 004F0674h
call 00007FA6AC6AA765h
mov eax, dword ptr [004F358Ch]
mov eax, dword ptr [eax]
call 00007FA6AC7009B9h
mov ecx, dword ptr [004F3714h]
mov eax, dword ptr [004F358Ch]
mov eax, dword ptr [eax]
mov edx, dword ptr [004F00B8h]
call 00007FA6AC7009B9h
mov eax, dword ptr [004F358Ch]
mov eax, dword ptr [eax]
call 00007FA6AC700A2Dh
call 00007FA6AC6A80F8h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xf5000	0x2226	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x10d000	0x127800	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xfa000	0x122e0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xf9000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0xefb6c	0xefc00	b6cbccf4120abae452c4f4bb0c0241a1	False	0.4459682937956204	data	6.569769101849669	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0xf1000	0x27b0	0x2800	075c39913dba2b50d48b34e05836ce6d	False	0.3671875	data	4.187577550487257	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xf4000	0xdd9	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xf5000	0x2226	0x2400	900ba339ba647a2a80150451120be588	False	0.3502604166666667	data	4.767633120388674	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xf8000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xf9000	0x18	0x200	bb1897305839cee8a2c35260b95c6576	False	0.05078125	data	0.2005819074398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0xfa000	0x122e0	0x12400	00541f5ce5b3ab6485498fee99281fc2	False	0.550339790239726	data	6.68159046363066	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x10d000	0x127800	0x127800	9e0ad6970eabe657b8599891019c3b4c	False	0.749698438821912	data	7.29880427329147	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x10dc94	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"			0.38636363636363635
RT_CURSOR	0x10ddc8	0x134	data			0.4642857142857143
RT_CURSOR	0x10defc	0x134	data			0.4805194805194805
RT_CURSOR	0x10e030	0x134	data			0.38311688311688313
RT_CURSOR	0x10e164	0x134	data			0.36038961038961037
RT_CURSOR	0x10e298	0x134	data			0.4090909090909091
RT_CURSOR	0x10e3cc	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"			0.4967532467532468
RT_BITMAP	0x10e500	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0x10e6d0	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380			0.46487603305785125
RT_BITMAP	0x10e8b4	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0x10ea84	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39870689655172414
RT_BITMAP	0x10ec54	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.4245689655172414
RT_BITMAP	0x10ee24	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5021551724137931
RT_BITMAP	0x10eff4	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5064655172413793
RT_BITMAP	0x10f1c4	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0x10f394	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5344827586206896
RT_BITMAP	0x10f564	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0x10f734	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.4870689655172414
RT_ICON	0x10f81c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.5013440860215054
RT_ICON	0x10fb04	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.311841949603691
RT_DIALOG	0x12032c	0x52	data			0.7682926829268293
RT_STRING	0x120380	0xc0	data			0.5260416666666666
RT_STRING	0x120440	0x634	data			0.30289672544080604
RT_STRING	0x120a74	0x358	data			0.3703271028037383
RT_STRING	0x120dcc	0x494	data			0.3796928327645051
RT_STRING	0x121260	0x3e0	data			0.32661290322580644
RT_STRING	0x121640	0x3cc	data			0.411522633744856
RT_STRING	0x121a0c	0x344	data			0.46411483253588515
RT_STRING	0x121d50	0x1d0	data			0.38146551724137934
RT_STRING	0x121f20	0x16c	data			0.532967032967033
RT_STRING	0x12208c	0x1fc	Targa image data - Color 99 x 107 x 32 +68 +111 "z"			0.4744094488188976
RT_STRING	0x122288	0x1f0	data			0.530241935483871
RT_STRING	0x122478	0xec	data			0.597457627118644
RT_STRING	0x122564	0x10c	data			0.5522388059701493
RT_STRING	0x122670	0x470	data			0.3908450704225352
RT_STRING	0x122ae0	0x388	data			0.38827433628318586
RT_STRING	0x122e68	0x358	data			0.34345794392523366
RT_STRING	0x1231c0	0x398	data			0.39456521739130435
RT_STRING	0x123558	0xe4	data			0.5482456140350878
RT_STRING	0x12363c	0xbc	data			0.5691489361702128
RT_STRING	0x1236f8	0x2f4	data			0.4312169312169312
RT_STRING	0x1239ec	0x4b8	data			0.298841059602649
RT_STRING	0x123ea4	0x388	data			0.3661504424778761
RT_STRING	0x12422c	0x2f0	data			0.39095744680851063
RT_RCDATA	0x12451c	0x10	data			1.5
RT_RCDATA	0x12452c	0x10f89c	data	English	United States	0.7984275817871094
RT_RCDATA	0x233dc8	0x658	data			0.6354679802955665
RT_RCDATA	0x234420	0x21b	Delphi compiled form 'Tplfb'			0.62152133580705
RT_GROUP_CURSOR	0x23463c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x234650	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x234664	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x234678	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x23468c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x2346a0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x2346b4	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0x2346c8	0x14	data	English	United States	1.2
RT_GROUP_ICON	0x2346dc	0x14	data	English	United States	1.25

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualAlloc, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetSystemInfo, GetStringTypeExA, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, GetACP, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumCalendarInfoA, EnterCriticalSection, DeleteFileA, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStretchBltMode, GetStockObject, GetPixelFormat, GetPixel, GetPaletteEntries, GetObjectA, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, ExcludeClipRect, DeleteObject, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
ole32.dll	IsEqualGUID, CoTaskMemFree, StringFromCLSID, CoCreateGuid
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayGetElement, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
ole32.dll	CLSIDFromProgID, CoCreateInstance, CoUninitialize, CoInitialize
oleaut32.dll	CreateErrorInfo, GetErrorInfo, SetErrorInfo, SysFreeString
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 29, 2024 05:42:02.718513966 CEST	49705	443	192.168.2.5	149.154.167.99
Jun 29, 2024 05:42:02.718564034 CEST	443	49705	149.154.167.99	192.168.2.5
Jun 29, 2024 05:42:02.718681097 CEST	49705	443	192.168.2.5	149.154.167.99
Jun 29, 2024 05:42:02.726402044 CEST	49705	443	192.168.2.5	149.154.167.99
Jun 29, 2024 05:42:02.726438046 CEST	443	49705	149.154.167.99	192.168.2.5
Jun 29, 2024 05:42:03.375915051 CEST	443	49705	149.154.167.99	192.168.2.5
Jun 29, 2024 05:42:03.376012087 CEST	49705	443	192.168.2.5	149.154.167.99
Jun 29, 2024 05:42:03.422590017 CEST	49705	443	192.168.2.5	149.154.167.99
Jun 29, 2024 05:42:03.422621012 CEST	443	49705	149.154.167.99	192.168.2.5
Jun 29, 2024 05:42:03.423090935 CEST	443	49705	149.154.167.99	192.168.2.5
Jun 29, 2024 05:42:03.423146009 CEST	49705	443	192.168.2.5	149.154.167.99
Jun 29, 2024 05:42:03.424961090 CEST	49705	443	192.168.2.5	149.154.167.99
Jun 29, 2024 05:42:03.472501993 CEST	443	49705	149.154.167.99	192.168.2.5
Jun 29, 2024 05:42:03.720643044 CEST	443	49705	149.154.167.99	192.168.2.5
Jun 29, 2024 05:42:03.720668077 CEST	443	49705	149.154.167.99	192.168.2.5
Jun 29, 2024 05:42:03.720706940 CEST	443	49705	149.154.167.99	192.168.2.5
Jun 29, 2024 05:42:03.720716000 CEST	49705	443	192.168.2.5	149.154.167.99
Jun 29, 2024 05:42:03.720722914 CEST	443	49705	149.154.167.99	192.168.2.5
Jun 29, 2024 05:42:03.720742941 CEST	49705	443	192.168.2.5	149.154.167.99
Jun 29, 2024 05:42:03.720786095 CEST	49705	443	192.168.2.5	149.154.167.99
Jun 29, 2024 05:42:03.723265886 CEST	49705	443	192.168.2.5	149.154.167.99
Jun 29, 2024 05:42:03.723292112 CEST	443	49705	149.154.167.99	192.168.2.5
Jun 29, 2024 05:42:03.740025997 CEST	49706	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:03.744816065 CEST	9000	49706	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:03.744920969 CEST	49706	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:03.745166063 CEST	49706	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:03.749900103 CEST	9000	49706	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:04.436064005 CEST	9000	49706	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:04.436126947 CEST	9000	49706	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:04.436171055 CEST	49706	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:04.439600945 CEST	49706	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:05.665072918 CEST	49706	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:05.669986963 CEST	9000	49706	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:05.863558054 CEST	9000	49706	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:05.863641977 CEST	49706	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:05.864064932 CEST	49706	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:05.868782043 CEST	9000	49706	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:06.322073936 CEST	9000	49706	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:06.322259903 CEST	49706	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:06.331079006 CEST	49708	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:06.342097044 CEST	9000	49708	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:06.342294931 CEST	49708	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:06.342540026 CEST	49708	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:06.349286079 CEST	9000	49708	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:06.991245985 CEST	9000	49708	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:06.991333008 CEST	49708	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:06.991688967 CEST	49708	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:06.993303061 CEST	49708	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:06.996462107 CEST	9000	49708	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:06.998028994 CEST	9000	49708	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:07.614944935 CEST	9000	49708	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:07.615160942 CEST	49708	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:07.619904041 CEST	49706	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:07.620349884 CEST	49709	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:07.625237942 CEST	9000	49706	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:07.625251055 CEST	9000	49709	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:07.625299931 CEST	49706	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:07.625330925 CEST	49709	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:07.625555038 CEST	49709	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:07.630332947 CEST	9000	49709	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:08.295095921 CEST	9000	49709	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:08.295170069 CEST	49709	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:08.295603991 CEST	49709	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:08.297230959 CEST	49709	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:08.300384045 CEST	9000	49709	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:08.301981926 CEST	9000	49709	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:08.925075054 CEST	9000	49709	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:08.925173998 CEST	49709	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:08.925510883 CEST	9000	49709	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:08.925571918 CEST	49709	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:08.926930904 CEST	49708	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:08.927331924 CEST	49710	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:08.932112932 CEST	9000	49710	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:08.932198048 CEST	49710	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:08.932387114 CEST	49710	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:08.932805061 CEST	9000	49708	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:08.932854891 CEST	49708	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:08.937177896 CEST	9000	49710	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:09.581386089 CEST	9000	49710	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:09.581536055 CEST	49710	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:09.581993103 CEST	49710	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:09.583724976 CEST	49710	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:09.586771965 CEST	9000	49710	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:09.588573933 CEST	9000	49710	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:10.208534956 CEST	9000	49710	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:10.208551884 CEST	9000	49710	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:10.208564043 CEST	9000	49710	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:10.208606958 CEST	9000	49710	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:10.208617926 CEST	9000	49710	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:10.208622932 CEST	49710	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:10.208627939 CEST	9000	49710	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:10.208729982 CEST	49710	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:10.208730936 CEST	49710	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:10.209997892 CEST	49709	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:10.210376024 CEST	49711	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:10.215190887 CEST	9000	49709	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:10.215262890 CEST	49709	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:10.215405941 CEST	9000	49711	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:10.215471029 CEST	49711	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:10.215679884 CEST	49711	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:10.222357035 CEST	9000	49711	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:10.885778904 CEST	9000	49711	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:10.885863066 CEST	49711	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:10.886245966 CEST	49711	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:10.887907982 CEST	49711	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:10.891521931 CEST	9000	49711	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:10.892785072 CEST	9000	49711	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:11.521778107 CEST	9000	49711	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:11.521871090 CEST	49711	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:11.594953060 CEST	49710	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:11.595303059 CEST	49712	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:11.601061106 CEST	9000	49710	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:11.601073980 CEST	9000	49712	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:11.601129055 CEST	49710	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:11.601151943 CEST	49712	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:11.601428986 CEST	49712	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:11.606187105 CEST	9000	49712	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:12.253087997 CEST	9000	49712	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:12.253161907 CEST	49712	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:12.253483057 CEST	49712	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:12.255503893 CEST	49712	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:12.255570889 CEST	49712	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:12.258213997 CEST	9000	49712	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:12.260262012 CEST	9000	49712	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:12.260370970 CEST	9000	49712	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:12.260380030 CEST	9000	49712	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:12.260428905 CEST	9000	49712	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:12.260442972 CEST	9000	49712	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:12.260451078 CEST	9000	49712	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:12.260458946 CEST	9000	49712	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:12.829550982 CEST	49711	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:12.830022097 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:12.842994928 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:12.843004942 CEST	9000	49711	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:12.843188047 CEST	49711	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:12.843206882 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:12.843421936 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:12.866604090 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:12.950654030 CEST	9000	49712	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:12.950720072 CEST	49712	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.497047901 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.497117043 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.497539997 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.499195099 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.503350019 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.505114079 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.833831072 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.833901882 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.833914042 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.833925009 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.833971977 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.833972931 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.834170103 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.834184885 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.834194899 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.834206104 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.834217072 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.834219933 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.834270000 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.834708929 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.834773064 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.834834099 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.834880114 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.835273027 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.835319042 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.838710070 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.838754892 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.840637922 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.840682030 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.922650099 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.922727108 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.922729015 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.922761917 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.933954000 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.934005976 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.934027910 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.934041977 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.934065104 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.934091091 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.938761950 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.938772917 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.938785076 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.938817978 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.938841105 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.946293116 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.946305037 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.946315050 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.946338892 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.946372032 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.952590942 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.952668905 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.952742100 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.952752113 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.952785969 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.960037947 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.960099936 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.960197926 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.960208893 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.960242033 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.960258007 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.960443974 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.960489988 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.966732025 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.966793060 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.966892958 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.966903925 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.966943979 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.973725080 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.973778963 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.973892927 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.973903894 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.973939896 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.973956108 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.979617119 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.979670048 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.979686022 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.979696989 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.979732990 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.979748011 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.986891985 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.986970901 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.986984968 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.987054110 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.993598938 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.993654966 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:13.993654966 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:13.993693113 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.011478901 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.011531115 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.011533022 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.011543036 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.011575937 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.011599064 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.022696018 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.022768974 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.024259090 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.024307966 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.035502911 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.035512924 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.035521984 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.035571098 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.035598993 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.039063931 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.039076090 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.039086103 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.039112091 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.039310932 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.045874119 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.045922995 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.046053886 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.046063900 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.046093941 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.046109915 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.053129911 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.053141117 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.053162098 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.053174019 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.053191900 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.053200960 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.059881926 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.059921980 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.059932947 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.059938908 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.059958935 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.059979916 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.076101065 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.076145887 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.076181889 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.076193094 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.076231956 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.076247931 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.078717947 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.078764915 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.078807116 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.078818083 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.078851938 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.078869104 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.080015898 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.080063105 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.080099106 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.080108881 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.080137014 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.080152035 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.085655928 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.085702896 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.085741997 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.085752964 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.085784912 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.091649055 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.091665983 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.091689110 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.091711044 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.091732979 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.091780901 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.091804028 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.091826916 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.091870070 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.100330114 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.100341082 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.100375891 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.100394964 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.101449966 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.101507902 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.101604939 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.101613998 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.101624012 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.101648092 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.101663113 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.106786013 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.106796980 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.106806993 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.106832981 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.106853962 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.111815929 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.111826897 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.111866951 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.111948967 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.111989021 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.116866112 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.116918087 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.117027998 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.117038965 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.117074013 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.117090940 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.122013092 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.122024059 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.122056961 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.122155905 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.122164965 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.122201920 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.122219086 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.127240896 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.127253056 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.127289057 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.127305984 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.127388000 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.127434015 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.132189035 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.132240057 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.132338047 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.132349014 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.132390976 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.132405043 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.135771990 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.135822058 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.135844946 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.135855913 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.135890961 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.139065027 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.139111996 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.139132977 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.139143944 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.139173031 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.139189005 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.141879082 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.141926050 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.142015934 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.142025948 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.142056942 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.142061949 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.142091036 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.145163059 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.145193100 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.145215988 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.145234108 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.145400047 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.145442009 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.148068905 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.148117065 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.148158073 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.148168087 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.148202896 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.148269892 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.148310900 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.151072025 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.151122093 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.151148081 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.151159048 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.151190996 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.151206017 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.154062986 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.154100895 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.154109955 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.154134035 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.154179096 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.154222965 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.155155897 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.155199051 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.157139063 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.157186031 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.157218933 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.157229900 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.157265902 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.160105944 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.160154104 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.160186052 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.160197973 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.160231113 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.164474964 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.164527893 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.164534092 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.164571047 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.164925098 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.164968014 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.164973021 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.165009975 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.166898966 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.166946888 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.167315960 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.167361021 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.167396069 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.167439938 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.167445898 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.167495966 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.169316053 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.169362068 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.169363022 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.169373989 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.169406891 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.169430017 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.172261953 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.172307968 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.172339916 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.172350883 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.172380924 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.172394037 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.175434113 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.175481081 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.175512075 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.175523043 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.175558090 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.178352118 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.178400040 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.178414106 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.178423882 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.178453922 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.178469896 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.181374073 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.181418896 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.181447983 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.181458950 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.181494951 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.181512117 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.184320927 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.184364080 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.184397936 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.184408903 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.184604883 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.187414885 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.187469006 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.187479019 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.187479019 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.187511921 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.190599918 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.190610886 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.190620899 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.190644979 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.190663099 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.193377972 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.193434000 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.193439007 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.193476915 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.193478107 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.193541050 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.193547010 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.193587065 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.196511984 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.196557045 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.196566105 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.196583986 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.196604013 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.196619987 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.199455976 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.199505091 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.199582100 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.199592113 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.199600935 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.199626923 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.199641943 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.203170061 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.203181028 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.203190088 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.203217030 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.203233957 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.205678940 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.205730915 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.205758095 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.205768108 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.205802917 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.209021091 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.209067106 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.209098101 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.209108114 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.209142923 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.211466074 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.211509943 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.211566925 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.211577892 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.211611986 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.214596987 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.214646101 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.214715004 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.214725018 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.214754105 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.214764118 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.214782000 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.214792013 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.217456102 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.217502117 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.217534065 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.217544079 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.217576981 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.220813036 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.220861912 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.220889091 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.220899105 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.220933914 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.223784924 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.223829985 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.223839045 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.223849058 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.223882914 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.225476027 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.225521088 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.225550890 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.225562096 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.225598097 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.228229046 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.228276014 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.228283882 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.228293896 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.228328943 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.230866909 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.230912924 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.230926991 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.230937004 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.230964899 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.230977058 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.233594894 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.233640909 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.233674049 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.233684063 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.233716011 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.233731031 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.235972881 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.236020088 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.236052036 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.236063004 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.236098051 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.238217115 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.238261938 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.238296986 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.238307953 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.238342047 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.240009069 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.240056992 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.240088940 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.240109921 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.240132093 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.240148067 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.240207911 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.240250111 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.242229939 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.242280960 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.242304087 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.242314100 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.242347002 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.244174004 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.244218111 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.244241953 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.244251966 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.244282007 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.244297981 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.246442080 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.246453047 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.246463060 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.246493101 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.246520042 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.247908115 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.247955084 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.247977018 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.247987032 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.248023033 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.250042915 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.250051975 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.250062943 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.250092983 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.250113010 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.250169039 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.250215054 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.251827955 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.251873016 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.251899004 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.251909018 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.251943111 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.254008055 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.254053116 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.254098892 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.254108906 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.254142046 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.255372047 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.255412102 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.255491018 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.255505085 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.255528927 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.255548954 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.255567074 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.257529020 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.257572889 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.257627964 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.257642984 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.257678986 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.259124994 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.259162903 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.259195089 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.259206057 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.259241104 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.261051893 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.261104107 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.261133909 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.261156082 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.261172056 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.261188030 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.261245966 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.261282921 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.262281895 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.262307882 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.262326956 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.262346029 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.262409925 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.262449026 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.262522936 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.262561083 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.264556885 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.264609098 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.264674902 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.264684916 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.264719963 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.264724016 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.264764071 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.266052008 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.266098976 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.266124964 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.266134977 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.266163111 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.266177893 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.267667055 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.267678976 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.267688990 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.267719984 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.267743111 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.269166946 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.269213915 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.269251108 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.269289017 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.269319057 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.269365072 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.269368887 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.269407034 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.273731947 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.273747921 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.273758888 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.273767948 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.273778915 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.273780107 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.273789883 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.273797035 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.273823023 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.273840904 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.275507927 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.275520086 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.275528908 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.275556087 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.275593042 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.278177977 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.278187990 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.278234959 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.278317928 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.278357983 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.279582024 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.279628038 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.279727936 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.279737949 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.279764891 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.279781103 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.281826973 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.281836987 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.281847000 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.281868935 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.281886101 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.282123089 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.282162905 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.283361912 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.283373117 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.283382893 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.283412933 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.283412933 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.283977985 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.283988953 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.283998966 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.284019947 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.284040928 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.284137964 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.284174919 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.284207106 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.284245014 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.284338951 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.284348965 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.284383059 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.284383059 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.285965919 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.286007881 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.286142111 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.286153078 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.286181927 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.286195040 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.287727118 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.287736893 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.287746906 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.287765980 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.287781000 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.288615942 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.288670063 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.288784981 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.288794994 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.288826942 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.288842916 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.290241957 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.290251970 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.290261030 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.290302992 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.290328026 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.291553020 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.291570902 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.291582108 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.291610956 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.291629076 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.293144941 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.293195963 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.293286085 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.293296099 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.293323040 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.293337107 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.296135902 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.296194077 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.296268940 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.296281099 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.296310902 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.296325922 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.296449900 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.296461105 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.296499014 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.296514034 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.296597004 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.296636105 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.301852942 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.301863909 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.301872969 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.301913023 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.301951885 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.302006006 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.302015066 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.302047968 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.302201033 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.302212954 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.302222967 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.302243948 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.302259922 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.302469969 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.302510023 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.306474924 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.306485891 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.306495905 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.306521893 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.306539059 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.306577921 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.306588888 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.306618929 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.306638956 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.306745052 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.306785107 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.314692020 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.314702034 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.314712048 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.314723015 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.314757109 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.314791918 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.314990997 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.315001965 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.315031052 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.315052032 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.315181971 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.315221071 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.319865942 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.319906950 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.319950104 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.319962025 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.319988966 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.320003986 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.320153952 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.320167065 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.320192099 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.320207119 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.320358038 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.320369959 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.320398092 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.320411921 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.327037096 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.327086926 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.327135086 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.327145100 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.327183962 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.327266932 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.327279091 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.327308893 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.327323914 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.327445984 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.327455997 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.327466011 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.327486992 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.327517986 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.333704948 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.333769083 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.333801985 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.333812952 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.333842039 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.333875895 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.334002018 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.334012985 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.334022999 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.334044933 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.334059000 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.334320068 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.334362030 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.339014053 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.339032888 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.339059114 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.339075089 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.339085102 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.339121103 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.339220047 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.339231014 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.339241982 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.339262009 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.339278936 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.339512110 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.339521885 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.339555979 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.344677925 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.344721079 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.344961882 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.344974041 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.345012903 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.345113993 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.345124006 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.345134020 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.345155001 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.345176935 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.345448017 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.345489025 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.349996090 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.350007057 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.350018024 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.350058079 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.350090027 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.350275993 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.350286961 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.350297928 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.350308895 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.350323915 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.350352049 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.362020016 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.362030029 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.362040043 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.362072945 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.362097025 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.362164974 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.362176895 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.362206936 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.362298012 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.362334013 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.362761021 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.362772942 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.362811089 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.368143082 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.368192911 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.368297100 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.368308067 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.368334055 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.368350029 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.368495941 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.368506908 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.368516922 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.368525982 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.368531942 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.368551970 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.368571997 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.379098892 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.379153013 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.379235983 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.379246950 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.379257917 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.379282951 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.379282951 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.379415989 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.379432917 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.379445076 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.379453897 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.379455090 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.379466057 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.379483938 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.389370918 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.389381886 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.389393091 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.389414072 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.389431000 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.389518023 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.389529943 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.389555931 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.389575005 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.389833927 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.389843941 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.389853954 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.389868975 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.389885902 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.393142939 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.393198967 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.393287897 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.393345118 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.393424034 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.393462896 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.393609047 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.393649101 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.393800020 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.393810987 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.393820047 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.393827915 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.393846035 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.393863916 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.393874884 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.399497986 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.399578094 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.399635077 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.399646044 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.399684906 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.399702072 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.399827957 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.399840117 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.399867058 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.399883032 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.399970055 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.399981976 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.400011063 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.407118082 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.407126904 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.407136917 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.407162905 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.407186031 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.407264948 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.407303095 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.407452106 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.407463074 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.407473087 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.407490015 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.407505989 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.407747030 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.407793999 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.414704084 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.414716005 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.414750099 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.414767981 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.414839029 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.414877892 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.414994001 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.415004969 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.415039062 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.415055037 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.415143967 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.415153980 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.415163994 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.415186882 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.415203094 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.424398899 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.424444914 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.424473047 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.424493074 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.424515009 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.424530029 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.424591064 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.424628973 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.424665928 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.424701929 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.424704075 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.424740076 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.424887896 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.424899101 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.424932003 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.438074112 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.438143015 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.438216925 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.438231945 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.438257933 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.438286066 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.438508987 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.438555002 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.439284086 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.439299107 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.439311028 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.439321041 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.439326048 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.439342022 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.439376116 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.439759016 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.439769983 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.439779043 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.439790010 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.439800024 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.439809084 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.439810038 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.439821959 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.439832926 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.439836025 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.439846992 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.439877033 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.441549063 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.441560030 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.441570997 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.441581011 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.441591024 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.441596985 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.441601992 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.441613913 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.441634893 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.441664934 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.442312002 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.442322016 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.442331076 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.442341089 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.442351103 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.442356110 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.442363024 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.442373991 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.442385912 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.442389011 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.442414999 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.442430019 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.442977905 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.443133116 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.443164110 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.443176031 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.443188906 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.443198919 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.443208933 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.443208933 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.443219900 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.443242073 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.443268061 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.444785118 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.444797039 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.444807053 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.444839001 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.444856882 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.444925070 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.444937944 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.444947004 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.444957972 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.444967031 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.444992065 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.445838928 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.445884943 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.445959091 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.445971012 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.445980072 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.445991039 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.446003914 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.446007967 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.446011066 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.446033001 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.446047068 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.450938940 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.450989008 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.451023102 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.451034069 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.451071978 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.451169014 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.451179981 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.451208115 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.451227903 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.451304913 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.451316118 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.451344013 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.456834078 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.456881046 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.456899881 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.456911087 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.456948042 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.456965923 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.457138062 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.457149982 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.457185030 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.457200050 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.457267046 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.457278967 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.457288027 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.457313061 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.457341909 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.463586092 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.463639021 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.463675022 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.463685036 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.463723898 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.463772058 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.463783026 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.463809967 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.463825941 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.463943005 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.463982105 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.464013100 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.464024067 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.464051008 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.464066982 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.474009991 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.474039078 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.474075079 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.474086046 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.474109888 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.474118948 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.474237919 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.474250078 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.474260092 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.474289894 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.474314928 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.474456072 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.474498987 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.474553108 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.474561930 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.474596977 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.478008032 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.478060961 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.478070974 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.478081942 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.478116989 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.478298903 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.478315115 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.478326082 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.478336096 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.478343010 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.478363991 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.478396893 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.484149933 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.484191895 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.484208107 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.484225988 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.484236002 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.484277010 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.484366894 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.484379053 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.484389067 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.484416008 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.484436989 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.484635115 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.484646082 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.484689951 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.491888046 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.491938114 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.491967916 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.491978884 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.492016077 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.492160082 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.492199898 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.492235899 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.492280006 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.492311001 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.492321968 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.492331028 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.492353916 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.492379904 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.501698017 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.501759052 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.501841068 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.501852036 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.501885891 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.502016068 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.502027035 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.502038002 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.502048016 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.502057076 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.502083063 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.513442993 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.513492107 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.513508081 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.513518095 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.513555050 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.513649940 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.513660908 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.513672113 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.513681889 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.513689995 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.513705969 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.513731956 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.513988018 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.514034986 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.526783943 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.526832104 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.526850939 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.526860952 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.526894093 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.526932955 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.527009964 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.527020931 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.527031898 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.527041912 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.527054071 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.527079105 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.527312994 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.527353048 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.527426004 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.527471066 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.527507067 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.527519941 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.527549982 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.527565956 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.527652979 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.527663946 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.527705908 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.527888060 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.527898073 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.527909040 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.527934074 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.527950048 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.528990984 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.529036045 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.529077053 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.529088020 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.529123068 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.529272079 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.529316902 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.529346943 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.529359102 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.529370070 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.529377937 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.529392004 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.529416084 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.530165911 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.530178070 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.530189037 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.530214071 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.530231953 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.530291080 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.530302048 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.530334949 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.530339956 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.530352116 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.530380964 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.530864000 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.530915976 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.531018019 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.531028032 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.531064987 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.531105042 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.531116009 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.531126022 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.531137943 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.531148911 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.531167984 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.531193972 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.531591892 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.531605005 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.531615973 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.531625986 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.531636000 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.531637907 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.531647921 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.531665087 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.531680107 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.532098055 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.532144070 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.532255888 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.532299995 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.532495022 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.532537937 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.532577038 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.532618046 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.532628059 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.532685041 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.534580946 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.534626007 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.534646034 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.534661055 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.534687042 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.534703970 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.535130978 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.535175085 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.540694952 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.540741920 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.540774107 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.540817022 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.541171074 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.541219950 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.541233063 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.541237116 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.541256905 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.541275024 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.541431904 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.541475058 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.541476011 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.541487932 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.541517973 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.546989918 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.547039032 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.547275066 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.547319889 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.547389030 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.547432899 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.547502041 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.547513008 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.547547102 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.547656059 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.547666073 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.547676086 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.547698021 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.547714949 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.552691936 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.552723885 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.552735090 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.552737951 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.552755117 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.552772999 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.552896023 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.552907944 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.552942038 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.553056955 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.553069115 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.553102970 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.562968969 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.563019037 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.563095093 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.563106060 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.563141108 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.563255072 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.563266039 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.563277006 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.563287973 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.563301086 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.563327074 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.563601971 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.563648939 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.566965103 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.567011118 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.567030907 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.567040920 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.567070961 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.567152023 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.567195892 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.567243099 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.567254066 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.567285061 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.567370892 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.567413092 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.567414045 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.567457914 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.573199034 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.573255062 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.573405027 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.573416948 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.573451042 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.573545933 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.573556900 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.573569059 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.573581934 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.573590040 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.573609114 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.573637009 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.573779106 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.573822021 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.580895901 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.580945969 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.580976963 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.580988884 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.581022978 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.581212044 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.581222057 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.581232071 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.581242085 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.581250906 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.581257105 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.581271887 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.581290960 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.590786934 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.590832949 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.590862989 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.590873003 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.590903997 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.591130972 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.591141939 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.591151953 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.591161966 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.591180086 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.591196060 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.602273941 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.602334023 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.602375031 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.602385044 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.602427006 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.602497101 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.602508068 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.602516890 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.602540016 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.602581024 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.602763891 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.602775097 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.602804899 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.615783930 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.615845919 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.615869999 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.615880013 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.615920067 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.615998030 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.616014957 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.616024971 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.616036892 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.616049051 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.616065979 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.616092920 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.616339922 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.616379976 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.616411924 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.616451025 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.616523027 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.616533995 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.616563082 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.616679907 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.616692066 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.616723061 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.616863966 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.616874933 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.616883993 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.616905928 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.616920948 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.617945910 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.617990971 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.618004084 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.618015051 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.618052959 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.618190050 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.618231058 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.618252039 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.618297100 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.618360043 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.618371010 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.618380070 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.618407011 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.618429899 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.618565083 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.618607998 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.618678093 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.618690014 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.618719101 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.618733883 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.618908882 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.618918896 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.618928909 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.618940115 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.618948936 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.618948936 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.618984938 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.618999958 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.619741917 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.619791985 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.619834900 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.619846106 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.619882107 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.619898081 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.620095968 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.620106936 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.620115995 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.620126963 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.620137930 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.620155096 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.620155096 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.620174885 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.620476007 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.620522022 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.620553017 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.620568037 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.620579958 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.620589972 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.620594025 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.620603085 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.620604038 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.620626926 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.620647907 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.620982885 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.621026993 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.621254921 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.621309042 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.621334076 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.621344090 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.621373892 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.621467113 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.621478081 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.621486902 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.621505022 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.621520996 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.621762037 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.621802092 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.621859074 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.621898890 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.629877090 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.629923105 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.629946947 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.629957914 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.629997015 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.630089045 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.630100012 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.630122900 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.630146980 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.630317926 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.630328894 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.630338907 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.630361080 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.630384922 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.636317015 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.636362076 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.636409998 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.636420012 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.636449099 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.636465073 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.636537075 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.636584044 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.636655092 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.636697054 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.636701107 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.636714935 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.636724949 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.636740923 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.636764050 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.641716957 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.641777039 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.641794920 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.641807079 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.641839981 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.641856909 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.641967058 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.641978025 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.642010927 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.642155886 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.642167091 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.642198086 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.652131081 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.652193069 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.652199030 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.652209997 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.652242899 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.652257919 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.652420044 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.652430058 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.652440071 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.652451038 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.652460098 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.652468920 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.652503967 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.656075001 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.656126976 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.656147003 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.656158924 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.656241894 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.656390905 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.656400919 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.656435966 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.656539917 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.656550884 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.656579971 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.662148952 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.662190914 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.662200928 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.662208080 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.662233114 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.662344933 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.662359953 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.662369013 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.662401915 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.662419081 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.662547112 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.662559032 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.662595987 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.670104027 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.670152903 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.670171976 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.670214891 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.670286894 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.670298100 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.670332909 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.670485973 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.670496941 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.670506001 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.670536995 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.670553923 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.679886103 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.679944038 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.679954052 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.680052042 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.680088997 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.680099964 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.680116892 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.680126905 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.680140018 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.680157900 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.680176973 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.680454969 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.680510998 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.691253901 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.691303968 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.691323996 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.691333055 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.691370010 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.691483974 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.691494942 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.691504955 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.691515923 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.691531897 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.691559076 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.691813946 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.691859007 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.704801083 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.704852104 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.704865932 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.704875946 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.704904079 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.705080032 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.705089092 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.705097914 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.705125093 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.705140114 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.705302954 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.705311060 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.705349922 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.705431938 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.705441952 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.705468893 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.705485106 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.705661058 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.705670118 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.705678940 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.705688953 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.705697060 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.705702066 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.705718040 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.705725908 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.706008911 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.706052065 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.707063913 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.707107067 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.707137108 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.707145929 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.707179070 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.707268000 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.707282066 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.707313061 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.707474947 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.707484961 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.707493067 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.707516909 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.707532883 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.707695961 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.707705975 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.707745075 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.707837105 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.707850933 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.707860947 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.707875013 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.707880974 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.707880974 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.707885027 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.707902908 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.707916975 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.708281040 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.708324909 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.708731890 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.708775043 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.708781958 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.708792925 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.708825111 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.708980083 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.708991051 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.709022999 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.709115028 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.709131956 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.709141016 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.709162951 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.709178925 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.709430933 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.709441900 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.709450960 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.709460020 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.709470034 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.709475994 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.709481001 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.709497929 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.709511995 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.709908009 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.709917068 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.709953070 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.710288048 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.710330963 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.710361004 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.710371017 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.710401058 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.710416079 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.710515022 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.710525990 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.710557938 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.710674047 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.710685015 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.710720062 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.718826056 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.718873978 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.718883038 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.718892097 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.718924999 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.719043970 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.719054937 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.719089031 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.719235897 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.719247103 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.719257116 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.719281912 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.719296932 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.725543022 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.725588083 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.725627899 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.725639105 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.725671053 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.725847006 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.725857019 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.725867033 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.725886106 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.725893974 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.725908041 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.725930929 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.730704069 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.730750084 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.730782032 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.730792999 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.730828047 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.730983019 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.730993986 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.731029034 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.731116056 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.731132030 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.731161118 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.731175900 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.750078917 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.750127077 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.750168085 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.750178099 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.750214100 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.750232935 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.750394106 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.750405073 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.750415087 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.750426054 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.750437975 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.750466108 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.750828028 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.750839949 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.750850916 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.750860929 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.750871897 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.750874043 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.750883102 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.750886917 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.750895023 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.750911951 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.750931978 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.751398087 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.751442909 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.751472950 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.751482010 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.751513958 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.751640081 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.751651049 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.751661062 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.751672029 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.751689911 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.751708031 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.751943111 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.751985073 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.758889914 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.758934975 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.758944988 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.758955002 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.758985043 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.759130001 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.759140968 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.759150982 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.759162903 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.759174109 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.759202957 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.759465933 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.759509087 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.769093037 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.769145012 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.769175053 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.769185066 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.769218922 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.769401073 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.769411087 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.769421101 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.769432068 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.769445896 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.769469023 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.780296087 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.780347109 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.780374050 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.780385017 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.780420065 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.780599117 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.780611038 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.780622005 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.780632973 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.780647993 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.780670881 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.780872107 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.780917883 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.794012070 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.794066906 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.794117928 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.794167995 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.794224024 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.794286966 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.794296026 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.794301987 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.794317007 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.794342041 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.794431925 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.794444084 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.794455051 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.794462919 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.794481993 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.794516087 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.794728994 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.794776917 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.794805050 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.794816971 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.794847965 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.795037031 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.795047998 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.795058966 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.795068979 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.795078039 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.795094013 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.795125008 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.796361923 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.796408892 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.796443939 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.796456099 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.796494007 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.796494007 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.796679974 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.796689987 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.796700001 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.796710968 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.796722889 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.796746969 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.796976089 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.797019005 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.797089100 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.797101021 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.797133923 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.797318935 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.797328949 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.797338963 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.797349930 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.797363043 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.797386885 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.797913074 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.797962904 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.798017979 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.798031092 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.798063993 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.798079967 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.798330069 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.798341036 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.798351049 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.798362017 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.798372984 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.798373938 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.798398018 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.798412085 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.798887014 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.798897982 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.798907995 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.798918962 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.798928976 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.798929930 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.798940897 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.798955917 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.798971891 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.798990011 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.799310923 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.799320936 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.799330950 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.799356937 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.799376965 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.799417019 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.799427986 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.799438000 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.799448967 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.799462080 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.799485922 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.799690962 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.799732924 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.807948112 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.807993889 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.808027029 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.808038950 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.808060884 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.808078051 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.808254004 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.808264971 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.808274984 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.808285952 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.808294058 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.808309078 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.808331013 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.814475060 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.814523935 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.814554930 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.814563990 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.814595938 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.814615011 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.814692020 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.814702034 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.814718962 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.814735889 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.814753056 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.814760923 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.814927101 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.814939022 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.814971924 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.814989090 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.819750071 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.819796085 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.819824934 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.819835901 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.819869995 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.820055962 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.820067883 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.820077896 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.820087910 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.820105076 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.820121050 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.839096069 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.839153051 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.839183092 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.839195013 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.839353085 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.839476109 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.839487076 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.839497089 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.839508057 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.839517117 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.839526892 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.839541912 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.839569092 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.839891911 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.839903116 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.839912891 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.839941978 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.839965105 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.840194941 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.840204000 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.840214014 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.840224028 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.840240955 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.840256929 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.840440035 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.840451002 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.840461016 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.840471029 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.840504885 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.840517044 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.840723038 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.840765953 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.840775013 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.840778112 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.840790033 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.840815067 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.840842962 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.848248959 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.848320007 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.848330021 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.848417044 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.848579884 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.848591089 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.848602057 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.848612070 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.848639011 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.848656893 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.858112097 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.858161926 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.858220100 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.858230114 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.858269930 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.858417988 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.858428001 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.858438969 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.858448029 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.858464003 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.858479023 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.869379997 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.869438887 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.869446993 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.869450092 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.869491100 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.869604111 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.869649887 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.869704962 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.869715929 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.869729996 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.869739056 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.869752884 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.869770050 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.883574963 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.883632898 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.883661985 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.883673906 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.883702040 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.883718967 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.883876085 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.883888006 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.883898020 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.883908033 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.883923054 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.883948088 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.884241104 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.884253025 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.884284019 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.884470940 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.884490013 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.884500980 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.884511948 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.884515047 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.884522915 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.884537935 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.884562969 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.885159016 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.885219097 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.885227919 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.885227919 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.885262012 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.885345936 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.885387897 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.885396004 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.885406971 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.885417938 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.885436058 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.885462046 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.885731936 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.885782003 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.885799885 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.885842085 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.885938883 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.885947943 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.885958910 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.885968924 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.885982990 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.885998011 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.886228085 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.886239052 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.886271000 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.886630058 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.886676073 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.886852980 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.886900902 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.886931896 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.886943102 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.886974096 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.886989117 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.887145042 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.887161016 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.887171030 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.887192965 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.887209892 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.887393951 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.887406111 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.887439013 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.887466908 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.887479067 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.887489080 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.887500048 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.887511969 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.887526989 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.887561083 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.888016939 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.888027906 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.888073921 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.888350964 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.888360977 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.888394117 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.888458967 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.888500929 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.888508081 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.888518095 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.888529062 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.888545990 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.888561010 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.888720036 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.888730049 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.888761997 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.898085117 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.898142099 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.898170948 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.898183107 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.898212910 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.898356915 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.898366928 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.898382902 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.898392916 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.898402929 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.898417950 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.898441076 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.903561115 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.903608084 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.903698921 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.903711081 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.903738976 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.903754950 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.903844118 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.903853893 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.903865099 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.903886080 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.903903961 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.904112101 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.904155016 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.908715963 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.908761024 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.908778906 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.908788919 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.908819914 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.908976078 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.908987045 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.908997059 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.909020901 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.909034014 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.909179926 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.909224987 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.928292036 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.928370953 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.928376913 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.928539038 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.928556919 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.928594112 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.928595066 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.928607941 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.928617954 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.928628922 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.928638935 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.928653002 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.928678989 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.929100037 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.929111004 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.929121017 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.929131031 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.929141998 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.929148912 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.929152012 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.929172039 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.929194927 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.929733992 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.929744959 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.929755926 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.929780960 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.929796934 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.929914951 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.929924965 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.929935932 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.929945946 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.929954052 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.929955006 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.929971933 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.929997921 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.937149048 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.937200069 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.937269926 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.937285900 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.937319994 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.937371016 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.937381983 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.937411070 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.937426090 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.937573910 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.937583923 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.937603951 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.937617064 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.937633991 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.937643051 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.947057009 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.947107077 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.947118998 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.947129965 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.947154999 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.947171926 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.947326899 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.947336912 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.947346926 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.947359085 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.947371960 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.947392941 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.958374977 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.958410025 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.958420992 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.958426952 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.958441973 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.958460093 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.958563089 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.958601952 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.958661079 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.958698034 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.958703995 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.958709955 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.958719015 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.958734035 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.958749056 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.958758116 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.972260952 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.972282887 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.972317934 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.972335100 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.972338915 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.972378969 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.972435951 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.972450018 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.972465992 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.972486019 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.972507000 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.972507000 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.972747087 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.972758055 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.972796917 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.972906113 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.972917080 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.972950935 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.973139048 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.973148108 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.973159075 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.973169088 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.973179102 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.973181009 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.973187923 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.973198891 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.973216057 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.973242998 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.974189997 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.974235058 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.974240065 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.974250078 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.974278927 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.974419117 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.974430084 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.974438906 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.974450111 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.974467993 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.974490881 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.974731922 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.974775076 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.974862099 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.974874020 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.974905014 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.974930048 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.974972963 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.975075960 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.975085974 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.975095987 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.975126982 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.975143909 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.975519896 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.975529909 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.975564003 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.975811958 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.975857973 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.975887060 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.975897074 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.975925922 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.976090908 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.976102114 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.976135015 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.976238966 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.976252079 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.976263046 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.976273060 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.976279020 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.976283073 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.976300955 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.976327896 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.976720095 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.976732016 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.976742029 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.976752996 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.976763010 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.976768970 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.976793051 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.976811886 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.977338076 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.977395058 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.977406025 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.977416992 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.977449894 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.977467060 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.977579117 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.977591038 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.977612972 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.977622986 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.977637053 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.977673054 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.987078905 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.987138987 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.987148046 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.987149954 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.987180948 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.987195015 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.987272024 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.987283945 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.987309933 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.987324953 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.987448931 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.987459898 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.987485886 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.987500906 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.987585068 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.987622023 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.992455959 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.992507935 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.992536068 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.992544889 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.992580891 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.992666006 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.992676973 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.992686033 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.992707968 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.992733955 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.992901087 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.992911100 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.992947102 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.997638941 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.997674942 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.997687101 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.997711897 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.997777939 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.997787952 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.997917891 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.997927904 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.997936010 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.997939110 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.997972965 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:14.998056889 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:14.998101950 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.019079924 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.019089937 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.019098997 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.019161940 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.019406080 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.019416094 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.019424915 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.019434929 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.019455910 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.019470930 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.019740105 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.019750118 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.019758940 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.019787073 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.019800901 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.019870996 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.019912004 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.020046949 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.020088911 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.020203114 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.020214081 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.020224094 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.020232916 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.020251989 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.020276070 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.020473957 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.020494938 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.020505905 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.020515919 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.020519018 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.020529032 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.020545006 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.020569086 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.020869017 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.020912886 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.020939112 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.020962000 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.020982027 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.020994902 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.028531075 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.028542995 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.028552055 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.028583050 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.028599977 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.028680086 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.028688908 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.028698921 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.028709888 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.028723955 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.028744936 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.037931919 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.037942886 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.037952900 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.037962914 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.037985086 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.038005114 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.038077116 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.038094997 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.038105011 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.038131952 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.038142920 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.038369894 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.038410902 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.048589945 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.048600912 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.048610926 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.048620939 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.048630953 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.048640966 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.048643112 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.048652887 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.048671007 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.048683882 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.061371088 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.061422110 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.061450005 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.061461926 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.061492920 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.061750889 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.061762094 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.061772108 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.061795950 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.061819077 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.061944008 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.061954975 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.061965942 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.061974049 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.061989069 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.062009096 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.062269926 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.062282085 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.062290907 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.062300920 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.062309980 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.062316895 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.062335014 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.062355995 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.063378096 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.063431025 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.063453913 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.063467979 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.063493013 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.063508034 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.063673973 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.063684940 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.063700914 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.063711882 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.063714027 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.063724041 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.063738108 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.063754082 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.063988924 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.064033985 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.064110994 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.064121962 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.064155102 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.064333916 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.064343929 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.064353943 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.064363956 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.064378977 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.064399958 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.064816952 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.064861059 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.064884901 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.064897060 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.064928055 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.064943075 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.065078974 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.065088987 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.065104008 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.065119028 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.065135956 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.065143108 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.065294027 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.065304041 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.065342903 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.065361023 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.065372944 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.065382004 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.065392971 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.065403938 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.065418005 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.065443993 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.065912962 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.065923929 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.065956116 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.066183090 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.066226959 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.066253901 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.066262960 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.066299915 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.066371918 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.066382885 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.066392899 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.066417933 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.066458941 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.066576958 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.066586971 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.066622972 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.076170921 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.076217890 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.076267004 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.076277018 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.076312065 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.076500893 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.076508999 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.076518059 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.076528072 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.076540947 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.076559067 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.076571941 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.076766014 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.076812029 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.081370115 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.081418037 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.081423998 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.081434011 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.081461906 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.081484079 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.081548929 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.081559896 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.081594944 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.081734896 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.081747055 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.081757069 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.081784010 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.081799984 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.086725950 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.086771965 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.086791039 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.086801052 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.086837053 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.086855888 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.086966038 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.086976051 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.086987019 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.086997032 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.087003946 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.087018967 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.087043047 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.087315083 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.087359905 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.106173038 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.106225967 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.106239080 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.106249094 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.106278896 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.106374025 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.106384039 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.106400967 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.106411934 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.106419086 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.106448889 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.106784105 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.106828928 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.107201099 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.107248068 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.107274055 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.107285976 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.107315063 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.107331991 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.107480049 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.107490063 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.107501030 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.107511997 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.107527018 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.107547998 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.107819080 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.107863903 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.107918978 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.107935905 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.107959986 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.107976913 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.108170033 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.108181000 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.108191013 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.108201027 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.108216047 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.108241081 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.115634918 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.115679979 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.115709066 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.115720987 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.115752935 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.115768909 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.115925074 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.115936995 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.115952015 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.115962029 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.115963936 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.115981102 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.116008997 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.125479937 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.125528097 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.125555038 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.125565052 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.125596046 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.125802994 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.125812054 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.125823975 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.125835896 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.125844955 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.125844955 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.125863075 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.125889063 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.136642933 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.136696100 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.136709929 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.136720896 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.136750937 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.136773109 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.136940956 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.136951923 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.136961937 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.136971951 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.136985064 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.137006998 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.150417089 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.150429964 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.150469065 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.150481939 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.150522947 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.150553942 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.150585890 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.150599003 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.150621891 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.150969028 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.150979042 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.150989056 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.150999069 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.151010990 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.151016951 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.151036024 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.151055098 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.151232958 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.151248932 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.151259899 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.151269913 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.151278973 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.151279926 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.151288033 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.151318073 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.152628899 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.152674913 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.152686119 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.152698040 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.152725935 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.152743101 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.152915955 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.152932882 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.152945042 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.152955055 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.152959108 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.152973890 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.152991056 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.153280020 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.153290987 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.153301954 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.153312922 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.153327942 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.153342962 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.153659105 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.153667927 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.153678894 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.153698921 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.153731108 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.153887987 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.153933048 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.154015064 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.154025078 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.154057026 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.154231071 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.154242039 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.154252052 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.154263020 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.154278994 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.154295921 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.154309034 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.154613972 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.154624939 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.154634953 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.154644966 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.154655933 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.154656887 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.154670954 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.154680967 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.154695988 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.154720068 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.155097961 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.155107021 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.155144930 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.155337095 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.155379057 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.155400991 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.155411959 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.155441999 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.155591965 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.155602932 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.155616999 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.155627012 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.155636072 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.155651093 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.155674934 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.165174961 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.165292978 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.165302038 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.165329933 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.165355921 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.165384054 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.165395021 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.165405035 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.165415049 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.165421009 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.165451050 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.165870905 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.165920973 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.170486927 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.170535088 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.170562029 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.170572042 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.170603991 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.170627117 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.170725107 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.170736074 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.170753956 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.170768023 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.170785904 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.170793056 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.170923948 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.170968056 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.175672054 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.175721884 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.175730944 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.175734043 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.175755024 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.175787926 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.175852060 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.175862074 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.175898075 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.175909996 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.175940037 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.175951004 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.175975084 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.175990105 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.176105976 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.176115036 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.176146984 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.195209980 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.195264101 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.195266962 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.195280075 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.195311069 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.195329905 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.195502996 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.195513964 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.195523977 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.195534945 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.195544004 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.195552111 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.195589066 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.195970058 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.196017027 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.196033001 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.196079016 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.196155071 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.196202040 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.196233034 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.196243048 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.196279049 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.196295023 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.196423054 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.196435928 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.196450949 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.196466923 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.196466923 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.196491957 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.196640015 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.196650028 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.196685076 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.196700096 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.196782112 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.196793079 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.196803093 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.196830034 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.196856022 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.197032928 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.197047949 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.197058916 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.197067976 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.197077990 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.197091103 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.197118998 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.204511881 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.204546928 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.204555988 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.204572916 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.204600096 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.204685926 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.204696894 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.204746962 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.204888105 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.204898119 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.204926968 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.204942942 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.205030918 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.205066919 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.214612961 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.214680910 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.214687109 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.214698076 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.214731932 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.214747906 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.214939117 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.214951038 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.214961052 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.214970112 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.214983940 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.214998960 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.215033054 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.226327896 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.226397991 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.226398945 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.226411104 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.226447105 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.226461887 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.226627111 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.226638079 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.226648092 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.226659060 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.226675034 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.226691961 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.239650011 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.239705086 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.239734888 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.239753008 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.239773989 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.239789963 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.239974022 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.239984035 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.239995003 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.240005016 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.240009069 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.240015984 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.240037918 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.240066051 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.240452051 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.240463018 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.240473986 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.240499020 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.240510941 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.240520954 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.240537882 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.240572929 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.241491079 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.241549969 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.241561890 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.241561890 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.241596937 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.241596937 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.241766930 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.241789103 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.241799116 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.241810083 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.241822004 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.241849899 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.241982937 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.241992950 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.242002010 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.242029905 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.242046118 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.242110014 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.242121935 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.242186069 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.242306948 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.242316961 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.242331982 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.242341995 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.242362976 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.242362976 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.242392063 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.242721081 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.242763042 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.242790937 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.242801905 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.242831945 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.242947102 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.242957115 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.242966890 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.242976904 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.242990971 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.243011951 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.243187904 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.243217945 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.243230104 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.243248940 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.243328094 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.243339062 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.243350029 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.243366957 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.243385077 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.243577003 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.243587971 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.243597984 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.243622065 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.243637085 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.244338036 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.244383097 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.244405031 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.244415045 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.244450092 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.244589090 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.244600058 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.244610071 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.244618893 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.244628906 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.244637012 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.244651079 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.244663954 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.254420042 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.254478931 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.254508018 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.254518986 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.254549980 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.254740000 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.254750967 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.254761934 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.254776955 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.254786015 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.254802942 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.254821062 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.259501934 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.259557962 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.259572029 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.259582996 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.259612083 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.259628057 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.259764910 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.259778976 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.259788990 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.259799004 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.259807110 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.259823084 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.259845018 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.264966011 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.265027046 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.265058994 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.265069962 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.265104055 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.265247107 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.265258074 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.265290976 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.265408993 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.265419006 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.265453100 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.284287930 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.284336090 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.284363031 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.284373999 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.284401894 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.284418106 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.284576893 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.284589052 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.284599066 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.284610033 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.284626961 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.284641981 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.284996986 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.285043001 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.285060883 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.285070896 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.285103083 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.285223961 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.285237074 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.285248041 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.285258055 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.285264015 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.285290956 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.285306931 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.285548925 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.285590887 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.285615921 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.285660982 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.285741091 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.285749912 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.285758018 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.285780907 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.285795927 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.286001921 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.286010981 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.286021948 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.286029100 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.286040068 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.286056042 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.293680906 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.293725967 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.293754101 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.293766022 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.293797970 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.293972015 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.293982983 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.293992996 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.294003963 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.294018984 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.294034958 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.294058084 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.303611994 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.303654909 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.303667068 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.303677082 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.303708076 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.303853989 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.303864956 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.303874969 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.303884983 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.303900957 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.303926945 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.304179907 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.304222107 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.315346003 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.315402985 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.315413952 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.315438986 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.315479994 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.315627098 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.315638065 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.315653086 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.315664053 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.315675020 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.315689087 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.315713882 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.328377962 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.328437090 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.328447104 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.328448057 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.328505039 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.328655958 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.328665972 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.328677893 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.328689098 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.328701019 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.328713894 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.328744888 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.328984976 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.328994989 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.329025030 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.329041004 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.329155922 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.329165936 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.329175949 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.329185963 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.329196930 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.329204082 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.329224110 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.329250097 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.329654932 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.329699039 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.330460072 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.330499887 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.330502987 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.330509901 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.330538034 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.330554008 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.330656052 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.330670118 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.330688953 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.330698967 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.330699921 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.330718040 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.330734968 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.331015110 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.331053972 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.331074953 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.331083059 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.331111908 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.331130028 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.331216097 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.331226110 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.331234932 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.331259966 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.331286907 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.331468105 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.331480980 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.331490040 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.331506968 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.331522942 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.331532001 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.331728935 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.331768036 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.331836939 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.331846952 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.331877947 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.331893921 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.332060099 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.332076073 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.332086086 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.332096100 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.332103968 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.332103968 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.332113981 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.332149029 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.332473993 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.332493067 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.332514048 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.332537889 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.332662106 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.332673073 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.332683086 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.332693100 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.332700014 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.332703114 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.332710981 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.332725048 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.332747936 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.333293915 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.333328009 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.333336115 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.333337069 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.333372116 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.333456993 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.333467007 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.333476067 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.333499908 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.333514929 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.333641052 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.333651066 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.333681107 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.333704948 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.343444109 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.343511105 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.343521118 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.343616962 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.343660116 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.343669891 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.343679905 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.343689919 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.343700886 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.343733072 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.344017982 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.344065905 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.348495007 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.348545074 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.348567963 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.348578930 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.348608971 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.348732948 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.348742962 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.348752975 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.348763943 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.348778009 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.348793983 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.348818064 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.353921890 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.353934050 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.353981018 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.353996992 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.354046106 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.354077101 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.354123116 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.354130030 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.354140997 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.354172945 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.354402065 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.354412079 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.354446888 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.373229980 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.373296976 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.373317957 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.373327971 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.373368979 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.373505116 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.373516083 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.373526096 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.373533964 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.373547077 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.373574972 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.373943090 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.373989105 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.374012947 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.374022961 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.374054909 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.374150038 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.374187946 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.374202967 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.374218941 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.374228954 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.374242067 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.374262094 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.374497890 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.374540091 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.374567032 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.374610901 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.374697924 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.374707937 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.374716997 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.374727011 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.374742985 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.374762058 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.375016928 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.375026941 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.375035048 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.375061989 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.375076056 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.383078098 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.383128881 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.383285046 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.383296967 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.383316994 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.383333921 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.383352041 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.383361101 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.383373976 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.383383989 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.383399010 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.383413076 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.392746925 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.392800093 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.392854929 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.392868042 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.392896891 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.392911911 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.393028021 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.393038988 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.393049002 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.393064022 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.393070936 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.393093109 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.393110037 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.404409885 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.404459953 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.404499054 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.404510975 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.404541016 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.404556036 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.404668093 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.404679060 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.404709101 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.404726028 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.404897928 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.404908895 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.404943943 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.417337894 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.417386055 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.417429924 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.417442083 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.417474985 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.417561054 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.417599916 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.417711973 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.417721987 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.417732000 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.417738914 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.417748928 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.417756081 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.417773008 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.417798042 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.418147087 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.418157101 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.418173075 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.418181896 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.418190002 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.418204069 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.418224096 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.418391943 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.418401003 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.418410063 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.418436050 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.418452978 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.419475079 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.419519901 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.419559002 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.419569016 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.419603109 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.419779062 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.419791937 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.419801950 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.419811010 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.419820070 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.419845104 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.420053005 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.420062065 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.420070887 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.420080900 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.420097113 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.420114040 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.420409918 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.420452118 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.420479059 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.420497894 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.420526028 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.420542002 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.420836926 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.420885086 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.420895100 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.420906067 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.420934916 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.420950890 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.421000004 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.421010017 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.421025038 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.421036005 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.421041965 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.421046019 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.421053886 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.421067953 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.421096087 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.421350002 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.421360970 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.421371937 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.421382904 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.421395063 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.421415091 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.422076941 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.422089100 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.422099113 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.422108889 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.422122955 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.422136068 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.422157049 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.422290087 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.422333002 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.422333956 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.422347069 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.422374964 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.422480106 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.422534943 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.422569036 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.422579050 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.422590017 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.422597885 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.422609091 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.422632933 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.422640085 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.432781935 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.432827950 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.432851076 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.432861090 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.432893991 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.433152914 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.433163881 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.433178902 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.433191061 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.433196068 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.433213949 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.433263063 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.437506914 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.437556982 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.437582016 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.437592983 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.437623978 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.437647104 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.437799931 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.437809944 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.437820911 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.437832117 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.437840939 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.437856913 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.437879086 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.443233967 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.443283081 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.443315029 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.443326950 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.443358898 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.443533897 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.443545103 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.443555117 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.443564892 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.443577051 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.443591118 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.462529898 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.462704897 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.462733030 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.462743998 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.462794065 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.462811947 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.462825060 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.462835073 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.462843895 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.462860107 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.462874889 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.462893009 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.471826077 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.471868992 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.471875906 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.471882105 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.471910954 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.471923113 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.472116947 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.472129107 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.472138882 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.472150087 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.472170115 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.472196102 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.472548008 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.472559929 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.472569942 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.472579956 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.472596884 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.472596884 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.472608089 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.472609043 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.472620964 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.472637892 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.472666025 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.473088026 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.473133087 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.473263979 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.473273993 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.473313093 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.473385096 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.473396063 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.473406076 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.473417997 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.473429918 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.473455906 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.473797083 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.473841906 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.482224941 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.482274055 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.482300997 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.482311964 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.482343912 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.482532978 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.482542992 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.482572079 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.482578039 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.482588053 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.482594967 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.482614040 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.482635975 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.493691921 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.493702888 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.493714094 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.493738890 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.493757010 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.493895054 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.493905067 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.493915081 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.493925095 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.493937969 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.493961096 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.506721973 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.506771088 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.506798983 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.506808996 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.506844997 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.506871939 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.506887913 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.506922007 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.506939888 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.506966114 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.506975889 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.506987095 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.506995916 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.507006884 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.507023096 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.507050991 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.507199049 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.507210016 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.507220030 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.507230043 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.507241011 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.507241964 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.507251978 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.507265091 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.507280111 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.507311106 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.507621050 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.507668018 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.508660078 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.508703947 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.508730888 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.508740902 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.508766890 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.508945942 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.508955002 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.508964062 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.508975983 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.508991003 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.509006977 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.509510994 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.509520054 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.509529114 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.509550095 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.509569883 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.509684086 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.509727955 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.509773016 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.509783030 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.509815931 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.509959936 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.509969950 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.509982109 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.510004997 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.510020971 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.510221958 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.510234118 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.510245085 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.510267019 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.510283947 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.510484934 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.510495901 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.510504961 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.510514021 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.510520935 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.510545015 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.510894060 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.510904074 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.510912895 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.510921955 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.510931015 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.510938883 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.510940075 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.510948896 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.510951996 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.510970116 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.510984898 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.511470079 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.511514902 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.511578083 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.511586905 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.511616945 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.511744976 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.511754990 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.511764050 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.511775017 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.511784077 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.511802912 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.512109995 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.512151957 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.521783113 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.521832943 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.521848917 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.521857977 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.521891117 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.522031069 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.522039890 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.522048950 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.522058010 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.522073030 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.522090912 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.522345066 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.522383928 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.526484013 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.526530027 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.526544094 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.526551962 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.526585102 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.526694059 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.526704073 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.526712894 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.526726961 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.526736975 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.526751041 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.526782036 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.527014017 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.527056932 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.532650948 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.532697916 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.532711029 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.532725096 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.532752037 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.532767057 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.532916069 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.532926083 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.532936096 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.532947063 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.532955885 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.532973051 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.532995939 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.533174038 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.533211946 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.551389933 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.551439047 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.551470041 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.551480055 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.551512003 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.551665068 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.551673889 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.551683903 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.551695108 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.551716089 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.551733017 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.551742077 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.559551954 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.559598923 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.559627056 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.559637070 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.559670925 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.559798956 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.559808969 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.559818983 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.559830904 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.559848070 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.559865952 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.560178995 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.560188055 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.560221910 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.560359001 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.560369968 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.560379982 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.560389996 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.560399055 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.560419083 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.560677052 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.560688019 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.560719013 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.561678886 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.561723948 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.561727047 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.561738014 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.561763048 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.561778069 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.561887980 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.561898947 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.561933994 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.562134981 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.562145948 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.562180042 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.562203884 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.562252045 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.570955038 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.571003914 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.571037054 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.571053028 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.571075916 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.571091890 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.571238041 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.571249008 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.571259022 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.571278095 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.571296930 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.571459055 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.571504116 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.582737923 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.582796097 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.582823992 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.582834959 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.582865000 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.582880974 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.583023071 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.583040953 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.583054066 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.583065033 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.583065987 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.583076000 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.583101034 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.597306967 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.597357988 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.597388983 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.597399950 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.597433090 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.597632885 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.597649097 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.597659111 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.597668886 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.597676039 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.597693920 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.597718954 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.598016977 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.598027945 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.598040104 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.598051071 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.598062038 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.598063946 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.598078966 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.598087072 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.598090887 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.598098040 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.598133087 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.598650932 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.598660946 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.598670959 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.598680973 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.598691940 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.598696947 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.598701954 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.598710060 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.598715067 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.598737955 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.598754883 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.600260019 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.600305080 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.600368023 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.600377083 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.600385904 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.600397110 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.600405931 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.600411892 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.600416899 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.600420952 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.600430965 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.600444078 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.600445032 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.600455046 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.600465059 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.600469112 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.600475073 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.600478888 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.600497007 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.600505114 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.600512028 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.600522041 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.600553989 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.600889921 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.600935936 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.600964069 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.600974083 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.601006031 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.601021051 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.601201057 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.601213932 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.601227999 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.601238966 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.601239920 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.601250887 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.601272106 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.601624012 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.601634979 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.601644993 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.601655960 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.601665974 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.601670980 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.601676941 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.601689100 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.601690054 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.601703882 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.601707935 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.601720095 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.601730108 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.601753950 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.610845089 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.610886097 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.610888004 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.610923052 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.611046076 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.611088037 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.611114979 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.611125946 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.611136913 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.611157894 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.611176014 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.611406088 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.611417055 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.611453056 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.615717888 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.615762949 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.615780115 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.615791082 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.615824938 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.615892887 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.615904093 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.615912914 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.615936995 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.615953922 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.616072893 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.616084099 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.616117954 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.621404886 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.621467113 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.621478081 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.621484995 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.621566057 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.621654987 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.621665955 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.621675968 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.621685982 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.621695995 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.621720076 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.621776104 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.640578985 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.640640020 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.640660048 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.640671968 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.640705109 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.640840054 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.640850067 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.640860081 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.640871048 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.640880108 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.640885115 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.640911102 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.640911102 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.649063110 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.649106026 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.649136066 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.649146080 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.649178982 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.649285078 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.649295092 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.649306059 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.649317980 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.649328947 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.649346113 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.649358988 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.649605989 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.649661064 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.649718046 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.649729013 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.649739027 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.649749994 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.649764061 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.649780035 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.649796963 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.649815083 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.650146961 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.650158882 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.650172949 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.650188923 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.650208950 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.651112080 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.651154995 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.651201010 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.651211977 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.651242971 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.651427984 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.651443005 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.651453972 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.651469946 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.651489019 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.651652098 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.651698112 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.660978079 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.661029100 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.661045074 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.661056995 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.661088943 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.661107063 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.661272049 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.661283016 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.661293983 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.661304951 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.661314011 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.661315918 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.661340952 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.661355972 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.671772957 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.671844006 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.671858072 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.671869040 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.671896935 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.671912909 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.672065020 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.672075033 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.672086000 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.672096968 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.672110081 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.672137022 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.686269045 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.686328888 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.686338902 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.686338902 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.686404943 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.686479092 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.686491013 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.686501980 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.686512947 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.686523914 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.686553955 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.686911106 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.686920881 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.686930895 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.686942101 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.686953068 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.686955929 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.686964035 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.686978102 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.686988115 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.687005997 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.687021017 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.687463999 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.687505007 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.687505007 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.687541962 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.687633038 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.687644958 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.687654018 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.687670946 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.687700987 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.687871933 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.687882900 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.687915087 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.687920094 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.687932014 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.687939882 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.687951088 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.687959909 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.687962055 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.687997103 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.688016891 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.688447952 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.688460112 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.688469887 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.688486099 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.688491106 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.688508987 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.688539982 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.688760042 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.688802958 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.689519882 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.689567089 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.689599037 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.689609051 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.689641953 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.689749956 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.689762115 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.689773083 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.689784050 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.689793110 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.689826012 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.690108061 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.690119982 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.690130949 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.690141916 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.690148115 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.690185070 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.690464973 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.690476894 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.690488100 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.690499067 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.690505028 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.690516949 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.690545082 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.690562963 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.690920115 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.690932035 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.690942049 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.690953016 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.690959930 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.690975904 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.691006899 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.691250086 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.691260099 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.691287994 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.691303015 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.699974060 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.700047970 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.700050116 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.700062037 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.700094938 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.700256109 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.700265884 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.700275898 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.700304031 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.700319052 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.700496912 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.700542927 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.704857111 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.704910040 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.704916000 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.704929113 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.704958916 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.704977036 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.705087900 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.705099106 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.705110073 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.705120087 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.705132008 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.705159903 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.710505009 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.710552931 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.710552931 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.710566044 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.710593939 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.710618019 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.710695982 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.710712910 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.710736990 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.710752010 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.710896015 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.710906982 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.710916996 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.710941076 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.710964918 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.729861975 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.729923964 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.729954004 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.729964972 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.730000973 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.730041027 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.730051994 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.730062962 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.730074883 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.730082989 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.730098009 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.730130911 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.738507986 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.738558054 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.738568068 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.738570929 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.738598108 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.738620043 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.738645077 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.738655090 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.738689899 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.738821030 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.738832951 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.738863945 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.738879919 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.739080906 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.739090919 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.739099979 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.739110947 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.739119053 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.739120007 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.739130020 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.739130020 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.739141941 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.739151955 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.739181042 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.739557981 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.739568949 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.739583969 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.739603043 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.739634991 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.749654055 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.749696970 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.749726057 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.749737978 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.749762058 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.749779940 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.749965906 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.749979019 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.749989986 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.750000000 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.750010967 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.750016928 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.750041008 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.750062943 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.753133059 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.753144979 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.753154993 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.753165960 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.753175974 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.753184080 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.753187895 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.753216982 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.753232002 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.762933969 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.762945890 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.762957096 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.762991905 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.763015985 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.763088942 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.763098955 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.763109922 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.763120890 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.763138056 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.763154030 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.763192892 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.779871941 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.779927015 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.779930115 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.779938936 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.779964924 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.779979944 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.780150890 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.780169010 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.780186892 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.780199051 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.780205011 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.780220985 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.780241966 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.780555964 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.780567884 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.780580997 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.780591965 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.780603886 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.780689001 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.780689001 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.780987024 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.780998945 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.781028986 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.781040907 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.781110048 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.781121016 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.781136990 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.781147957 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.781148911 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.781160116 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.781161070 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.781174898 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.781184912 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.781187057 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.781193018 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.781210899 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.781235933 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.782087088 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.782098055 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.782109022 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.782119036 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.782129049 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.782134056 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.782140970 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.782152891 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.782157898 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.782164097 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.782170057 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.782176971 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.782187939 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.782192945 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.782217979 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.782999039 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.783011913 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.783021927 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.783031940 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.783042908 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.783045053 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.783055067 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.783060074 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.783066988 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.783077955 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.783085108 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.783111095 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.849226952 CEST	49712	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.849580050 CEST	49714	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.855395079 CEST	9000	49712	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.855407000 CEST	9000	49714	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:15.855462074 CEST	49712	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.855498075 CEST	49714	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.855703115 CEST	49714	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:15.860414028 CEST	9000	49714	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:16.515317917 CEST	9000	49714	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:16.515393019 CEST	49714	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:16.515712023 CEST	49714	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:16.517280102 CEST	49714	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:16.517304897 CEST	49714	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:16.520629883 CEST	9000	49714	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:16.522083998 CEST	9000	49714	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:16.522201061 CEST	9000	49714	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:17.097534895 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:17.097912073 CEST	49716	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:17.102755070 CEST	9000	49713	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:17.102807999 CEST	49713	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:17.102875948 CEST	9000	49716	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:17.102930069 CEST	49716	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:17.103130102 CEST	49716	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:17.108584881 CEST	9000	49716	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:17.283562899 CEST	9000	49714	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:17.283615112 CEST	49714	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:17.759537935 CEST	9000	49716	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:17.759609938 CEST	49716	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:17.760184050 CEST	49716	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:17.762001991 CEST	49716	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:17.765511990 CEST	9000	49716	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:17.767143011 CEST	9000	49716	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:18.519654989 CEST	9000	49716	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:18.519702911 CEST	49716	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:18.653392076 CEST	49714	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:18.653821945 CEST	49722	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:18.658610106 CEST	9000	49714	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:18.658652067 CEST	9000	49722	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:18.658689976 CEST	49714	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:18.658735037 CEST	49722	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:18.658967972 CEST	49722	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:18.664026976 CEST	9000	49722	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:19.326536894 CEST	9000	49722	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:19.326595068 CEST	49722	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:19.327033997 CEST	49722	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:19.331732988 CEST	9000	49722	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:19.451631069 CEST	49722	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:19.456465960 CEST	9000	49722	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:19.963783026 CEST	49716	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:19.968867064 CEST	9000	49716	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:19.969619989 CEST	49716	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:20.104516029 CEST	9000	49722	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:20.104924917 CEST	49722	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:20.164999962 CEST	49889	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:20.169898033 CEST	9000	49889	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:20.169984102 CEST	49889	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:20.171629906 CEST	49889	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:20.176464081 CEST	9000	49889	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:20.822920084 CEST	9000	49889	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:20.823016882 CEST	49889	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:20.823623896 CEST	49889	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:20.828530073 CEST	9000	49889	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:20.836905956 CEST	49889	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:20.839427948 CEST	49890	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:20.841934919 CEST	9000	49889	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:20.841999054 CEST	49889	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:20.844234943 CEST	9000	49890	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:20.844299078 CEST	49890	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:20.844566107 CEST	49890	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:20.849330902 CEST	9000	49890	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:21.512898922 CEST	9000	49890	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:21.512979984 CEST	49890	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:21.520983934 CEST	49890	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:21.522641897 CEST	49890	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:21.524729013 CEST	49891	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:21.527326107 CEST	9000	49890	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:21.528134108 CEST	9000	49890	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:21.529006958 CEST	49890	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:21.530015945 CEST	9000	49891	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:21.530076981 CEST	49891	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:21.530330896 CEST	49891	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:21.536058903 CEST	9000	49891	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:22.191796064 CEST	9000	49891	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:22.195682049 CEST	49891	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:22.196019888 CEST	49891	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:22.197844982 CEST	49891	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:22.199306965 CEST	49892	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:22.200746059 CEST	9000	49891	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:22.202958107 CEST	9000	49891	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:22.203022003 CEST	49891	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:22.204149961 CEST	9000	49892	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:22.207674980 CEST	49892	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:22.207894087 CEST	49892	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:22.212640047 CEST	9000	49892	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:22.854338884 CEST	9000	49892	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:22.854424953 CEST	49892	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:22.854741096 CEST	49892	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:22.856266022 CEST	49892	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:22.858081102 CEST	49893	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:22.859477043 CEST	9000	49892	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:22.861479044 CEST	9000	49892	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:22.861535072 CEST	49892	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:22.862864017 CEST	9000	49893	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:22.862922907 CEST	49893	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:22.863107920 CEST	49893	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:22.867827892 CEST	9000	49893	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:23.515857935 CEST	9000	49893	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:23.515921116 CEST	49893	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:23.516372919 CEST	49893	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:23.517946959 CEST	49893	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:23.519432068 CEST	49894	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:23.521219015 CEST	9000	49893	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:23.524286985 CEST	9000	49894	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:23.524358034 CEST	49894	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:23.524576902 CEST	49894	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:23.525098085 CEST	9000	49893	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:23.525149107 CEST	49893	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:23.529463053 CEST	9000	49894	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:24.203419924 CEST	9000	49894	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:24.203484058 CEST	49894	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:24.203816891 CEST	49894	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:24.205355883 CEST	49894	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:42:24.209053040 CEST	9000	49894	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:24.212029934 CEST	9000	49894	195.201.251.214	192.168.2.5
Jun 29, 2024 05:42:24.212083101 CEST	49894	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:43:30.104968071 CEST	9000	49722	195.201.251.214	192.168.2.5
Jun 29, 2024 05:43:30.105088949 CEST	49722	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:43:30.105468988 CEST	9000	49722	195.201.251.214	192.168.2.5
Jun 29, 2024 05:43:30.105541945 CEST	49722	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:43:52.666918039 CEST	49722	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:43:52.666918039 CEST	49722	9000	192.168.2.5	195.201.251.214
Jun 29, 2024 05:43:52.671787977 CEST	9000	49722	195.201.251.214	192.168.2.5
Jun 29, 2024 05:43:52.671880007 CEST	49722	9000	192.168.2.5	195.201.251.214

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 29, 2024 05:42:02.706751108 CEST	52574	53	192.168.2.5	1.1.1.1
Jun 29, 2024 05:42:02.713762045 CEST	53	52574	1.1.1.1	192.168.2.5
Jun 29, 2024 05:42:20.082277060 CEST	53	60276	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 29, 2024 05:42:02.706751108 CEST	192.168.2.5	1.1.1.1	0x7201	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 29, 2024 05:42:02.713762045 CEST	1.1.1.1	192.168.2.5	0x7201	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

t.me

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	149.154.167.99	443	2568	C:\Users\user\AppData\Local\Temp\katAE61.tmp

Timestamp	Bytes transferred	Direction	Data
2024-06-29 03:42:03 UTC	84	OUT	GET /g067n HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-06-29 03:42:03 UTC	512	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 29 Jun 2024 03:42:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12312 Connection: close Set-Cookie: stel_ssid=3e2ecea7e35671d5ae_13623644875101988492; expires=Sun, 30 Jun 2024 03:42:03 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-06-29 03:42:03 UTC	12312	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 67 30 36 37 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 2e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @g067n</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.parent.

Target ID:	0
Start time:	23:41:57
Start date:	28/06/2024
Path:	C:\Users\user\Desktop\S8co1ACRdn.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\S8co1ACRdn.exe"
Imagebase:	0x400000
File size:	2'288'128 bytes
MD5 hash:	6A605BFCF8816AB1A6E21238FCB55747
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2027781260.00000000023C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Crypt, Description: Yara detected CryptOne packer, Source: 00000000.00000002.2028089019.0000000002CBB000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2028621267.0000000004200000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2028089019.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.2028089019.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:41:58
Start date:	28/06/2024
Path:	C:\Users\user\AppData\Local\Temp\katAE61.tmp
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\katAE61.tmp
Imagebase:	0x400000
File size:	881'664 bytes
MD5 hash:	66064DBDB70A5EB15EBF3BF65ABA254B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 4%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	50.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	64.1%
Total number of Nodes:	39
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02CBBEF0 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 317
threadmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,?,00003000,00000004), ref: 02CBBF61
GetTempFileNameA.KERNELBASE(?,kate,00000000,?), ref: 02CBC114
CreateFileA.KERNELBASE(?,00000003,00000000,00000000,00000004,00000002,00000000), ref: 02CBC142
WriteFile.KERNELBASE(00000000,?,000D7400,00000000,00000000), ref: 02CBC16C
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,00000000,00000000), ref: 02CBC1B6
NtUnmapViewOfSection.NTDLL(00000000,00400000), ref: 02CBC1D0
VirtualAllocEx.KERNELBASE(00000000,00400000,?,00003000,00000040), ref: 02CBC1FB
WriteProcessMemory.KERNELBASE(00000000,00400000,00000000,?,00000000), ref: 02CBC21F
WriteProcessMemory.KERNELBASE(00000000,00000000,00000000,00000000,00000000), ref: 02CBC281
Wow64GetThreadContext.KERNEL32(?,00010002), ref: 02CBC2AF
Wow64SetThreadContext.KERNEL32(?,00010002), ref: 02CBC2DA
ResumeThread.KERNELBASE(?), ref: 02CBC2EC
ExitProcess.KERNEL32(00000000), ref: 02CBC2F9

Strings

kate, xrefs: 02CBC100, 02CBC103

Memory Dump Source

Source File: 00000000.00000002.2028089019.0000000002CBB000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CBB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cbb000_S8co1ACRdn.jbxd

Yara matches

Similarity

API ID: Process$FileMemoryThreadWrite$ContextCreateVirtualWow64$AllocAllocateExitNameResumeSectionTempUnmapView
String ID: kate
API String ID: 1984375786-4076676908
Opcode ID: 8bdce1911b773aa4c5a77b11a59fe6ead0f340a8c12956d4af66eaabf161a0bb
Instruction ID: a758776eb609707c8cc2254993788d414b7ba10fc7e283cbc36cd2194d76b77a
Opcode Fuzzy Hash: 8bdce1911b773aa4c5a77b11a59fe6ead0f340a8c12956d4af66eaabf161a0bb
Instruction Fuzzy Hash: 52E1D875A00208AFDB54CF84D895FEEB7B5BF88304F108199E908AB391D771AE85CF94

Function 02CBB250 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02CBB9B0: VirtualAlloc.KERNELBASE(00000000,02CBB30F,00003000,00000040), ref: 02CBBA34

NtCreateFile.NTDLL(00000000,00120089,00000018,?,00000000,00000080,00000001,00000001,00000040,00000000,00000000), ref: 02CBB41B
FindCloseChangeNotification.KERNELBASE(00000000), ref: 02CBB4CC

Strings

@, xrefs: 02CBB39D

Memory Dump Source

Source File: 00000000.00000002.2028089019.0000000002CBB000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CBB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cbb000_S8co1ACRdn.jbxd

Yara matches

Similarity

API ID: AllocChangeCloseCreateFileFindNotificationVirtual
String ID: @
API String ID: 482251274-2766056989
Opcode ID: 1eb9ea2caabc7391b7229261c1d9bf95df83910e65e6df0dd8a40b88344f7981
Instruction ID: 01cd1de06e4ac20fadf733a621ab2bd57f1f61323884e8904b384ab554036c5b
Opcode Fuzzy Hash: 1eb9ea2caabc7391b7229261c1d9bf95df83910e65e6df0dd8a40b88344f7981
Instruction Fuzzy Hash: 5881FB71A00218AFDB25DF55CC55FDAB3B5AF88704F1481A9EA0DAB290D7706F84CF94

Function 02CBB510 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

.tex, xrefs: 02CBB5D4

Memory Dump Source

Source File: 00000000.00000002.2028089019.0000000002CBB000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CBB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cbb000_S8co1ACRdn.jbxd

Yara matches

Similarity

API ID:
String ID: .tex
API String ID: 0-1946526065
Opcode ID: 86473fe90031cc0144bf05fc695b61ac0536840d3e25b293d5c37be5d6457d6f
Instruction ID: 0b3e0eb9480e1927930d022a1d4dbfa4daebd4e4cf387801b5326145c26797b5
Opcode Fuzzy Hash: 86473fe90031cc0144bf05fc695b61ac0536840d3e25b293d5c37be5d6457d6f
Instruction Fuzzy Hash: D951E5B1D00109EFDB08CF94C894BEEFBB5EF48318F249559D915AB280D775AE85CBA0

Function 02CBB9B0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 46
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,02CBB30F,00003000,00000040), ref: 02CBBA34

Strings

VirtualAlloc, xrefs: 02CBBA19, 02CBBA1C

Memory Dump Source

Source File: 00000000.00000002.2028089019.0000000002CBB000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CBB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cbb000_S8co1ACRdn.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: VirtualAlloc
API String ID: 4275171209-164498762
Opcode ID: c42a450ca02fa363a87eb9b6114333d3fd783ad335b2bc0464273431a807ed53
Instruction ID: 7797405bd28ce1cbd4302b744df9b5484688a2a752745cdd41806da1e793878b
Opcode Fuzzy Hash: c42a450ca02fa363a87eb9b6114333d3fd783ad335b2bc0464273431a807ed53
Instruction Fuzzy Hash: 3711D060D082CDDEEF02DBE894097EEBFB55F11708F044098D9446A282D6BA57588BA6

Non-executed Functions

Function 02CBC510 Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2028089019.0000000002CBB000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CBB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cbb000_S8co1ACRdn.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a568a7dc076fac4237d36aa73511bb81ae5ea1128cbd7157671a2a4345687388
Instruction ID: ba7f4c2a671ceae0ffad6eb7f089bbb138052b436c876ead3e962f96c8cb1015
Opcode Fuzzy Hash: a568a7dc076fac4237d36aa73511bb81ae5ea1128cbd7157671a2a4345687388
Instruction Fuzzy Hash: 9E419171D1091C9BDF48CFADC991AEEBBF2AF88201F548299D516AB345D730AB41DB80

Analysis Process: katAE61.tmpPID: 2568, Parent PID: 5812COMMON

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	14
Total number of Limit Nodes:	5

Executed Functions

Function 227B4CF0 Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 461
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,-00000003,04000102,00000000), ref: 227B4EE1

Strings

psow, xrefs: 227B51F5
delayed %dms for lock/sharing conflict at line %d, xrefs: 227B4FB5
winOpen, xrefs: 227B5110
exclusive, xrefs: 227B4E81

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID: CreateFile
String ID: delayed %dms for lock/sharing conflict at line %d$exclusive$psow$winOpen
API String ID: 823142352-3829269058
Opcode ID: f3a5be967da1a8829b4f8292cce5b4214bd7449dbb8ac083dd55403171a23b47
Instruction ID: 85aa668cce1dbedce3bdf0c555b4d0632489fbb970d468fa57d93749596798e6
Opcode Fuzzy Hash: f3a5be967da1a8829b4f8292cce5b4214bd7449dbb8ac083dd55403171a23b47
Instruction Fuzzy Hash: 83F1AC71A4C300CFD7108F24CAA8B2A77E4BF94359F440A2AFE45D7299D779D944CB92

Function 227AFD40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 134
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32(?,?,?,?,?), ref: 227AFE03

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 227AFE78
winRead, xrefs: 227AFE3D

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID: FileRead
String ID: delayed %dms for lock/sharing conflict at line %d$winRead
API String ID: 2738559852-1843600136
Opcode ID: 221185f8023a6d172628dadf617ec1e5e1bbbc7d7791e033ff21f82b8868431f
Instruction ID: f3ab7a82d4471609793d37fd60b37608c063ba0f43de517a7503bdfd10f440c9
Opcode Fuzzy Hash: 221185f8023a6d172628dadf617ec1e5e1bbbc7d7791e033ff21f82b8868431f
Instruction Fuzzy Hash: 05410772608305ABC304DF65CD95A6BB7E8FFC4324F841A2DF94483641DB76E91887A3

Function 227D04D0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

failed to allocate %u bytes of memory, xrefs: 227D04E7

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: failed to allocate %u bytes of memory
API String ID: 0-1168259600
Opcode ID: 750424627d8e9fdf59a4dd46c2cfae1fe1999d0d5f6a91d60c6d49c945cb8a9d
Instruction ID: 423721510577337863cccc8d2b62da51545217f709953721714d382f8de6d335
Opcode Fuzzy Hash: 750424627d8e9fdf59a4dd46c2cfae1fe1999d0d5f6a91d60c6d49c945cb8a9d
Instruction Fuzzy Hash: 53D02222ECC33163D6521180EC00FCA3E808FA03B1F054134FC4C2A270D216985183C3

Non-executed Functions

Function 22884140 Relevance: 47.7, APIs: 14, Strings: 13, Instructions: 461
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%_rowid, xrefs: 228845B0, 228845FA
SELECT data FROM %Q.'%q_node' WHERE nodeno=?, xrefs: 22884166
Dimension %d of cell %d on node %lld is corrupt, xrefs: 228843D7
%_parent, xrefs: 228844D4, 2288451E
Mapping (%lld -> %lld) missing from %s table, xrefs: 228844E6, 228845C2
Node %lld missing from database, xrefs: 22884230
Found (%lld -> %lld) in %s table, expected (%lld -> %lld), xrefs: 22884527, 22884603
Rtree depth out of range (%d), xrefs: 2288428E
Node %lld is too small (%d bytes), xrefs: 2288425A
SELECT parentnode FROM %Q.'%q_parent' WHERE nodeno=?1, xrefs: 22884498
Dimension %d of cell %d on node %lld is corrupt relative to parent, xrefs: 2288444D
SELECT nodeno FROM %Q.'%q_rowid' WHERE rowid=?1, xrefs: 22884574
Node %lld is too small for cell count of %d (%d bytes), xrefs: 2288432B

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %_parent$%_rowid$Dimension %d of cell %d on node %lld is corrupt$Dimension %d of cell %d on node %lld is corrupt relative to parent$Found (%lld -> %lld) in %s table, expected (%lld -> %lld)$Mapping (%lld -> %lld) missing from %s table$Node %lld is too small (%d bytes)$Node %lld is too small for cell count of %d (%d bytes)$Node %lld missing from database$Rtree depth out of range (%d)$SELECT data FROM %Q.'%q_node' WHERE nodeno=?$SELECT nodeno FROM %Q.'%q_rowid' WHERE rowid=?1$SELECT parentnode FROM %Q.'%q_parent' WHERE nodeno=?1
API String ID: 0-1352829109
Opcode ID: 0188f3e64c3f322dc2423b3f09a4f41a6267fb87974fd468404625e9289681a3
Instruction ID: c05b2c06fc97f133eb3bba103acfc0df3adf6003007f62ae4783b337303aaadd
Opcode Fuzzy Hash: 0188f3e64c3f322dc2423b3f09a4f41a6267fb87974fd468404625e9289681a3
Instruction Fuzzy Hash: E3F12476908308EBD705DF64CD84A2BBBE9FF88314F044929F9489B216E775D950CBA3

Function 228E0480 Relevance: 30.2, APIs: 8, Strings: 9, Instructions: 476COMMON

Download Yara Rule

Strings

%s mode not allowed: %s, xrefs: 228E09EC
cach, xrefs: 228E082B
mode, xrefs: 228E0867
lhos, xrefs: 228E05A1
file, xrefs: 228E04DA
loca, xrefs: 228E0598
invalid uri authority: %.*s, xrefs: 228E05C2
no such vfs: %s, xrefs: 228E099A
no such %s mode: %s, xrefs: 228E0922

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s mode not allowed: %s$cach$file$invalid uri authority: %.*s$lhos$loca$mode$no such %s mode: %s$no such vfs: %s
API String ID: 0-1127695371
Opcode ID: ec82ea688bf5bc223b7f9fdcd7e1b0e4ed89d21153b729b8c5e423b344309d2e
Instruction ID: f6f3e51016f09bc80839f32935fc1444af2ec036432e4327b47fe27f3c8adeae
Opcode Fuzzy Hash: ec82ea688bf5bc223b7f9fdcd7e1b0e4ed89d21153b729b8c5e423b344309d2e
Instruction Fuzzy Hash: CCF111B8508345CFE3118E24C69076A7BA2AB97318F444E5DFCDE2B293D736D609CB42

Function 227C8680 Relevance: 28.6, APIs: 9, Strings: 7, Instructions: 550COMMON

Download Yara Rule

Strings

parse error in rank function: %s, xrefs: 227C97FF
, xrefs: 227C9848
%s: table does not support scanning, xrefs: 227C9979
SELECT rowid, rank FROM %Q.%Q ORDER BY %s("%w"%s%s) %s, xrefs: 227C98F1
DESC, xrefs: 227C98C2, 227C98D6
ASC, xrefs: 227C98BA
recursively defined fts5 content table, xrefs: 227C86C5

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: $%s: table does not support scanning$ASC$DESC$SELECT rowid, rank FROM %Q.%Q ORDER BY %s("%w"%s%s) %s$parse error in rank function: %s$recursively defined fts5 content table
API String ID: 0-2381147695
Opcode ID: c4d767aa325e0cd705c2b04ea07ef9113f743ea784e1ae8b286d90183f438cfe
Instruction ID: c350b5e092525cc09906ab90234d5ada3034f665984a11e550cc60dc28d95277
Opcode Fuzzy Hash: c4d767aa325e0cd705c2b04ea07ef9113f743ea784e1ae8b286d90183f438cfe
Instruction Fuzzy Hash: B422CEB1908711DFCB65CF34C980B6ABBF4BF88304F444A29F949AB291E735E941CB91

Function 228CD9E0 Relevance: 23.3, APIs: 8, Strings: 5, Instructions: 564COMMON

Download Yara Rule

Strings

API called with NULL prepared statement, xrefs: 228CDA9B, 228CDDFE
misuse, xrefs: 228CDAD6, 228CDE39
%s at line %d of [%.10s], xrefs: 228CDADB, 228CDE3E
API called with finalized prepared statement, xrefs: 228CDAB0, 228CDE13
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 228CDACC, 228CDE2F

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-860711957
Opcode ID: a1beadb1b2b57cc51a7b182f6fe405a3490175d9e9a469e2ffee799a0b3846de
Instruction ID: c2a24aeb260f4972d152a71715e7162a0db3bbbc2f6dc643fef50a1a10f96ba1
Opcode Fuzzy Hash: a1beadb1b2b57cc51a7b182f6fe405a3490175d9e9a469e2ffee799a0b3846de
Instruction Fuzzy Hash: 3012DEB9904704DBE325AF24C944B5777E8BF55318F000A2CF99D9B282F7B6E505CBA2

Function 227B66C0 Relevance: 23.2, APIs: 12, Strings: 1, Instructions: 416COMMON

Download Yara Rule

Strings

_shape does not contain a valid polygon, xrefs: 227B6816

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: _shape does not contain a valid polygon
API String ID: 0-1814939628
Opcode ID: ad419a855365f707c5c9335c21ecb9ad915447bfe5a91ee8d3d7286494666c9e
Instruction ID: faccc39cfff2a8854773dff772b4f49a1ea3ce1542d9dee0bf848df8f5ea3827
Opcode Fuzzy Hash: ad419a855365f707c5c9335c21ecb9ad915447bfe5a91ee8d3d7286494666c9e
Instruction Fuzzy Hash: 3DE1E0B580C3009FC701DF24C940A1BBBF9EF99714F544A2EFA9997212E736DA45CB92

Function 227CB400 Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 367COMMON

Download Yara Rule

Strings

SELECT %s WHERE rowid BETWEEN %lld AND %lld ORDER BY rowid %s, xrefs: 227CB696
SELECT %s ORDER BY rowid %s, xrefs: 227CB665
DESC, xrefs: 227CB656, 227CB65E, 227CB67D, 227CB685
ASC, xrefs: 227CB651, 227CB678

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: ASC$DESC$SELECT %s ORDER BY rowid %s$SELECT %s WHERE rowid BETWEEN %lld AND %lld ORDER BY rowid %s
API String ID: 0-3496276579
Opcode ID: c61c3aadfab4ea8fe52cf8ba2d6ddfb82e38fbeea3a0dbdbff660b074c2eb060
Instruction ID: 7b8c99df703c744d5f7cdc38f18734eaf923ec3f99cc392bc00b99c9a4ab653c
Opcode Fuzzy Hash: c61c3aadfab4ea8fe52cf8ba2d6ddfb82e38fbeea3a0dbdbff660b074c2eb060
Instruction Fuzzy Hash: 9EC141B15087419BC7128F34D940B67B7E0FF88324F440A2EFD899B641E73AE655CBA2

Function 2281DB10 Relevance: 18.3, APIs: 12, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e4a902339b7ec3370ce954a3caff759dff15f8b16f1e19f8b13c469af56a679
Instruction ID: 61ac5ec22fbbca02903bfc701ce9b85da3d9768eb30dd480d525e91a56012887
Opcode Fuzzy Hash: 9e4a902339b7ec3370ce954a3caff759dff15f8b16f1e19f8b13c469af56a679
Instruction Fuzzy Hash: 6B81CF76604305EBE7109F68CC80B6BB3E9AF95314F04092CF989DB391F7B5E9058B92

Function 227D0FB0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

e, xrefs: 227D115A

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: e
API String ID: 0-4024072794
Opcode ID: 36bf8875baaf085edaede92fcfbfd96a80b42455c8294c9340591cc07f665f1e
Instruction ID: c54a3d34a2c4ae2b2cafdc7fb9ae47a265d73be4556ac155342c01f354cbfc45
Opcode Fuzzy Hash: 36bf8875baaf085edaede92fcfbfd96a80b42455c8294c9340591cc07f665f1e
Instruction Fuzzy Hash: 315123726083419FD705DF28CC84A67BBE1EF95322F10066EF88197562E732E954CBA1

Function 2281DFC0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

%lld %lld, xrefs: 2281E055

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %lld %lld
API String ID: 0-3794783949
Opcode ID: 57ec660d42748e360e256680ace50813db6faad4cdd7dda052268ba9b5944d73
Instruction ID: 5b34b09ae4a645a71ce64b6c222ec1a1802a28142d4e96cbe6263247e2cd4a9d
Opcode Fuzzy Hash: 57ec660d42748e360e256680ace50813db6faad4cdd7dda052268ba9b5944d73
Instruction Fuzzy Hash: 61312A76605700BFF7126B28CD09F5B77EAEFD0720F004918FA4593292E7B6C9118B62

Function 228C14D0 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 360COMMON

Download Yara Rule

Strings

API called with NULL prepared statement, xrefs: 228C1571
misuse, xrefs: 228C15AC
%s at line %d of [%.10s], xrefs: 228C15B1
API called with finalized prepared statement, xrefs: 228C1586
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 228C15A2

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-860711957
Opcode ID: 6cf082ce0ed4d157fcec6beac4b6bd1402d3dfea626ba513a13e4c24fd7ba541
Instruction ID: 4a71bd49c531924d3c99acd23e6ab128e5d6c8f6326bd2b8890129ec4cf40112
Opcode Fuzzy Hash: 6cf082ce0ed4d157fcec6beac4b6bd1402d3dfea626ba513a13e4c24fd7ba541
Instruction Fuzzy Hash: 0FC1F4B8A04700DBE7289F34C9C4B6777E4BF60318F04063CE98A9B292E775E549C792

Function 228CD4F0 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 310COMMON

Download Yara Rule

Strings

API called with NULL prepared statement, xrefs: 228CD5AC
misuse, xrefs: 228CD5E7
%s at line %d of [%.10s], xrefs: 228CD5EC
API called with finalized prepared statement, xrefs: 228CD5C1
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 228CD5DD

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-860711957
Opcode ID: db99a822608bb765872fcaca1814da4b6f6ba9de3109c3543d4f8dd47a936648
Instruction ID: cd2c9c298787197841517bdc5bd24e90bad1078d667732af22581edd9b29374c
Opcode Fuzzy Hash: db99a822608bb765872fcaca1814da4b6f6ba9de3109c3543d4f8dd47a936648
Instruction Fuzzy Hash: 81B1ADB8904700DFE715AF28D984B57B7E4AF54318F00492CF99D8B282F776E549CBA2

Function 22884D40 Relevance: 14.0, APIs: 9, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b36258adfa07ee8bf8b8427f4a08fc68b6f0b5c6a10cbc10741eb4339f2072d3
Instruction ID: 179d06b2d13678f06b6612b83310c34e12578cf8a42d5c42352ef4d0af6aca4f
Opcode Fuzzy Hash: b36258adfa07ee8bf8b8427f4a08fc68b6f0b5c6a10cbc10741eb4339f2072d3
Instruction Fuzzy Hash: FEF1F3B9904305DBD3109F64CD84A2B77F9EF91315F050A2DFD0882242EBB9EA55CBA3

Function 22818200 Relevance: 14.0, APIs: 9, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad0a5c3b00ab44df3f57bc95005167e3ce00a97848b695a5dc32b7394a5da5d8
Instruction ID: 55830aef0a5ddb7124165b19907b6d2f5712282c438e53dbd62b609409eb1fcd
Opcode Fuzzy Hash: ad0a5c3b00ab44df3f57bc95005167e3ce00a97848b695a5dc32b7394a5da5d8
Instruction Fuzzy Hash: BA020F76908300EFE7118F64C981B6BB7E9FF88354F440E29FA8993291E735D954CB92

Function 22855940 Relevance: 12.4, APIs: 8, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44234126f4600257f9e6b55391fb75d356e9c215bc3f30cdfa467c4a94698a4f
Instruction ID: 3776932d6332d7c32963100ff94dfd85ea1c8966052d18f6d7273f3e5aab0527
Opcode Fuzzy Hash: 44234126f4600257f9e6b55391fb75d356e9c215bc3f30cdfa467c4a94698a4f
Instruction Fuzzy Hash: F4C15B7AE18344CFF7119A18CC81BDB77D1EF91310F9A066DE48947352E22DEA69C782

Function 227D7810 Relevance: 10.9, APIs: 7, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f458172522c070dc6579027d3ddc5d3adb0243558bd4183cf0e5db10e40d2170
Instruction ID: 0ca31284ff7704680904844cba563d098a5725dc264e9ddf64f59f78b46027f2
Opcode Fuzzy Hash: f458172522c070dc6579027d3ddc5d3adb0243558bd4183cf0e5db10e40d2170
Instruction Fuzzy Hash: 86E1237280C301AFD302DF35C981AABB7E4BF99354F444A5EF885AB251E735D950CB92

Function 228451D0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 141COMMON

Download Yara Rule

Strings

, xrefs: 22845334
REPLACE INTO '%q'.'%q_data'(id, block) VALUES(?,?), xrefs: 22845264

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: $REPLACE INTO '%q'.'%q_data'(id, block) VALUES(?,?)
API String ID: 0-69911113
Opcode ID: 831a8dd7813dab5761b3d77c135968409dfb7504b69b4dbbe64d693e371c055d
Instruction ID: 2308d5d54ffccabede4c310cfb807de444dbbc25b896f9f6e488f8e937dec6df
Opcode Fuzzy Hash: 831a8dd7813dab5761b3d77c135968409dfb7504b69b4dbbe64d693e371c055d
Instruction Fuzzy Hash: 9141C1B5A04305EFE700DF28CD80B1AB7E5FF98318F440529F948A7211D775E950CB92

Function 2287D610 Relevance: 10.6, APIs: 7, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd5a444f62547b55e1c478906cffc6cc5e8d8fd97acf4dcf33dab7dbce9423b
Instruction ID: 1da6880fe8c45f3803af89424d0420aa785e98eb23df258e0e995475e9781f06
Opcode Fuzzy Hash: 8fd5a444f62547b55e1c478906cffc6cc5e8d8fd97acf4dcf33dab7dbce9423b
Instruction Fuzzy Hash: DB41AF79600701EBDB019F29CD80A5BB7F8FF55364F00462CF95886262F772EA15CBA2

Function 22804760 Relevance: 9.4, APIs: 6, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84f2a22addbf0759c789563628e846be2de20c4d02fcb88ce6d06f847b0ecc42
Instruction ID: 219d866ab5abcfeb8a2dc14d7b3a2e4688ef55de4a4011d430abf700596d1b91
Opcode Fuzzy Hash: 84f2a22addbf0759c789563628e846be2de20c4d02fcb88ce6d06f847b0ecc42
Instruction Fuzzy Hash: 7BF1B0B5948345DFD300CF68C944A2BBBE4FF84309F044A2EF98997212E775EA54CB92

Function 227B4820 Relevance: 9.3, APIs: 6, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0051da772f1aa9bd0326b2edda15011298d1080fe7e7bf4308b12d85581d153
Instruction ID: 2e957fd81e2feb09df6828151714d018b2861c95a7355a06da2ab40c76032cf7
Opcode Fuzzy Hash: d0051da772f1aa9bd0326b2edda15011298d1080fe7e7bf4308b12d85581d153
Instruction Fuzzy Hash: F6B19DB4808705EBD700CF29C864B1BB7F8BFA9314F008B2AF954A7251E775E594CB96

Function 227B5C70 Relevance: 9.1, APIs: 6, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43830c2c14d87b3ae716c7a1980d3d4f048575f12cac28b556fe9d979f0dcba0
Instruction ID: 92e49a35c2ceec5d6cbaed791b83499f3e605e1965601d1aa98aae371f51ce8d
Opcode Fuzzy Hash: 43830c2c14d87b3ae716c7a1980d3d4f048575f12cac28b556fe9d979f0dcba0
Instruction Fuzzy Hash: 614132B12083019FEB05DF18C988F66B7E1FF98321F104669EA818B691E772F950CB60

Function 22839090 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fddf73e3dedc46fe06ba0150dcb83b8c6604cb6ffaed24e9029a2af673efdc2
Instruction ID: 0f1119769352fef9704dd258e8f66320512c5e8052fc8714210448f22ab03ae3
Opcode Fuzzy Hash: 8fddf73e3dedc46fe06ba0150dcb83b8c6604cb6ffaed24e9029a2af673efdc2
Instruction Fuzzy Hash: B431CF39600300DFD322CF28D988E26B3E5FF80365B1545B9ED468B262D736EC51CB90

Function 2280E200 Relevance: 9.1, APIs: 6, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e935a6ea62bfb3de66fdd343c028e5bd065c530818778387015c74fcb024b188
Instruction ID: 8b3677eb6227fbd3a8149e4b52e92d72e55364e6d06cf6cb4c79f9f98418ab1a
Opcode Fuzzy Hash: e935a6ea62bfb3de66fdd343c028e5bd065c530818778387015c74fcb024b188
Instruction Fuzzy Hash: 57113673209308AFE3045A64DC81FABF39DDF68335F10062AF60553151EBB6DA1183A1

Function 227F06E0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

VUUU, xrefs: 227F083A

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: VUUU
API String ID: 0-2040033107
Opcode ID: af2a95a4baecc27ea20ac66508a598598ccb4f34d796b97a00b64dcc37c9bdca
Instruction ID: da821f182158fd1e889ce202b27cb9b446ffca1e0db90d83144213f6243ce040
Opcode Fuzzy Hash: af2a95a4baecc27ea20ac66508a598598ccb4f34d796b97a00b64dcc37c9bdca
Instruction Fuzzy Hash: 6C81B1B150C3458FC714DF29C895A2BFBE4BFA9310F144A6DE98987342E771E944CBA1

Function 22821FE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

REPLACE INTO '%q'.'%q_data'(id, block) VALUES(?,?), xrefs: 22822001

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: REPLACE INTO '%q'.'%q_data'(id, block) VALUES(?,?)
API String ID: 0-914542581
Opcode ID: f6d290a65760101b680b94f44f9ca70ca43c8fd56bacb631dccf1934acf89dec
Instruction ID: 551a44c55b992e0b22e22b902c3f78e95841ab769f260f08acc418f277ab3d06
Opcode Fuzzy Hash: f6d290a65760101b680b94f44f9ca70ca43c8fd56bacb631dccf1934acf89dec
Instruction Fuzzy Hash: 7921EFB5500704EFEB11AF68DD44F1677AAFF24358F004618F9489712AD7B2E9A0CBA6

Function 2281A6F0 Relevance: 7.6, APIs: 5, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f019eea1133be2b3635edd7cc90bf4134357b1ee646fe582e77d9575b4d6cf1a
Instruction ID: 08a1e275fc625e5bee0fa2b6f8fa41a86269f34d7c177e0e727aa039161a611f
Opcode Fuzzy Hash: f019eea1133be2b3635edd7cc90bf4134357b1ee646fe582e77d9575b4d6cf1a
Instruction Fuzzy Hash: D36133B4108385CFD728CF15CA80A4BBBE0BBA9340F904A9CE5A85B364D735D555CFAB

Function 227F8550 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3966a2d936edd45f59b6e0deb058351046a11c26772725d757917f5ea545eae4
Instruction ID: fe808ae8e75910365adeee9767fa6e7a3fb9508cca09e84a31d048b01d7e2baa
Opcode Fuzzy Hash: 3966a2d936edd45f59b6e0deb058351046a11c26772725d757917f5ea545eae4
Instruction Fuzzy Hash: 5501F4B1608301BBDB125F18EE05B5B77A6EFE0725F24046CF90067210D336EC28CBA2

Function 227D1C50 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 471COMMON

Download Yara Rule

Strings

RtreeMatchArg, xrefs: 227D1F83

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: RtreeMatchArg
API String ID: 0-1459067757
Opcode ID: be391c1de5b69cfa3da2508ff031dfa20686b0bc1f47aad1dbbf724337169716
Instruction ID: 1c4f7f6a1e4fe4e9a27e6deb506852b144d9c56be9e2ff6f0414a28a3d36d8c4
Opcode Fuzzy Hash: be391c1de5b69cfa3da2508ff031dfa20686b0bc1f47aad1dbbf724337169716
Instruction Fuzzy Hash: 9602F1B29087018FC711CF24C980A1BBBF1BF99314F144A5DF9859B322E775E995CBA2

Function 227A298C Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 384COMMON

Download Yara Rule

APIs

GetACP.KERNEL32 ref: 22992A1F
IsValidCodePage.KERNEL32(00000000), ref: 22992A56
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 22992C3A

Strings

utf8, xrefs: 22992B28

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID: CodeInfoLocalePageValid
String ID: utf8
API String ID: 790303815-905460609
Opcode ID: 002c7a9692ad6926516bdf43081956b683d7e633f949ad877840d2e4cce5fffb
Instruction ID: 2c0de74c902d369ea2afa0d17057e82ebd904df6553aa86de5bcb1f1c207c63f
Opcode Fuzzy Hash: 002c7a9692ad6926516bdf43081956b683d7e633f949ad877840d2e4cce5fffb
Instruction Fuzzy Hash: BF71F472E04306AAE715AF74CD45FAA73ECEF55324F1045AAEA05DB180FBB4E940C7A0

Function 2280E090 Relevance: 6.1, APIs: 4, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 032214ef06cbbd2307b87f0be3e9a7f3a37357a656e957b8c9e19f3d7f6e2acd
Instruction ID: 7502a224548b254a123a17936ff44312c64bb012c8fd4f4cba57bf23c670cd05
Opcode Fuzzy Hash: 032214ef06cbbd2307b87f0be3e9a7f3a37357a656e957b8c9e19f3d7f6e2acd
Instruction Fuzzy Hash: CD31EE76114300DFEB16CF08DD40A77B7E1EB85315F04858AF8448F262E336E982CBA1

Function 227A2C8E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 229448A7
IsDebuggerPresent.KERNEL32 ref: 22944973
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 22944993
UnhandledExceptionFilter.KERNEL32(?), ref: 2294499D

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: e4026a08ee740692614341ec1c1e5faed412fcf29ba52724e055d71327597aa8
Instruction ID: fb952a6d459c8555000940bf55c10f0c6f2646c06d27030c61797b7cc4577a30
Opcode Fuzzy Hash: e4026a08ee740692614341ec1c1e5faed412fcf29ba52724e055d71327597aa8
Instruction Fuzzy Hash: EF310575D45318DBDB11DFA4C989BCCBBB8BF18304F1041EAE409AB250EB749A85DF05

Function 227FEF30 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf41f3b5669224c1154e9b2a92fe1b82126ef762f8275621b626f57154db146f
Instruction ID: de39712ee9e2efe8be150de43e172785000cd3474ffc00f0cd0ddf548e6d7986
Opcode Fuzzy Hash: bf41f3b5669224c1154e9b2a92fe1b82126ef762f8275621b626f57154db146f
Instruction Fuzzy Hash: 8E11213180C712ABD3528B28D904B46F7E0BF15334F064328F8889BB61C321F860CBC1

Function 228837E0 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 163b20eed04c21f543b465dbf508e26d1b36e382aec2e71a79acdea727c2a907
Instruction ID: 098879b3f3aae9c354f87085b5f0a6e4ed84c32029421c792f5e4fcb05ea24bc
Opcode Fuzzy Hash: 163b20eed04c21f543b465dbf508e26d1b36e382aec2e71a79acdea727c2a907
Instruction Fuzzy Hash: 1FE0B632009780ABDB235F51DD59E4BBFA6AF58364F040D18F58562470C7B2D8A1AB41

Function 22863770 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ccdf9b743d75f8252b2851f4553c50142fb9d6052622b86404dbf4ff0d5e94
Instruction ID: fe6eee54c48523e927176e675e893ba4f1674b49d402a48f3add36d4533833af
Opcode Fuzzy Hash: f4ccdf9b743d75f8252b2851f4553c50142fb9d6052622b86404dbf4ff0d5e94
Instruction Fuzzy Hash: 6EE0B632009700ABDB235F50DE5AE4BBFA6BF58760F040D18F5C522670C772D860AB41

Function 22845910 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

INSERT INTO '%q'.'%q_idx'(segid,term,pgno) VALUES(?,?,?), xrefs: 2284597E

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: INSERT INTO '%q'.'%q_idx'(segid,term,pgno) VALUES(?,?,?)
API String ID: 0-143322027
Opcode ID: 0a66c5c92a401dc3d42f7c9df2bfeea27c6158dbaa9a1195a201d771d262aad4
Instruction ID: 019d29595c7f5839c331a2b1c0b3370326cbc52c1da626ae27ed351579b65ca7
Opcode Fuzzy Hash: 0a66c5c92a401dc3d42f7c9df2bfeea27c6158dbaa9a1195a201d771d262aad4
Instruction Fuzzy Hash: EF1159B5500705BFE7109F58CC84F86BBADFF65328F004155F9489B252C7B6E5A4CBA1

Function 227D8970 Relevance: 4.6, APIs: 3, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67358935f96f66479ab3b40af424bcb292f3e40716e5d86d4d9a8bdb6708e6bf
Instruction ID: 9b4cfd6fcbacd8c21beecf5c81a2485bf4296675ef9765a4794105ee43b2f17c
Opcode Fuzzy Hash: 67358935f96f66479ab3b40af424bcb292f3e40716e5d86d4d9a8bdb6708e6bf
Instruction Fuzzy Hash: CB410537508311AFC7019F28EC4096BB7A5EF94724F144669F9448B261D733D913DB91

Function 2285D3B0 Relevance: 4.6, APIs: 3, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d11294175c1ef29e92c7e1418c6e1a90cd654317afc919e5a52303d08573a1c
Instruction ID: 64bf1cfe2c971ed4985c50eea9ae4205aeba41bde594fcf689f21cd3954efa92
Opcode Fuzzy Hash: 6d11294175c1ef29e92c7e1418c6e1a90cd654317afc919e5a52303d08573a1c
Instruction Fuzzy Hash: ED3168B5600700ABE704AF69DD84B66B3E9FF58314F018628FA48D7241E775F920CAA1

Function 228455B0 Relevance: 4.6, APIs: 3, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96a0fec9d7644001a59b05bf427f96057855fdd0b686ef9e14758ebca1917a34
Instruction ID: 209506fde3e8d923c440d5411827db0708d7f11957916e41531c2bfc739d6b47
Opcode Fuzzy Hash: 96a0fec9d7644001a59b05bf427f96057855fdd0b686ef9e14758ebca1917a34
Instruction Fuzzy Hash: 1D31EDB5904304EFEB009F29DC84B1B77E9EFA0318F004828F9498B252EB79E940CF11

Function 2281E170 Relevance: 4.6, APIs: 3, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7563429ee5596be6efdf3361d85c93174ad81afaab09c505e37f1af3d849dc06
Instruction ID: 617e1d4a9999c89b4b822b2b38719cb26ade579556a393d4643a0ec9e26d9d7b
Opcode Fuzzy Hash: 7563429ee5596be6efdf3361d85c93174ad81afaab09c505e37f1af3d849dc06
Instruction Fuzzy Hash: 0E11B47A600300ABE605AB28CD05F6B77AEEF94755F14081CF949D3292EBB6D91187A2

Function 227A2112 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

GetEnabledXStateFeatures, xrefs: 22980C61

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: GetEnabledXStateFeatures
API String ID: 0-1068256093
Opcode ID: d2492a26b7b9b6c5864764ec7738edfb68309c480baa9e9f003069fbd8f553f1
Instruction ID: a00cb75391c7167d396e0415f91ab56bc0e599db868ff201aa632d97874e00db
Opcode Fuzzy Hash: d2492a26b7b9b6c5864764ec7738edfb68309c480baa9e9f003069fbd8f553f1
Instruction Fuzzy Hash: A0F0F632505328BBDF222F20DC08FAE3E06AF80721F090611FE192B258DB794921D6C6

Function 22984A46 Relevance: 2.2, APIs: 1, Instructions: 658COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b89c3f2043cc12e30c9e587453b40a7bb0ef32063290aa691ead31fd4ab867e5
Instruction ID: 62b1592b73efcbae99ebbb3c5153bfba3aa6142bf0c1efff02920c46bcc0bbe6
Opcode Fuzzy Hash: b89c3f2043cc12e30c9e587453b40a7bb0ef32063290aa691ead31fd4ab867e5
Instruction Fuzzy Hash: 45C14B72904325ABCB05AF64CD15BBE7BBDFF21720F6841AAE901EB180E7718E40C791

Function 227D8CB0 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8985b4118c1730fb088f1b788d8455347231e9a5320a5b1d742885ac7b112862
Instruction ID: 88106b85583242e71eb2fce0da18aa6e0eab54a30609d3916d5a38f631f22376
Opcode Fuzzy Hash: 8985b4118c1730fb088f1b788d8455347231e9a5320a5b1d742885ac7b112862
Instruction Fuzzy Hash: 0801F5B260A300DBE700CF29D904E1673D5EFA8604F500869E544E7352E721D806C761

Function 2297FF17 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(2297FF01,00000001,229DD298,0000000C,22980A92,?), ref: 2297FF4F

Memory Dump Source

Source File: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 141410c1e530b838328cdcf4db368e44e32e90e66a1a6e1e8332982a90884400
Instruction ID: 894d4eb3a404cc8b00205d771c0492e6d2e904efc4356fb126e55a41c2afce13
Opcode Fuzzy Hash: 141410c1e530b838328cdcf4db368e44e32e90e66a1a6e1e8332982a90884400
Instruction Fuzzy Hash: D8F04472A48340DFE700EFA8D545BAC77B0FF59325F00466AE910EB2E0DB7A9900CB80

Function 227D8430 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 875602c2f73a52c0c9a6f148e04de174215d237d3759911a04e6fd69f05410ec
Instruction ID: 111916442ea996978cfbdb7907eada1a07b53bc20f88627a404669de1b0c753e
Opcode Fuzzy Hash: 875602c2f73a52c0c9a6f148e04de174215d237d3759911a04e6fd69f05410ec
Instruction Fuzzy Hash: B7B048B2408741BFAB42AA088C0087AB6AAFBD0220F848D48B4A441031D3328828AA12

Function 227A42AF Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00004214), ref: 22944A98

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: fad7db9fa624cc0ca25629854cb9772bb351ec61bdedc554b4e868157fd98811
Instruction ID: dade7f7ad52c1a4b003ed1910bc45f8ff802ce9a437537a83a4cbce7e4088ca3
Opcode Fuzzy Hash: fad7db9fa624cc0ca25629854cb9772bb351ec61bdedc554b4e868157fd98811
Instruction Fuzzy Hash: C59002B0A883029A9E0096559A698256A3059667113101A72680D5446C5D1D0101D636

Function 227A433C Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

GetSystemTimePreciseAsFileTime, xrefs: 22980CE9, 22980CF3

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: GetSystemTimePreciseAsFileTime
API String ID: 0-595813830
Opcode ID: ebb0d60b9d4709647a02733a2ea0f86d522f426d8cb401fa1ebdcee821671175
Instruction ID: 56752ddaced8c5dd59bb37fe6e71af0ef6d490a19e0d5196135433cbd83a01f1
Opcode Fuzzy Hash: ebb0d60b9d4709647a02733a2ea0f86d522f426d8cb401fa1ebdcee821671175
Instruction Fuzzy Hash: EE414870600301EFE715CF64C995EEABBF5FF44324B004AA9E99697252D732FA02CB91

Function 227A46A6 Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 2297EFF3

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 9e0c4626964bf9bc991a7717544772e800d915853459b53af1935eee33991c94
Instruction ID: 5636652d246e6674ed2a65b56739129173a0c9a478ca54fb92425a9240e662ba
Opcode Fuzzy Hash: 9e0c4626964bf9bc991a7717544772e800d915853459b53af1935eee33991c94
Instruction Fuzzy Hash: F0B01270545301CF53C04F72450471D39BC7E1D1917008467A800C4124D63C40808F21

Function 22885660 Relevance: 53.0, APIs: 26, Strings: 4, Instructions: 452
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_node, xrefs: 2288579E
Auxiliary rtree columns must be last, xrefs: 228856B3, 228858B3
CREATE TABLE x(%.*s INT, xrefs: 228857CA
,%.*s, xrefs: 22885804, 22885835

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: ,%.*s$Auxiliary rtree columns must be last$CREATE TABLE x(%.*s INT$_node
API String ID: 0-209218429
Opcode ID: bf4fcf6353c0bbb7e6e3d7dcdaec0bead7ac7168bd898c118ce354dc7d61a03b
Instruction ID: 3a41aae1e137ed85547c693980c7fe50851496bc9c49f831ea6f0a04d0d226d3
Opcode Fuzzy Hash: bf4fcf6353c0bbb7e6e3d7dcdaec0bead7ac7168bd898c118ce354dc7d61a03b
Instruction Fuzzy Hash: A7F12374908308DFC701CF24C994B2BB7E5BF94315F040A2AED4E97256D77AE958CBA2

Function 227CCC80 Relevance: 47.7, APIs: 15, Strings: 12, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

u, xrefs: 227CD16D
%2d, xrefs: 227CCE27
%02d, xrefs: 227CCE2C, 227CCE34, 227CCF27, 227CCF6F, 227CCFCE, 227CCFE9, 227CD10A
%03d, xrefs: 227CCF81, 227CCF8B
%lld, xrefs: 227CD0EE
%02d:%02d, xrefs: 227CD080
%04d, xrefs: 227CD1CE
%06.3f, xrefs: 227CCE5F
%.16g, xrefs: 227CCFB3
%04d-%02d-%02d, xrefs: 227CCE82
%02d:%02d:%02d, xrefs: 227CD12E
%.3f, xrefs: 227CD0BF

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %.16g$%.3f$%02d$%02d:%02d$%02d:%02d:%02d$%03d$%04d$%04d-%02d-%02d$%06.3f$%2d$%lld$u
API String ID: 0-1613945299
Opcode ID: 96b17fc201a98c4757d926cace3eb8228abcdcf19149a2f713c3e8e1206ee8c6
Instruction ID: 74a69da505ee6e7b81285c8f26aa58a4bbb84a51113e312aaf1cdac7287c3fd3
Opcode Fuzzy Hash: 96b17fc201a98c4757d926cace3eb8228abcdcf19149a2f713c3e8e1206ee8c6
Instruction Fuzzy Hash: 71F102B1A0C340AFE701CB34CC55F6BB3EABF99314F444A1DF984A7255E639DA448752

Function 22849120 Relevance: 45.9, APIs: 23, Strings: 3, Instructions: 355
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,%s, xrefs: 22849297
_node, xrefs: 22849202
CREATE TABLE x(_shape, xrefs: 22849268

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: ,%s$CREATE TABLE x(_shape$_node
API String ID: 0-1242591684
Opcode ID: b405f2e45c08c75d77914d771dbb22647b1282c7e79b5523d2f31b7e461a6d79
Instruction ID: ad030c5147dbfe84c9e85e14d2054d214256112a1c0035fdf7c7efba203d3258
Opcode Fuzzy Hash: b405f2e45c08c75d77914d771dbb22647b1282c7e79b5523d2f31b7e461a6d79
Instruction Fuzzy Hash: 5CC13475908308DBD7218F24CD88B2777B8FF50319F040A29ED4E87296DB7AE915CBA1

Function 228FB050 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 251
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

NULL, xrefs: 228FB267, 228FB324, 228FB325
program, xrefs: 228FB2FB
%s(%d), xrefs: 228FB1B3
BINARY, xrefs: 228FB0D3
k(%d, xrefs: 228FB0A5
%c%u, xrefs: 228FB2C3
vtab:%p, xrefs: 228FB283
(blob), xrefs: 228FB26C
%lld, xrefs: 228FB1DA, 228FB24C
%.16g, xrefs: 228FB217
,%s%s%s, xrefs: 228FB137
%.18s-%s, xrefs: 228FB192

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %.16g$%.18s-%s$%c%u$%lld$%s(%d)$(blob)$,%s%s%s$BINARY$NULL$k(%d$program$vtab:%p
API String ID: 0-900822179
Opcode ID: 9d274d98fb5359a81fe766bb0ba2f1e12950a45a4f5f07c5e170877f4a1878e9
Instruction ID: 1c1411f84851ff9f5954fc6d3f8648ee5a765d861b50fb0522f3580b7a3f07ae
Opcode Fuzzy Hash: 9d274d98fb5359a81fe766bb0ba2f1e12950a45a4f5f07c5e170877f4a1878e9
Instruction Fuzzy Hash: 7691F274A08345DBDB04CF14C894F6B77E5BF99308F98499DE9888B292D336D906C7A2

Function 227BD820 Relevance: 35.2, APIs: 8, Strings: 12, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

matchinfo, xrefs: 227BD970, 227BD98A
optimize, xrefs: 227BD9A4
offsets, xrefs: 227BD956
fts4aux, xrefs: 227BD840
fts4, xrefs: 227BD9F0
fts3_tokenizer, xrefs: 227BD921
fts3, xrefs: 227BD9CA
fts3tokenize, xrefs: 227BDA27
simple, xrefs: 227BD8A9
unicode61, xrefs: 227BD90B
snippet, xrefs: 227BD93C
porter, xrefs: 227BD8EE

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 0-449611708
Opcode ID: f825741c403537e2a538871fa907f44a874f7af89d603a2b6a6ddc56215c44df
Instruction ID: 723a80038d1d5ed95b1e0e291a25993fb55dd2bab21da9ed209aef7e7289127b
Opcode Fuzzy Hash: f825741c403537e2a538871fa907f44a874f7af89d603a2b6a6ddc56215c44df
Instruction Fuzzy Hash: 07513C70B4C301B7F7105BA49DC5F2B37A4AF56B59F040138FD04B628AF7A9EA15C296

Function 22937FB0 Relevance: 33.6, APIs: 14, Strings: 5, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

etilqs_, xrefs: 2293824C
winGetTempname5, xrefs: 22938233
winGetTempname2, xrefs: 22938094
winGetTempname4, xrefs: 22938355
winGetTempname1, xrefs: 2293817B

Memory Dump Source

Source File: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 0-2933911573
Opcode ID: c6d9567cbc2ef89df35ce7f502bca8b346063b68568af3c876ea3831d3d1c537
Instruction ID: bb508f258b4b12e913b43c7c383e1ea6d98c8a4dfba35a9d71987fde2104efb1
Opcode Fuzzy Hash: c6d9567cbc2ef89df35ce7f502bca8b346063b68568af3c876ea3831d3d1c537
Instruction Fuzzy Hash: F1A1C2B1A443015BE7024B749C40BBA7799FF52325F8406B6ED8497187E6ABD20FC3B1

Function 227C2BE0 Relevance: 31.8, APIs: 8, Strings: 10, Instructions: 346
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

NULL, xrefs: 227C2E38
SELECT * FROM (SELECT 'sqlite_schema' AS name,1 AS rootpage,'table' AS type UNION ALL SELECT name,rootpage,type FROM "%w".sqlite_schema WHERE rootpage!=0), xrefs: 227C2DA4
misuse, xrefs: 227C2E73
%s at line %d of [%.10s], xrefs: 227C2E78
API call with %s database connection pointer, xrefs: 227C2E5A
ORDER BY name, xrefs: 227C2DCC
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227C2E69
WHERE name=%Q, xrefs: 227C2DB7
invalid, xrefs: 227C2E4E
unopened, xrefs: 227C2E55

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: ORDER BY name$%s at line %d of [%.10s]$API call with %s database connection pointer$NULL$SELECT * FROM (SELECT 'sqlite_schema' AS name,1 AS rootpage,'table' AS type UNION ALL SELECT name,rootpage,type FROM "%w".sqlite_schema WHERE rootpage!=0)$WHERE name=%Q$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse$unopened
API String ID: 0-1179878930
Opcode ID: 9beeab949d0a23c5a6da94dfa941d3df9877bfb3d2de5a74ad4d8558c4f81a78
Instruction ID: 5198be9fa60d86ba6f96d2b7baf41a0f7e74814c2291988296b5426fb4bf1729
Opcode Fuzzy Hash: 9beeab949d0a23c5a6da94dfa941d3df9877bfb3d2de5a74ad4d8558c4f81a78
Instruction Fuzzy Hash: FDC1567060C3049BD7118F34CD84B5B37E0AF71B58F444A29ED49AB286E7B5E649C7A2

Function 228C5D70 Relevance: 28.3, APIs: 8, Strings: 8, Instructions: 266COMMON

Download Yara Rule

Strings

deletemerge, xrefs: 228C5F64
automerge, xrefs: 228C5E59
secure-delete, xrefs: 228C6031
crisismerge, xrefs: 228C5EF7
pgsz, xrefs: 228C5D81
usermerge, xrefs: 228C5EAD
rank, xrefs: 228C5FBB
hashsize, xrefs: 228C5DF0

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: automerge$crisismerge$deletemerge$hashsize$pgsz$rank$secure-delete$usermerge
API String ID: 0-3330941169
Opcode ID: c6177a3fcd9fe822e7aeb731f7f94519952b1839ebbddba2d64f1ded43a4d208
Instruction ID: 98d90e65ceeb7d83433152c7d978cb080065c7dcbdf82b6cd11b6a75ad6bff61
Opcode Fuzzy Hash: c6177a3fcd9fe822e7aeb731f7f94519952b1839ebbddba2d64f1ded43a4d208
Instruction Fuzzy Hash: 6C715FBAB0032187CB099B19AD4068F77D4EFD5322F04047DFA46E7252E725DA4AC7A3

Function 227B5E20 Relevance: 26.7, APIs: 8, Strings: 7, Instructions: 496COMMON

Download Yara Rule

Strings

recursive definition for %s.%s, xrefs: 227B5E4C
misuse, xrefs: 227B5F35, 227B625D, 227B638F
%s at line %d of [%.10s], xrefs: 227B5F3A, 227B6262, 227B6394
SELECT t.%Q FROM %Q.%Q AS t WHERE t.%Q MATCH '*id', xrefs: 227B5E6F
API called with finalized prepared statement, xrefs: 227B5F1F, 227B6247, 227B6379
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227B5F2B, 227B6253, 227B6385
no such fts5 table: %s.%s, xrefs: 227B62EA

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$SELECT t.%Q FROM %Q.%Q AS t WHERE t.%Q MATCH '*id'$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$no such fts5 table: %s.%s$recursive definition for %s.%s
API String ID: 0-1070437968
Opcode ID: be67191048080ad069ab2d0007704c762c53a42486d113ea00010b838ce05087
Instruction ID: b57b4950d2d62df465117a3eb1c154990f4c1d38af03068a3c5f85a27be3f7f1
Opcode Fuzzy Hash: be67191048080ad069ab2d0007704c762c53a42486d113ea00010b838ce05087
Instruction Fuzzy Hash: DC02F1B1A08704DFE711CF28CD88B5BB7E4BF94319F04492DEA599B242E775E504CBA2

Function 22829980 Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 429COMMON

Download Yara Rule

Strings

API called with NULL prepared statement, xrefs: 22829A04
misuse, xrefs: 22829A3F, 22829D9A
%s at line %d of [%.10s], xrefs: 22829A44, 22829D9F
API called with finalized prepared statement, xrefs: 22829A19, 22829D84
no such function: %s, xrefs: 22829E8C
SELECT %s, xrefs: 228299B1
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 22829A35, 22829D90

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$SELECT %s$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$no such function: %s
API String ID: 0-3900766660
Opcode ID: 9ce540e69b8a9bb130131db6e61a8b557885a195b420480fa86765764afbce78
Instruction ID: b5e65f261dc4f43cec511a17fce7aed240b485b134cb2dd37e04d2e695b257ee
Opcode Fuzzy Hash: 9ce540e69b8a9bb130131db6e61a8b557885a195b420480fa86765764afbce78
Instruction Fuzzy Hash: 60E1F8B8904B45DBE720CF28C984B5B77E4BF94314F14062CE98D9B242E775E985C792

Function 227E3800 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 184COMMON

Download Yara Rule

Strings

real, xrefs: 227E3895, 227E38EC
misuse, xrefs: 227E393A
null, xrefs: 227E38E7
no such rowid: %lld, xrefs: 227E39F8
%s at line %d of [%.10s], xrefs: 227E393F
integer, xrefs: 227E389A
cannot open value of type %s, xrefs: 227E38ED
API called with finalized prepared statement, xrefs: 227E3924
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227E3930

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$cannot open value of type %s$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$integer$misuse$no such rowid: %lld$null$real
API String ID: 0-1477268580
Opcode ID: 4d07efc5dd83a655461ccf2d57577560f8147e192f1c40a3184aaf2a9f5df607
Instruction ID: 67eb6cdc0ccb93d73a254328e9fe27ba7f6ac22080bfa4f1f5207fc404f9c5d6
Opcode Fuzzy Hash: 4d07efc5dd83a655461ccf2d57577560f8147e192f1c40a3184aaf2a9f5df607
Instruction Fuzzy Hash: 0451BFB16083059FD710DF28D880B26B7A4FF94319F044A6DE95A9B742E776E818CBB1

Function 22906230 Relevance: 23.1, APIs: 5, Strings: 8, Instructions: 374COMMON

Download Yara Rule

Strings

NULL, xrefs: 22906466
%02x, xrefs: 2290660C
NULL, xrefs: 22906481
-- , xrefs: 229062B0, 229062C0
%lld, xrefs: 2290649B
%!.15g, xrefs: 229064C2
'%.*q', xrefs: 22906562
zeroblob(%d), xrefs: 229065AF

Memory Dump Source

Source File: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %!.15g$%02x$%lld$'%.*q'$-- $NULL$NULL$zeroblob(%d)
API String ID: 0-3665355275
Opcode ID: 0292d8b8eab3677fa9ba4501796abc8586394f8e2187643a43b563ba1784f78b
Instruction ID: 90391ec50e2ea32d6bc14ed2acd7979ab7c8a256b7f749e2c8cb77ff465be643
Opcode Fuzzy Hash: 0292d8b8eab3677fa9ba4501796abc8586394f8e2187643a43b563ba1784f78b
Instruction Fuzzy Hash: 46D1EF7190C3589FD700CF64C984E6BBBE8AF99318F044A5DF99997251E331E788CB92

Function 228CA150 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 226COMMON

Download Yara Rule

Strings

idx, xrefs: 228CA200
data, xrefs: 228CA1E4
%s_data, xrefs: 228CA1BC
segid, term, pgno, PRIMARY KEY(segid, term), xrefs: 228CA1FB
id INTEGER PRIMARY KEY, block BLOB, xrefs: 228CA1DF

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s_data$data$id INTEGER PRIMARY KEY, block BLOB$idx$segid, term, pgno, PRIMARY KEY(segid, term)
API String ID: 0-1009905541
Opcode ID: d7de840011aa1720d0366bbe40e58fb851985e20e686df63b5ed6239141528d3
Instruction ID: 687efb1b90b3f450e3dbfafed5450f6274bf51ffbb3acd777bd30cdc9572f4df
Opcode Fuzzy Hash: d7de840011aa1720d0366bbe40e58fb851985e20e686df63b5ed6239141528d3
Instruction Fuzzy Hash: 7871C174948300DBD7149F74DD48B2B37A8BF4035AF044926FE0AA729ADB7EE914CB61

Function 228CF370 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 196COMMON

Download Yara Rule

Strings

content, xrefs: 228CF49D
k PRIMARY KEY, v, xrefs: 228CF544
id INTEGER PRIMARY KEY, sz BLOB, origin INTEGER, xrefs: 228CF51C
docsize, xrefs: 228CF52D
id INTEGER PRIMARY KEY, xrefs: 228CF43E
, c%d, xrefs: 228CF469
version, xrefs: 228CF560
id INTEGER PRIMARY KEY, sz BLOB, xrefs: 228CF524, 228CF52C
config, xrefs: 228CF549

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: , c%d$config$content$docsize$id INTEGER PRIMARY KEY$id INTEGER PRIMARY KEY, sz BLOB$id INTEGER PRIMARY KEY, sz BLOB, origin INTEGER$k PRIMARY KEY, v$version
API String ID: 0-3918257174
Opcode ID: 7e3b6dc88d35b5c41e8c775c8735e9f9c49b4f44beb2bc3864bf048f01ef3c18
Instruction ID: 14637c4bc1037d7310bf236906a4adf9d13ff25976fdd8ad8e291d667dac240c
Opcode Fuzzy Hash: 7e3b6dc88d35b5c41e8c775c8735e9f9c49b4f44beb2bc3864bf048f01ef3c18
Instruction Fuzzy Hash: F8514635900310DFE3149F28DC44B6B77A8FF94365F04462AFD48AB245DB39EA09CBA1

Function 227AA6C0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 195COMMON

Download Yara Rule

Strings

<polyline points=, xrefs: 227AA74B
%s, xrefs: 227AA82E
%g,%g', xrefs: 227AA7D1
%c%g,%g, xrefs: 227AA78E
></polyline>, xrefs: 227AA845

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %g,%g'$ %s$%c%g,%g$<polyline points=$></polyline>
API String ID: 0-3443809342
Opcode ID: c7d3c0fb0a040e92249266b05b9a7947b5a86d5a6c98e8042eed1d486b2bebd5
Instruction ID: 4e86c4ff9d94c80862918a81f6c88e73e3ef5ed556c8ae001505a3e1840f5767
Opcode Fuzzy Hash: c7d3c0fb0a040e92249266b05b9a7947b5a86d5a6c98e8042eed1d486b2bebd5
Instruction Fuzzy Hash: 43614570D087019BE7028F24CD65B6773B1AF52325F044729EC096B285E77DEA86CBE2

Function 228E8F40 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 177COMMON

Download Yara Rule

Strings

NULL, xrefs: 228E912E
NULL, xrefs: 228E9148
%lld, xrefs: 228E900C
%!.15g, xrefs: 228E8F83
%!.20e, xrefs: 228E8FF1

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %!.15g$%!.20e$%lld$NULL$NULL
API String ID: 0-2115304644
Opcode ID: 52bc37285cb26334f5b95a6b8465626e69ce3915b13eb6178174a3b6333416be
Instruction ID: e22781b2caf4645c7274de5f78ff5ecf3a9da92eeec911f62aaa925f7b8dc01c
Opcode Fuzzy Hash: 52bc37285cb26334f5b95a6b8465626e69ce3915b13eb6178174a3b6333416be
Instruction Fuzzy Hash: 99518879D08710DBE721DF188850AABB7E4EF92318F440A4DF89E67212E379D605C7A2

Function 227B3420 Relevance: 21.4, APIs: 6, Strings: 6, Instructions: 392COMMON

Download Yara Rule

Strings

API called with NULL prepared statement, xrefs: 227B3517
misuse, xrefs: 227B3552, 227B359E
%s at line %d of [%.10s], xrefs: 227B3557, 227B35A3
ATTACH x AS %Q, xrefs: 227B346F
API called with finalized prepared statement, xrefs: 227B352C, 227B3588
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227B3548, 227B3594

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ATTACH x AS %Q$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-2988319395
Opcode ID: 20e00194637f4ffecd53f1277155b6de362b21c181c7469f11108be1fa173f15
Instruction ID: b78f2ef65906b4be17f2ecb13b57f4fe112ddf22a3846feba8c23b78595bccab
Opcode Fuzzy Hash: 20e00194637f4ffecd53f1277155b6de362b21c181c7469f11108be1fa173f15
Instruction Fuzzy Hash: A3D1D4B0908301DBE7118F38C985B6B77E4BF54319F00492DED599F286E775E688CBA2

Function 2283EF60 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

,origin, xrefs: 2283F0D6, 2283F0DE

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: ,origin
API String ID: 0-4198660907
Opcode ID: 5db17e82efcca503811bae1f62ca89587aecbfd001a06b67031aae30542460d2
Instruction ID: da78fd6a43c42040795a11e9870795bdb8c2a5c40225d1bc66fd6dd1e0be31e1
Opcode Fuzzy Hash: 5db17e82efcca503811bae1f62ca89587aecbfd001a06b67031aae30542460d2
Instruction Fuzzy Hash: 6171ADB5408300DFC7129F58D98492BB7F5FFA8315F104E2DE98997260EB36E854CB82

Function 22884B10 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 156COMMON

Download Yara Rule

Strings

SELECT * FROM %Q.%Q, xrefs: 22884B25
misuse, xrefs: 22884C34
%s at line %d of [%.10s], xrefs: 22884C39
API called with finalized prepared statement, xrefs: 22884C1E
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 22884C2A
rtree constraint failed: %s.(%s<=%s), xrefs: 22884BF9
UNIQUE constraint failed: %s.%s, xrefs: 22884BC9

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$SELECT * FROM %Q.%Q$UNIQUE constraint failed: %s.%s$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$rtree constraint failed: %s.(%s<=%s)
API String ID: 0-2013246442
Opcode ID: 0f29a75576fc42a03d713985893b9815781e96cb83361c989646a98406bc6a5e
Instruction ID: e1b1a10b95c826a4594e3353000d6b70b0f6ab195e78618f951975d61215d2f8
Opcode Fuzzy Hash: 0f29a75576fc42a03d713985893b9815781e96cb83361c989646a98406bc6a5e
Instruction Fuzzy Hash: 2A41E376904309EFF7019FA59D84F6B379CAF90719F000929FE09A6285EB75E904C6B3

Function 22937C10 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 150COMMON

Download Yara Rule

Strings

winFullPathname1, xrefs: 22937CC9
%s%c%s, xrefs: 22937C7A
winFullPathname2, xrefs: 22937D35

Memory Dump Source

Source File: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s%c%s$winFullPathname1$winFullPathname2
API String ID: 0-2846052723
Opcode ID: a8eaa93bb1f46b35ff6582d162dab28f1e9a82044e12fa2df814ff3e9006fb27
Instruction ID: eb8ba2876b773aeddd1aa43a2b05bdf9cb0e561de243cbe7f8c268e34e188036
Opcode Fuzzy Hash: a8eaa93bb1f46b35ff6582d162dab28f1e9a82044e12fa2df814ff3e9006fb27
Instruction Fuzzy Hash: E041BDB2A083006BF7135734BD44FF7379D9F92724F0406ADF98956282DB67DA42C262

Function 22884920 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 132COMMON

Download Yara Rule

Strings

_parent, xrefs: 22884A6D
_rowid, xrefs: 22884A57
SELECT * FROM %Q.%Q, xrefs: 228849AA
SELECT * FROM %Q.'%q_rowid', xrefs: 2288496D
Schema corrupt or not an rtree, xrefs: 228849DC

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: SELECT * FROM %Q.%Q$SELECT * FROM %Q.'%q_rowid'$Schema corrupt or not an rtree$_parent$_rowid
API String ID: 0-2087119806
Opcode ID: 256cbd5b30f153d263e442475ed6b417a729293384c80fde6fedef6b0d73d850
Instruction ID: 180d5bd2ff7e51e2014f151d2b1ca37548f4350d0d16f839cc8381b56cad473b
Opcode Fuzzy Hash: 256cbd5b30f153d263e442475ed6b417a729293384c80fde6fedef6b0d73d850
Instruction Fuzzy Hash: 3241EBB6908309EBC300DB68DD8496FB7E9AFE8714F001A2EF885D7140E2B0D944CB93

Function 2292AAD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 130COMMON

Download Yara Rule

Strings

API called with NULL prepared statement, xrefs: 2292AAD9
misuse, xrefs: 2292AB15, 2292AB56, 2292ABAA
%s at line %d of [%.10s], xrefs: 2292AB1A, 2292AB5B, 2292ABAF
bind on a busy prepared statement: [%s], xrefs: 2292AB94
API called with finalized prepared statement, xrefs: 2292AAEF
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2292AB0B, 2292AB4C, 2292ABA0

Memory Dump Source

Source File: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$bind on a busy prepared statement: [%s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3679126755
Opcode ID: ec4134883fb3fdecac1e2f04710fbed279dbabcfe4fa32a7b23606c3f3166ba2
Instruction ID: fc04d43e77fc638da832c318b2a0dfcd7c6a7961fac0cbf96ad895d9b26315ed
Opcode Fuzzy Hash: ec4134883fb3fdecac1e2f04710fbed279dbabcfe4fa32a7b23606c3f3166ba2
Instruction Fuzzy Hash: CC41FF32704B049BF710CF28EC94F8673E8AF94319F004669FA59AB2C9E679D580C752

Function 228CECF0 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 335COMMON

Download Yara Rule

Strings

content, xrefs: 228CEFDF
docsize, xrefs: 228CF020

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: content$docsize
API String ID: 0-1024698521
Opcode ID: 5e36346f595a908c3b2e4041c77eacd30914104ce398fe5ad456f314b84d6386
Instruction ID: 8b494a0dbbc28f299789422709621349aa4ae93e520ae2ed6e181c4b0e0f9287
Opcode Fuzzy Hash: 5e36346f595a908c3b2e4041c77eacd30914104ce398fe5ad456f314b84d6386
Instruction Fuzzy Hash: 99C11376904311EBE315CF14C980B6BB3E4BFA4764F000A2AFD48AB251D775E945CBD2

Function 22855470 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 225COMMON

Download Yara Rule

Strings

%lld, xrefs: 2285550D
%!0.15g, xrefs: 228554D2
JSON cannot hold BLOB values, xrefs: 22855697

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %!0.15g$%lld$JSON cannot hold BLOB values
API String ID: 0-1047910854
Opcode ID: 41c78d3d7402d3f83724cd6828c5331899cb1599f7016f1e5a358e6e16ee399f
Instruction ID: 26ea3a9c01f481ba5b49d6dd7a7a6b0494cc41ecd1ed1e0a4b35fdfe7f6a8f96
Opcode Fuzzy Hash: 41c78d3d7402d3f83724cd6828c5331899cb1599f7016f1e5a358e6e16ee399f
Instruction Fuzzy Hash: 2B519E7A504300EAE3115A18DC41FBB37E6DF92335F15035DFA455B283EB6BE27582A2

Function 227D2B70 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 183COMMON

Download Yara Rule

Strings

("%s", xrefs: 227D2C4A
,arg HIDDEN, xrefs: 227D2C7A
,schema HIDDEN, xrefs: 227D2CD2
%c"%s", xrefs: 227D2C1B
ABLE x, xrefs: 227D2BB6

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %c"%s"$("%s"$,arg HIDDEN$,schema HIDDEN$ABLE x
API String ID: 0-1763475469
Opcode ID: fd93d78fd90f4ac45234106eba34131e91826578ce8a5c6f287979c076979dde
Instruction ID: ef2f760c73df64998a6a84143148fa285980a0e7b2bfb2001d8044da8b62d697
Opcode Fuzzy Hash: fd93d78fd90f4ac45234106eba34131e91826578ce8a5c6f287979c076979dde
Instruction Fuzzy Hash: 6B71AF7590C3819BD304CF24C954B6AFBE8FFA9308F404A5EF88897252E775D649CB92

Function 22886380 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

K{", xrefs: 22886381, 228864AB, 228864BE, 228864DC

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: K{"
API String ID: 0-1312522894
Opcode ID: 1491bce23fd771879a6a8bbcf84140d441abe81e15094e1345b1eb367d2da3b6
Instruction ID: 2bc2d89a4569ff5942c48ea0698255f8632bd265d9d4b0a82415ee0a87d22d46
Opcode Fuzzy Hash: 1491bce23fd771879a6a8bbcf84140d441abe81e15094e1345b1eb367d2da3b6
Instruction Fuzzy Hash: B941E530848704DFC7119F24DD5CA2B77B4BF5032AF04493AED09926ADDBBAE854CB62

Function 2284AA40 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 334COMMON

Download Yara Rule

Strings

API called with NULL prepared statement, xrefs: 2284AA87
misuse, xrefs: 2284AAC2, 2284AD8C
%s at line %d of [%.10s], xrefs: 2284AAC7, 2284AD91
API called with finalized prepared statement, xrefs: 2284AA9C, 2284AD76
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2284AAB8, 2284AD82

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-860711957
Opcode ID: a7a95c4e6fcab5ef73828d82a09eda7b3e05b147538bea6fa5f65a4253ee019d
Instruction ID: c9f233bf0ccf0f977f9f16b1723ba30ae906cb48365658b23aec38cfa7f8e594
Opcode Fuzzy Hash: a7a95c4e6fcab5ef73828d82a09eda7b3e05b147538bea6fa5f65a4253ee019d
Instruction Fuzzy Hash: D6B105B9E04708DBE7108F289D64B5B73D4AF54319F00052DE99A9F282EF79E604D7A2

Function 227CA170 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 286COMMON

Download Yara Rule

Strings

JSON path error near '%q', xrefs: 227CA3D7
malformed JSON, xrefs: 227CA283

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: JSON path error near '%q'$malformed JSON
API String ID: 0-560895927
Opcode ID: 9c04a91e32396ec4aa5ce642ae5c2866423ee6cc9030abb39909ea4a6fd4e309
Instruction ID: 84d9ac2ece51476355b82adec232fc5dc1eb48998a43c21ea94c9c25d1223488
Opcode Fuzzy Hash: 9c04a91e32396ec4aa5ce642ae5c2866423ee6cc9030abb39909ea4a6fd4e309
Instruction Fuzzy Hash: 8AA14CB19083008FD714CF38D844B67B7E5EFD031AF24466DE9858B242E77AEA59CB91

Function 227D3D20 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 223COMMON

Download Yara Rule

Strings

%Q., xrefs: 227D3E11
=%Q, xrefs: 227D3E7F
PRAGMA , xrefs: 227D3DC5

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %Q.$=%Q$PRAGMA
API String ID: 0-2099833060
Opcode ID: e9a6c50dd2d56458e1182c85615c515e3baa3cd35b9d132b3db2685a9bfc3715
Instruction ID: 0153d00b9498a7baf114d03df925340960d3962a4e60129c7d7e0ccf7f68d87c
Opcode Fuzzy Hash: e9a6c50dd2d56458e1182c85615c515e3baa3cd35b9d132b3db2685a9bfc3715
Instruction Fuzzy Hash: 8671C57290C3009BD700DF28D944B5BB7A8BF94319F440669FD45AF296D739D909CFA2

Function 227BB980 Relevance: 16.7, APIs: 11, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 415108078d8d1a1e71999164220a4a5647e3ed2e8cdb590856a125eb823295f3
Instruction ID: 2301752bbc7b3f70de0f66bc6a4dde390464aeb475d9c082afd38b6ff56c6dc1
Opcode Fuzzy Hash: 415108078d8d1a1e71999164220a4a5647e3ed2e8cdb590856a125eb823295f3
Instruction Fuzzy Hash: B281557180C3418BD7118F208A9072BBBE1FF96318F54266DFDD46721AD735CA96C792

Function 227FF600 Relevance: 16.7, APIs: 11, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a70c7127cf5330d89c7d45b3115e672d80e76ffd15e8db3879d2d7a1d690e5da
Instruction ID: e88d9122293dae7f6ef40c5be57b4f39915ba8f1101f49b7aa9821c8dfd6bce0
Opcode Fuzzy Hash: a70c7127cf5330d89c7d45b3115e672d80e76ffd15e8db3879d2d7a1d690e5da
Instruction Fuzzy Hash: 1F51C171A0C301ABE701DE18DC81B6BB7E8EF94724F40052DF94497391EB25EA59C7A3

Function 22821940 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 345COMMON

Download Yara Rule

Strings

block, xrefs: 22821A90
misuse, xrefs: 22821B21
%s at line %d of [%.10s], xrefs: 22821B26
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 22821B17

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$block$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-4016964285
Opcode ID: ebcf22fbabbaa295735df5948a85d282d3b641691293bebf8abfb8484eaf3fdb
Instruction ID: e4db8324fbfafa41f37df1a4d756afe9ab423a3e157874de19dc863e71ee1f9b
Opcode Fuzzy Hash: ebcf22fbabbaa295735df5948a85d282d3b641691293bebf8abfb8484eaf3fdb
Instruction Fuzzy Hash: DCC1F1B8904784DFDB10CF28C984A7A37A4FF44315F14466AFD099B267E735DA90CBA2

Function 227CFED0 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 257COMMON

Download Yara Rule

Strings

%llu, xrefs: 227CFF3C
unknown error, xrefs: 227D003E
no more rows available, xrefs: 227D006F
another row available, xrefs: 227D0076, 227D0081
%llu, xrefs: 227CFFF7
abort due to ROLLBACK, xrefs: 227D0068

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %llu$%llu$abort due to ROLLBACK$another row available$no more rows available$unknown error
API String ID: 0-1539118790
Opcode ID: 28f10a22a6ba621a4c8badd344ed8f26adb832511271830d570aa4ed2397701d
Instruction ID: 107f6d8b38c64bc2329905463ba9aed3e0033c34a62450bdd9ff3960fd1a205e
Opcode Fuzzy Hash: 28f10a22a6ba621a4c8badd344ed8f26adb832511271830d570aa4ed2397701d
Instruction Fuzzy Hash: 7591D4726083009BD704DF28C984BAEB7E1FF89358F44462EF9899B391D73AD945CB52

Function 228D70B0 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 227COMMON

Download Yara Rule

Strings

misuse, xrefs: 228D7217
%s at line %d of [%.10s], xrefs: 228D721C
invalid rootpage, xrefs: 228D715C, 228D730E
orphan index, xrefs: 228D72C2
API called with finalized prepared statement, xrefs: 228D7201
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 228D720D

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid rootpage$misuse$orphan index
API String ID: 0-165706444
Opcode ID: 125a014810e4f0921f1f0c87bfbf23937e6143204b2cd4770d9f889a190eb627
Instruction ID: 08a3149b5ab4593b43fd7cccc1286cf61f374d595cb81bc49ee39a6e76ad59ba
Opcode Fuzzy Hash: 125a014810e4f0921f1f0c87bfbf23937e6143204b2cd4770d9f889a190eb627
Instruction Fuzzy Hash: 97615A7BA04380EBEB119A349D80FDB77989F91329F080569ED4D96247E735E15CC3A2

Function 227C3A50 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 172COMMON

Download Yara Rule

Strings

read-only, xrefs: 227C3A71
bad page value, xrefs: 227C3BDC
bad page number, xrefs: 227C3BE3
no such schema, xrefs: 227C3BEA
cannot insert, xrefs: 227C3BF1, 227C3C52
cannot delete, xrefs: 227C3A82

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: bad page number$bad page value$cannot delete$cannot insert$no such schema$read-only
API String ID: 0-1499782803
Opcode ID: e5992117f019206521fa8fe56dac18cd4672c270c4cb8b4ff593da247409872c
Instruction ID: 1507d4752b1d8017853d29ca8abd0a9a68ecdfc8bd2b77d3b4ea5866996117e7
Opcode Fuzzy Hash: e5992117f019206521fa8fe56dac18cd4672c270c4cb8b4ff593da247409872c
Instruction Fuzzy Hash: 18512271A0C300CBD700DF28C981B2A37A4AF54359F14456AFD499F256E736E944C7AA

Function 227D9100 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 161COMMON

Download Yara Rule

Strings

API called with NULL prepared statement, xrefs: 227D910D
misuse, xrefs: 227D9148
%s at line %d of [%.10s], xrefs: 227D914D
API called with finalized prepared statement, xrefs: 227D9122
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227D913E

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-860711957
Opcode ID: 951172bc4efede4f4f593269ec7dddd297d2e777fe64318fb33fe0bb8e662c17
Instruction ID: 52d2c06eba970e6ffd0ecee78c90e135a560fa888156a1a6bcdafa823e2f1ce3
Opcode Fuzzy Hash: 951172bc4efede4f4f593269ec7dddd297d2e777fe64318fb33fe0bb8e662c17
Instruction Fuzzy Hash: 1E4156B2A0C700DBE7218E388C98B5B37D5AFD5324F04053CE955AB24AE776E505C3A2

Function 228E8340 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 145COMMON

Download Yara Rule

Strings

NULL, xrefs: 228E8369
misuse, xrefs: 228E8387
%s at line %d of [%.10s], xrefs: 228E838C
API call with %s database connection pointer, xrefs: 228E836E
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 228E837D
invalid, xrefs: 228E83B6
unopened, xrefs: 228E83BD

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$NULL$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse$unopened
API String ID: 0-538076154
Opcode ID: 2eefce38d2e22a4e89db20adb86ea3e0e2896bca547cdb2ff7f4872d4ae5194b
Instruction ID: 03f946fa6cb941cf46d1417a1a31306a35f5ad615c5686e3dce754bc08715850
Opcode Fuzzy Hash: 2eefce38d2e22a4e89db20adb86ea3e0e2896bca547cdb2ff7f4872d4ae5194b
Instruction Fuzzy Hash: 66417978608304EBD7118A288D80FAF7795EF82719FC8855DFD4E5B266E636D504C362

Function 228DB0E0 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 117COMMON

Download Yara Rule

Strings

NULL, xrefs: 228DB0F4
misuse, xrefs: 228DB112
%s at line %d of [%.10s], xrefs: 228DB117
API call with %s database connection pointer, xrefs: 228DB0F9
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 228DB108
invalid, xrefs: 228DB13E
unopened, xrefs: 228DB145

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$NULL$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse$unopened
API String ID: 0-538076154
Opcode ID: 8b4d7569188be2f28f1df1a3ad4875c684696f7a2c12c77112ab4cb5e2569ee3
Instruction ID: 7bc471102912d171d84fccde5ffa955d95e456113ab06b859ec67215e76a2b09
Opcode Fuzzy Hash: 8b4d7569188be2f28f1df1a3ad4875c684696f7a2c12c77112ab4cb5e2569ee3
Instruction Fuzzy Hash: 69319A7B608348EBEB115E749C40B5B7795AF89329F000639F9AD63142E775E60DC393

Function 227D6F30 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 83COMMON

Download Yara Rule

Strings

misuse, xrefs: 227D6F6A
%s at line %d of [%.10s], xrefs: 227D6F6F
API call with %s database connection pointer, xrefs: 227D6F54
bad parameter or other API misuse, xrefs: 227D6F7E
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227D6F60
invalid, xrefs: 227D6F4F
out of memory, xrefs: 227D6F39, 227D6FA0

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$bad parameter or other API misuse$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse$out of memory
API String ID: 0-2911740470
Opcode ID: 11e85bdffcb42e63b977c756832ad5eb8a99b4268d773f36569c5a1a61016a55
Instruction ID: 351896ea895bc101f83d31119f4e87f2db5827d0b7d88e63a6f3aa997f5cc16c
Opcode Fuzzy Hash: 11e85bdffcb42e63b977c756832ad5eb8a99b4268d773f36569c5a1a61016a55
Instruction Fuzzy Hash: EF21497364CB1097E7218318F980F9723A26FC6319F58452DE5956728AD735E847C282

Function 227C06F0 Relevance: 15.2, APIs: 10, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2117bf035cc78a99e5ba3fd1623b11ce72b7f4bb53d721c8d994d41c42293dc7
Instruction ID: 89fe27c0f9f13e5dad095d2264540f78cdc7e886d52b61ae3be027f21f47ba7f
Opcode Fuzzy Hash: 2117bf035cc78a99e5ba3fd1623b11ce72b7f4bb53d721c8d994d41c42293dc7
Instruction Fuzzy Hash: ED7115B590C3018BEB08DF34C892B5A73E4EF94314F44426DED859B206E336D955CBD2

Function 227FF4B0 Relevance: 15.1, APIs: 10, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d47789057f54d3d5d235375a09c406a209fee87bea1c44866fc0f5d3bf2f426b
Instruction ID: 585770e3d8cb8d5f1bc14ac1892cb28a57852bce3f68fb13d8d01c10edf49f9c
Opcode Fuzzy Hash: d47789057f54d3d5d235375a09c406a209fee87bea1c44866fc0f5d3bf2f426b
Instruction Fuzzy Hash: 7021BFA690C32176E312AA209D19FAF339C5F61366F044518FE14A7282FF74D70582B3

Function 227BE170 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 445COMMON

Download Yara Rule

Strings

unable to delete/modify user-function due to active statements, xrefs: 228313BF, 228314B8
fts5vocab, xrefs: 22831340
fts5_source_id, xrefs: 2283148D, 228314E0
fts5, xrefs: 22831053, 22831395, 228313E7
unicode61, xrefs: 22831279, 2283130F
snippet, xrefs: 22831200
porter, xrefs: 228312BF

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: fts5$fts5_source_id$fts5vocab$porter$snippet$unable to delete/modify user-function due to active statements$unicode61
API String ID: 0-2986783930
Opcode ID: 4215128f4aee84f87935640ce940f8f8d0c8138aed54cdd748dbf910015054a3
Instruction ID: 8511635d6e75ad5daded839fa780f59041845d4976811c02589878f483e59dc1
Opcode Fuzzy Hash: 4215128f4aee84f87935640ce940f8f8d0c8138aed54cdd748dbf910015054a3
Instruction Fuzzy Hash: 8EF1F5B8944701DBE702CF24CD84B2B7BA5BF40B49F004A29FD0997296E7B9D654CBD2

Function 228BFB30 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 324COMMON

Download Yara Rule

Strings

API called with NULL prepared statement, xrefs: 228BFB65
misuse, xrefs: 228BFBA0
%s at line %d of [%.10s], xrefs: 228BFBA5
API called with finalized prepared statement, xrefs: 228BFB7A
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 228BFB96

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-860711957
Opcode ID: bf568f86cc356a64c1426507c735a9b8cc378fff82572b4ff3b79a94dc5f6b78
Instruction ID: edca9f7c25ecec43c67340c4c7e15ae200f53b702eb6ec398413b2d82b8fd29f
Opcode Fuzzy Hash: bf568f86cc356a64c1426507c735a9b8cc378fff82572b4ff3b79a94dc5f6b78
Instruction Fuzzy Hash: 9BB19FB8904704DBE7208F28D954B1B77E4AF64319F04492CF98DDB342EB76E545CBA2

Function 22831710 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 235COMMON

Download Yara Rule

Strings

%z%s%Q, xrefs: 2283180D
%z, %Q HIDDEN, %s HIDDEN), xrefs: 22831831
rank, xrefs: 22831824
CREATE TABLE x(, xrefs: 228317D9

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %z%s%Q$%z, %Q HIDDEN, %s HIDDEN)$CREATE TABLE x($rank
API String ID: 0-3324442540
Opcode ID: 5aca53f15f04fabc37c7d02291e2f4c52debe85addf42759a9e707d3c0605a0c
Instruction ID: bad321b6d547ac647dcf1bff6e1295cd0e321ca4ca9a74b4789293be9fb24bd5
Opcode Fuzzy Hash: 5aca53f15f04fabc37c7d02291e2f4c52debe85addf42759a9e707d3c0605a0c
Instruction Fuzzy Hash: 2A81F275A04304DBDB028F68DD44B2AB7E8FF4475AF040A2AFC49A7261D779D950CBD2

Function 227FE320 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 177COMMON

Download Yara Rule

Strings

misuse, xrefs: 227FE380
%s at line %d of [%.10s], xrefs: 227FE385
API called with finalized prepared statement, xrefs: 227FE36A
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227FE376

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3620335220
Opcode ID: 6872ac6621e45fe4098cfd45d14d3bb6d833a8b0ae2b4771d115f8e49dc94bec
Instruction ID: 06dbea2f98cdde6c50aaa597262023ba899d7eba5d72c6a468d28dfc2aa47450
Opcode Fuzzy Hash: 6872ac6621e45fe4098cfd45d14d3bb6d833a8b0ae2b4771d115f8e49dc94bec
Instruction Fuzzy Hash: 96519171D4C305EBE7019F64C94CB7A37A4AF0435AF04482AFE09A7399D779E544CBA2

Function 228A74A0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 175COMMON

Download Yara Rule

Strings

misuse, xrefs: 228A74D7
%s at line %d of [%.10s], xrefs: 228A74DC
API call with %s database connection pointer, xrefs: 228A74C1
unable to close due to unfinalized statements or unfinished backups, xrefs: 228A75D1
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 228A74CD
invalid, xrefs: 228A74BC

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 0-3800776574
Opcode ID: 3d58bc4305d713926c90aeb247a1c2274f886f5c226beb7eef75052e1f98d3ae
Instruction ID: 51dd14034fdc3f1330a1c1600e53dfd31de5452d7a11fe86f0098c5e719f7cad
Opcode Fuzzy Hash: 3d58bc4305d713926c90aeb247a1c2274f886f5c226beb7eef75052e1f98d3ae
Instruction Fuzzy Hash: 0D514A79A04B00EBE3119B38ED64BAF77E5AF40319F040429E95D93246EF34F645D2A7

Function 2284BCF0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 103COMMON

Download Yara Rule

Strings

PRAGMA %Q.page_size, xrefs: 2284BD03
undersize RTree blobs in "%q_node", xrefs: 2284BDA1
SELECT length(data) FROM '%q'.'%q_node' WHERE nodeno = 1, xrefs: 2284BD67

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: PRAGMA %Q.page_size$SELECT length(data) FROM '%q'.'%q_node' WHERE nodeno = 1$undersize RTree blobs in "%q_node"
API String ID: 0-3485589083
Opcode ID: 15d3306450315e8a90f9e39f0442af4d3385a7f08d3c45c6a737e9b64e5203d6
Instruction ID: fb993d7195153d42a4d57b60380f32aea1874c221854a15882428964c10f94a1
Opcode Fuzzy Hash: 15d3306450315e8a90f9e39f0442af4d3385a7f08d3c45c6a737e9b64e5203d6
Instruction Fuzzy Hash: 7C313B79E08309EFD3008F64CD44B2673A8FF5436AF000A67FD0596245DB7AE954CBA1

Function 228A32F0 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 464COMMON

Download Yara Rule

Strings

database corruption, xrefs: 228A36C2, 228A3707, 228A3767, 228A3818
%s at line %d of [%.10s], xrefs: 228A36C7, 228A370C, 228A376C, 228A381D
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 228A36B8, 228A36FD, 228A375D, 228A380E

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 4da7acd33cfffc2a8ad1710fdc936edd9e7b88d534521cbd3ce3d80508dc5687
Instruction ID: 86a225cd40a5a0ecf7e983e7072593cd7e827e0af327a94a76340501b9993a84
Opcode Fuzzy Hash: 4da7acd33cfffc2a8ad1710fdc936edd9e7b88d534521cbd3ce3d80508dc5687
Instruction Fuzzy Hash: E7F18878A08701DFD300CF28C990B67BBE0FF94315F4446A9E948DB252EB35E955C7A2

Function 227CE420 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 380COMMON

Download Yara Rule

Strings

%c%04d-%02d-%02d %02d:%02d:%06.3f, xrefs: 227CE717
d, xrefs: 227CE71D
unknown error, xrefs: 227CE76B
no more rows available, xrefs: 227CE79C
another row available, xrefs: 227CE7A3, 227CE7AE
abort due to ROLLBACK, xrefs: 227CE795

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %c%04d-%02d-%02d %02d:%02d:%06.3f$abort due to ROLLBACK$another row available$d$no more rows available$unknown error
API String ID: 0-322231948
Opcode ID: be5039725816e558bc4540329239199b58fdadbb701d04e904da57fc543a7f92
Instruction ID: 4b4c0e31e639a63a732b8f28c420d31ee36c9c999002ab661f19f3d889056987
Opcode Fuzzy Hash: be5039725816e558bc4540329239199b58fdadbb701d04e904da57fc543a7f92
Instruction Fuzzy Hash: A0E1BC71A0C3409BD705CF28C988B5BB7E5AF88308F54592DF989A7241E776E905CB93

Function 227D28E5 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 346COMMON

Download Yara Rule

Strings

unable to validate the inverted index for FTS5 table %s.%s: %s, xrefs: 227D2AA0
INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');, xrefs: 227D29F1
malformed inverted index for FTS5 table %s.%s, xrefs: 227D2A8A

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');$malformed inverted index for FTS5 table %s.%s$unable to validate the inverted index for FTS5 table %s.%s: %s
API String ID: 0-3572959941
Opcode ID: ca7b2d15c78d6d70f8215663a1cc7da709dc0e6faed9068926d6f9e495196468
Instruction ID: 7fa3cd398d8f1a7f91c270118088b7da755b181ffc07783bcdf0d026ab9803bc
Opcode Fuzzy Hash: ca7b2d15c78d6d70f8215663a1cc7da709dc0e6faed9068926d6f9e495196468
Instruction Fuzzy Hash: 46415B7290D300DBE3109F64DC08EBB77A8FF84266F00092AFD4592156D7799645CBA6

Function 227F00A0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 334COMMON

Download Yara Rule

Strings

database corruption, xrefs: 227F010E, 227F0266, 227F0411, 227F043C
%s at line %d of [%.10s], xrefs: 227F0113, 227F026B, 227F0416, 227F0441
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227F0104, 227F025C, 227F0407, 227F0432

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 8e892dc2ec1704914b00e1b78b30f30b43659fd7df5111fde570aed9395dc9ac
Instruction ID: 669f5f44ad51335aeb0caef518c4050b10afd599ed8538f97b9a9731fe98e054
Opcode Fuzzy Hash: 8e892dc2ec1704914b00e1b78b30f30b43659fd7df5111fde570aed9395dc9ac
Instruction Fuzzy Hash: CEB1F871A0C3505FC304CB19C8D196BFBE0EFD4215F4846AEF9899B346D63AE549CBA2

Function 227FCEA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 286COMMON

Download Yara Rule

Strings

database corruption, xrefs: 227FCF52, 227FCF82, 227FD0A2, 227FD12B
%s at line %d of [%.10s], xrefs: 227FCF57, 227FCF87, 227FD0A7, 227FD130
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227FCF48, 227FCF78, 227FD098, 227FD121

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 27bbef1e1fa87063c900233b7f503d63a07b38fc9294bd93c8e4b9e2a1cb7e1f
Instruction ID: b573e1383a295be86c1a013643a8446e649331c8ac383604cf4b3dd62e75b1be
Opcode Fuzzy Hash: 27bbef1e1fa87063c900233b7f503d63a07b38fc9294bd93c8e4b9e2a1cb7e1f
Instruction Fuzzy Hash: 08913A3170C3955BC304DE2D98905BABFE0EB95225F8446BEF8C4D7782E12DD609D7A2

Function 227B9700 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 277COMMON

Download Yara Rule

Strings

(FK), xrefs: 227B98D3

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: (FK)
API String ID: 0-1642768157
Opcode ID: 66e63eb507a2b5f4b6408283f89113c6588e503182de66bd65fe530747d6bda5
Instruction ID: fb30fe53ea3fcaf675d283a2f16db931c5f42da90efa976190e350f26bf8732a
Opcode Fuzzy Hash: 66e63eb507a2b5f4b6408283f89113c6588e503182de66bd65fe530747d6bda5
Instruction Fuzzy Hash: EC81A1B67093009FE7109F29EC40B66B3A1FF89335F244BAEE655876A1E732E510DB50

Function 22938D80 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 271COMMON

Download Yara Rule

Strings

%s-shm, xrefs: 22938DF2
winOpenShm, xrefs: 22938FB9
readonly_shm, xrefs: 22938F52

Memory Dump Source

Source File: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s-shm$readonly_shm$winOpenShm
API String ID: 0-2815843928
Opcode ID: 1d901bca5d077420ab8d43c2ce7f45e7b139a46eb0af9415b75697722f787a21
Instruction ID: 785ea91d3e67c8d200fa1ad1c3ac0ce90a6b35e6ea34933de8b6ea1eb9d3e66d
Opcode Fuzzy Hash: 1d901bca5d077420ab8d43c2ce7f45e7b139a46eb0af9415b75697722f787a21
Instruction Fuzzy Hash: 3291FFB0948301DFEB129F64CD44B2777A8BF00319F440A6AFD4597395EB79E918CBA2

Function 227CEB00 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 187COMMON

Download Yara Rule

Strings

database corruption, xrefs: 227CECD5
%s at line %d of [%.10s], xrefs: 227CECDA
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227CECCB
%.*s%s, xrefs: 227CEC88

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %.*s%s$%s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-894757972
Opcode ID: 5b396c7f2d188441224241fb12d1ac83089648e3f80a6a7de9945acb5cc28068
Instruction ID: 1889e1e90d18e0f75204e2afef757af4fb4880b5f54e6d05b4bd369fabf67ad9
Opcode Fuzzy Hash: 5b396c7f2d188441224241fb12d1ac83089648e3f80a6a7de9945acb5cc28068
Instruction Fuzzy Hash: F561F4716093019FD725CF38C980AABB7E1EF88314F044A6DE849AB341E735EA05CB91

Function 22859030 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 169COMMON

Download Yara Rule

Strings

database corruption, xrefs: 22859059, 2285918C, 228591C3, 228591EE
%s at line %d of [%.10s], xrefs: 2285905E, 22859191, 228591C8, 228591F3
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2285904F, 22859182, 228591B9, 228591E4

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: dc801d4149063430badc9eacdad152817435242670580a2613b151b139ba9715
Instruction ID: a87762c58d64938f8b4d1f69b1809bed69213714f18e85e4016020731ab54e20
Opcode Fuzzy Hash: dc801d4149063430badc9eacdad152817435242670580a2613b151b139ba9715
Instruction Fuzzy Hash: 97513479344310ABD310DB18C984BA7B7E0EBC8325F914969F58EC7682E33AE55587A2

Function 227A9DA0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 160COMMON

Download Yara Rule

Strings

[%!g,%!g],, xrefs: 227A9E7E
[%!g,%!g]], xrefs: 227A9EC0

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: [%!g,%!g],$[%!g,%!g]]
API String ID: 0-3388633204
Opcode ID: d4572a33f3163960c8ceb8a244fb1f9b1fdb0b50a17ca7546cf27b7faca553c7
Instruction ID: 1042ad9e6d7de26bac287fa1c6f69947e4ff99154c8ba538b33e34e7ef8bdaf0
Opcode Fuzzy Hash: d4572a33f3163960c8ceb8a244fb1f9b1fdb0b50a17ca7546cf27b7faca553c7
Instruction Fuzzy Hash: B4514430908705DBD720DF29C9E4B27B7B0BF56324F00472AFC099B255E7B5A5A5CB92

Function 227CF330 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 126COMMON

Download Yara Rule

Strings

unable to validate the inverted index for FTS%d table %s.%s: %s, xrefs: 227CF418
INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');, xrefs: 227CF33F
malformed inverted index for FTS%d table %s.%s, xrefs: 227CF3F3

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');$malformed inverted index for FTS%d table %s.%s$unable to validate the inverted index for FTS%d table %s.%s: %s
API String ID: 0-2809892521
Opcode ID: 6990f98e67296378d51ce4779e3c442b343b578ec4d4e0142759c67873ba84f1
Instruction ID: 9406ac742b4eb39077cc9dfb8b672d67b5151b7fcd5f60c56664e9e6a4f94116
Opcode Fuzzy Hash: 6990f98e67296378d51ce4779e3c442b343b578ec4d4e0142759c67873ba84f1
Instruction Fuzzy Hash: 0341C171949301EBE3109F78DC08B6B37A8FF40366F04492BFD05D6299DB399655CBA2

Function 227D6E30 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 30COMMON

Download Yara Rule

Strings

misuse, xrefs: 227D6E62
%s at line %d of [%.10s], xrefs: 227D6E67
API call with %s database connection pointer, xrefs: 227D6E4C
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227D6E58
invalid, xrefs: 227D6E47

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse
API String ID: 0-3670841456
Opcode ID: cd1ed5f7cd8743d99a7b7f06fce11abb16b95777bf3b5704bdb1b8c8c86c7335
Instruction ID: f4b30e1285998556322a66a087032d6c6d24e125ccfd9b19ee5e69f30f13a13e
Opcode Fuzzy Hash: cd1ed5f7cd8743d99a7b7f06fce11abb16b95777bf3b5704bdb1b8c8c86c7335
Instruction Fuzzy Hash: 69F0EC2574C3447BFB049228DED1BA53B553BD4B0AF80005CE7946E1CED31AC4435242

Function 227D6EB0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 29COMMON

Download Yara Rule

Strings

misuse, xrefs: 227D6EE5
%s at line %d of [%.10s], xrefs: 227D6EEA
API call with %s database connection pointer, xrefs: 227D6ECF
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227D6EDB
invalid, xrefs: 227D6ECA

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse
API String ID: 0-3670841456
Opcode ID: ded33d60949dce6b161db9b784ba01539817af1c36e33f05add456721d074183
Instruction ID: 35085f1e64e382de078065f83aa8d7e0e478c7f4bfc521712de97106c50d4151
Opcode Fuzzy Hash: ded33d60949dce6b161db9b784ba01539817af1c36e33f05add456721d074183
Instruction Fuzzy Hash: 78F06D2170CB88AFFB109264EEF1FA66BC62BD4717FC051A5F7546E1EAE729D4504202

Function 227C30F0 Relevance: 12.2, APIs: 8, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6833438bc04471f1a405ec283e47f6e12176d36a297d453c2c5bd2cd48545877
Instruction ID: c2f8b1d4b399c0660214ae96fb04bc881ef53633d5df8a3fb0e6415c47a3a1c7
Opcode Fuzzy Hash: 6833438bc04471f1a405ec283e47f6e12176d36a297d453c2c5bd2cd48545877
Instruction Fuzzy Hash: 8E517F7260C300AFDB41EB68FC44EAB7BE2AF95320F1945A8F1588B2B5E231CD519F41

Function 227BB6E0 Relevance: 12.1, APIs: 8, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d19373a277acf6bd3a130ebb97fdfd2da09db1d74ac12c4f107d146aca8b701
Instruction ID: e2ab9ee18f44e9ebfd01e21d817f848e4d194f7d22187a73d31bebbf13cdb2a4
Opcode Fuzzy Hash: 4d19373a277acf6bd3a130ebb97fdfd2da09db1d74ac12c4f107d146aca8b701
Instruction Fuzzy Hash: 9B1138F5C08310BFE6059B20EC54E6B77A9EFA2310F4406A9FC4587230E73AD919D6A2

Function 22817920 Relevance: 10.8, APIs: 7, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c0a64c567377825aa826e38cd61e7aab24cd6bc2d57a6723dcf8eefeade29f
Instruction ID: 258a48ae64e1252cdbe92652649a37db90e31db317eac2258d48511d07198890
Opcode Fuzzy Hash: d7c0a64c567377825aa826e38cd61e7aab24cd6bc2d57a6723dcf8eefeade29f
Instruction Fuzzy Hash: B3B1BEB6A04301ABD704CF29CD80A9ABBE5FF88364F44462DF949D3751E735E9248BA1

Function 227BE260 Relevance: 10.8, APIs: 7, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec056e94c6855e207708af7dd9cf427ae85f037b60d258d2ee65a10ec9d8eda9
Instruction ID: d2671bc5aa1eaba2f032b5160e6ecf167d8694d85b3abef6fb11aad25979a86d
Opcode Fuzzy Hash: ec056e94c6855e207708af7dd9cf427ae85f037b60d258d2ee65a10ec9d8eda9
Instruction Fuzzy Hash: EAA1F471A0C3508FD704CF28C991B5AFBE1AF85318F844A6DF99597392E331D985CB92

Function 227B5930 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 234COMMON

Download Yara Rule

Strings

unknown tokenizer: %s, xrefs: 227B5B28
CREATE TABLE x(input, token, start, end, position), xrefs: 227B5933
simple, xrefs: 227B5A38, 227B5A84, 227B5A95, 227B5B27

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: CREATE TABLE x(input, token, start, end, position)$simple$unknown tokenizer: %s
API String ID: 0-2679805236
Opcode ID: 7ab2c76f0c15e953ddf1f7f22a7c3ba8bd6afd6afbf2e5b3323c3485b4f3d529
Instruction ID: 893cab9d2e75f3e117b578531bb910dc85e406186f662ebfa2d70734f516c7bb
Opcode Fuzzy Hash: 7ab2c76f0c15e953ddf1f7f22a7c3ba8bd6afd6afbf2e5b3323c3485b4f3d529
Instruction Fuzzy Hash: 8771E4B19083068FC700CF28C944A5BB7E4FF85354F440629ED49E7215EB75EA09CB92

Function 228BF0E0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 216COMMON

Download Yara Rule

Strings

unable to delete/modify user-function due to active statements, xrefs: 228BF157, 228BF298
misuse, xrefs: 228BF1E6, 228BF327
%s at line %d of [%.10s], xrefs: 228BF1EB, 228BF32C
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 228BF1DC, 228BF31D

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$unable to delete/modify user-function due to active statements
API String ID: 0-3864549341
Opcode ID: a3b5d49681a2119e89a3a5b9c6cfe3b3a3b32260eddb2477a54425d5032685fb
Instruction ID: 66b3b17d643bcd1fafbeb2132e324f905e33edaadc27eb7fa9dcab7f32f44b90
Opcode Fuzzy Hash: a3b5d49681a2119e89a3a5b9c6cfe3b3a3b32260eddb2477a54425d5032685fb
Instruction Fuzzy Hash: 666125B9A00B01EBE3118B24CD45F5B7794AF61304F04462CF919DB7C2EFA9E254C7A2

Function 228444F0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 208COMMON

Download Yara Rule

Strings

instance, xrefs: 228446BF
row, xrefs: 228446A1
col, xrefs: 22844679
fts5vocab: unknown table type: %Q, xrefs: 228446DE

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: col$fts5vocab: unknown table type: %Q$instance$row
API String ID: 0-195232091
Opcode ID: 902c789f635572cfa880cbc6d760f466cdd202ce9ceae418bd20cb77c437f74c
Instruction ID: 8e72d115a7ef33a6895391bcfc30770fe27237103362fa8fc6550eef07fbeec8
Opcode Fuzzy Hash: 902c789f635572cfa880cbc6d760f466cdd202ce9ceae418bd20cb77c437f74c
Instruction Fuzzy Hash: 29614A78D49318CFD700CF689944A6A37A0BF4034AF40093AED09D7319DF39E909CBA6

Function 227D09C2 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

cannot UPDATE a subset of columns on fts5 contentless-delete table: %s, xrefs: 227D0B3B

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: cannot UPDATE a subset of columns on fts5 contentless-delete table: %s
API String ID: 0-2869280805
Opcode ID: e5bcbe75942b03939cd8dc710ad723b4fdab3270da79f45e999258837bc62d3a
Instruction ID: deee9bc000fbd43b0c877f2824167498f3e40ab836cd69bc87ef5b3d9ed8f340
Opcode Fuzzy Hash: e5bcbe75942b03939cd8dc710ad723b4fdab3270da79f45e999258837bc62d3a
Instruction Fuzzy Hash: CE41DE77709301AFD7009F58EC80AA6F3E4FF84329B1006BEEA0487611E772E914C7A1

Function 227C1120 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 169COMMON

Download Yara Rule

Strings

main, xrefs: 227C11A6
rbu_memory, xrefs: 227C11F5

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: main$rbu_memory
API String ID: 0-3973752345
Opcode ID: a47196413302546fc0ad83668c82f138bf47c8de813828265738da0d92ce3bab
Instruction ID: 7ddde74d83ff55e6ed2ef9402e01c5378bf1e0b5b96378109e0ea4907d6dfb85
Opcode Fuzzy Hash: a47196413302546fc0ad83668c82f138bf47c8de813828265738da0d92ce3bab
Instruction Fuzzy Hash: 5C51DC75A083019FD700CF69D944B2BB3E8AFA5329F00453AEE05D7365EB79E905CB91

Function 227C3F30 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 169COMMON

Download Yara Rule

Strings

separators=, xrefs: 227C40A3
remove_diacritics=1, xrefs: 227C3FA2
remove_diacritics=0, xrefs: 227C3FE1
remove_diacritics=2, xrefs: 227C4021
tokenchars=, xrefs: 227C406A

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: remove_diacritics=0$remove_diacritics=1$remove_diacritics=2$separators=$tokenchars=
API String ID: 0-131617836
Opcode ID: 2dacfb9a1c937226f1ac646a17c5bf92cb14bce614525c4d64895447ff34cd36
Instruction ID: b21a1a13d6559f5b66f4994eff67fc6c78393443c498aeb7c44b9edd0dd2e930
Opcode Fuzzy Hash: 2dacfb9a1c937226f1ac646a17c5bf92cb14bce614525c4d64895447ff34cd36
Instruction Fuzzy Hash: B7510376A083418BD3008F34D5A07A6B7B1FB56334F8445B8E8865F246D732EEC6CB55

Function 227B8C40 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 227B8D35
winAccess, xrefs: 227B8D60

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 0-1873940834
Opcode ID: 8e457de206d224e612edf141cadb5c1de1e67afaf28a834299cf734be3702a25
Instruction ID: eeba444c5e11a78699c0a456bb138ccf09eee837a56ae7edc083c36fd1bd1afb
Opcode Fuzzy Hash: 8e457de206d224e612edf141cadb5c1de1e67afaf28a834299cf734be3702a25
Instruction Fuzzy Hash: B34128B290D3029BD3019B29C995A5AFBE0BFA9314FD50A2BFD6553290E770D544C682

Function 228DE5B0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 147COMMON

Download Yara Rule

Strings

database corruption, xrefs: 228DE675
d., xrefs: 228DE6E7
%s at line %d of [%.10s], xrefs: 228DE67A
tVj, xrefs: 228DE6F7
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 228DE66B

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$tVj$d.
API String ID: 0-1527448856
Opcode ID: 87b2dd240ddafbc95b0ba9e25bcc0a714cb2e897bfe2965225c79742c35dad32
Instruction ID: bc7faa41a9f55ef2532fcf2c36e45186e09fc2a6304803c4dc652664ab615277
Opcode Fuzzy Hash: 87b2dd240ddafbc95b0ba9e25bcc0a714cb2e897bfe2965225c79742c35dad32
Instruction Fuzzy Hash: 1441237F500300DAD7119F74ED80B6AB7E4AF51348F0444A9F94D96113E732E54ECBA2

Function 228C9350 Relevance: 10.6, APIs: 7, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0e69ac88de6eff31e4ef0b442d6e853130ead8b4ef73a9bd554c38f8b437362
Instruction ID: 64bda6e5a24dfb74d0787b452ff41a8a0b19294cadcb245fd0f1d5c80378f933
Opcode Fuzzy Hash: b0e69ac88de6eff31e4ef0b442d6e853130ead8b4ef73a9bd554c38f8b437362
Instruction Fuzzy Hash: 08519174888700DBD7259B74DE4CB3B37B8BF0035AF004976ED0A922ADDB79E554CA62

Function 228515C0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 135COMMON

Download Yara Rule

Strings

null, xrefs: 228515EE
%!0.15g, xrefs: 2285160A
JSON cannot hold BLOB values, xrefs: 228516D9

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %!0.15g$JSON cannot hold BLOB values$null
API String ID: 0-3074873597
Opcode ID: 312c7b41a8970718e396833daa4bc303bf82a3b2c9747832fcefe8df4800478b
Instruction ID: f4f47dd309e5fb527c05e20ec7cde97079c1b7c5b31276a4dcc97186b4d20a82
Opcode Fuzzy Hash: 312c7b41a8970718e396833daa4bc303bf82a3b2c9747832fcefe8df4800478b
Instruction Fuzzy Hash: 7A417AB9600700EEE3115B18EC81BBA77E4DF51329F090629E555825E3D3A9D6B8C7E2

Function 227C1D50 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 132COMMON

Download Yara Rule

Strings

CREATE TABLE x( name TEXT, path TEXT, pageno INTEGER, pagetype TEXT, ncell INTEGER, payload INTEGER, unused INTEGER, mx_payload INTEGER, pgoffset INTEGER, pgsize INTEGER, schema TEXT HIDDEN, aggregate BOOLEAN HIDDEN), xrefs: 227C1E2C
no such database: %s, xrefs: 227C1E05

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: CREATE TABLE x( name TEXT, path TEXT, pageno INTEGER, pagetype TEXT, ncell INTEGER, payload INTEGER, unused INTEGER, mx_payload INTEGER, pgoffset INTEGER, pgsize INTEGER, schema TEXT HIDDEN, aggregate BOOLEAN HIDDEN)$no such database: %s
API String ID: 0-1404816483
Opcode ID: 395225741909a0ba59d3315fea67b9bfeea4d54373fd36eec4ff567eed560319
Instruction ID: 6b320379a072211d80fa216d425fdcf144cff6d9e0028533a7ace0e288c1d01e
Opcode Fuzzy Hash: 395225741909a0ba59d3315fea67b9bfeea4d54373fd36eec4ff567eed560319
Instruction Fuzzy Hash: 6D3104B2608309ABD3105F7ADC50B5BB7D8EFA5325F000679FD58DB241EAB6E90087A0

Function 2282C650 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

PRAGMA %Q.data_version, xrefs: 2282C67C

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: PRAGMA %Q.data_version
API String ID: 0-2870853266
Opcode ID: 395b9d5e69292d53cf274e7d4fbfd3deb2d73b098a33e913907099b632c6bc86
Instruction ID: 1d40f7582ead1bea3d4e579753267be19cbfff946cc93c22c19887ecb4e02bfa
Opcode Fuzzy Hash: 395b9d5e69292d53cf274e7d4fbfd3deb2d73b098a33e913907099b632c6bc86
Instruction Fuzzy Hash: 3411F67AB043048BD700DE19FC40657F3D1EF98322F50463AE90483611EB36E95DCBA2

Function 229805B4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,?,?,?,7D25026E,?,229806F5,?,?), ref: 22980675

Strings

api-ms-, xrefs: 2298060B
ext-ms-, xrefs: 2298061F

Memory Dump Source

Source File: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 4a898f2801a0033cb2faea501b9c3469d7c939c8e7d38e1de1f66fbf159fdb4e
Instruction ID: f1c6518ba91463f903e47be119de4fe231f34768710d522c3076510d0a579fa0
Opcode Fuzzy Hash: 4a898f2801a0033cb2faea501b9c3469d7c939c8e7d38e1de1f66fbf159fdb4e
Instruction Fuzzy Hash: E921E731A45321EBD7219B61CD84B9A379CAF85370F180761ED15A7285D634EE00CAE1

Function 227D9CD0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 74COMMON

Download Yara Rule

Strings

misuse, xrefs: 227D9CFB
%s at line %d of [%.10s], xrefs: 227D9D00
API called with finalized prepared statement, xrefs: 227D9CE5
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227D9CF1

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3620335220
Opcode ID: c92c5b1a94e236993069ed5ea756e6d83e421f60747530e0d9366faa8bd29a58
Instruction ID: b9e8fc3cb3be281879fe911a93b3d4219044286958fbd502529555284a78a8a8
Opcode Fuzzy Hash: c92c5b1a94e236993069ed5ea756e6d83e421f60747530e0d9366faa8bd29a58
Instruction Fuzzy Hash: 95113A77F08714E6E621567DBC84B8B73989FE076AF000039F949A6249E734F98582F3

Function 228531F0 Relevance: 9.5, APIs: 6, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fa955b9582c8a216e7ca38315e3518db2f4b8f013e875c7333221293173cfd1
Instruction ID: 3524b617cf801e81bace89e8b94a5ae47de7b55aedfe9e079d9344245c7d17b4
Opcode Fuzzy Hash: 3fa955b9582c8a216e7ca38315e3518db2f4b8f013e875c7333221293173cfd1
Instruction Fuzzy Hash: 66F12379A08340DFD701CF28D98076ABBE0BF84328F45466DED999F242D335E965CB92

Function 227D4E00 Relevance: 9.2, APIs: 6, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49252fcde28a64e624a4f541c8fcb6bbc6b7021668bd4929a31b34a39703505a
Instruction ID: 78391d931fd96455295d163d762d8602f7cfa8b9dea41d206e89b427724367be
Opcode Fuzzy Hash: 49252fcde28a64e624a4f541c8fcb6bbc6b7021668bd4929a31b34a39703505a
Instruction Fuzzy Hash: 6F819F72908301DBD700DF68D944B6A77E4FF8035AF84093AFD4497255D77AE918CBA2

Function 228D73E0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 369COMMON

Download Yara Rule

Strings

ase, xrefs: 228D768D
sqlite_temp_master, xrefs: 228D73F2
sqlite_master, xrefs: 228D73FD
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 228D776D

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: SELECT*FROM"%w".%s ORDER BY rowid$ase$sqlite_master$sqlite_temp_master
API String ID: 0-231581592
Opcode ID: 03e162ff213cfc08e289343b46bc0bdf4b1fbd984c34b91bbe24d13736279f61
Instruction ID: d1138641d3dcbed4997e8f098ba09e953abb895984b9b85db73d3825616e8164
Opcode Fuzzy Hash: 03e162ff213cfc08e289343b46bc0bdf4b1fbd984c34b91bbe24d13736279f61
Instruction Fuzzy Hash: 56E1E5B9A08345DFD701CF38C980BAABBE4BF55318F04462CF94897252E775E948CB92

Function 227C6DA0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 364COMMON

Download Yara Rule

Strings

recursively defined fts5 content table, xrefs: 227C6DE2

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: recursively defined fts5 content table
API String ID: 0-437020801
Opcode ID: 173cb074d4532d83488f46fc41afd731b1c0eafb67e658ff7142c1dde21d96b6
Instruction ID: 68cb145d84bea19b2896d40b8952683e27c198c6d462dc918dd9c0045988042e
Opcode Fuzzy Hash: 173cb074d4532d83488f46fc41afd731b1c0eafb67e658ff7142c1dde21d96b6
Instruction Fuzzy Hash: D3D1CC759083048FD705CF29C580796BBE5FFC9328F440A5EEC889B246DB79E985CB92

Function 22846180 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 335COMMON

Download Yara Rule

Strings

NEAR, xrefs: 2284642A
expected integer, got "%.*s", xrefs: 2284648D
fts5 expression tree is too large (maximum depth %d), xrefs: 22846349
fts5: syntax error near "%.*s", xrefs: 22846436

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: NEAR$expected integer, got "%.*s"$fts5 expression tree is too large (maximum depth %d)$fts5: syntax error near "%.*s"
API String ID: 0-2846580575
Opcode ID: f9ac13a6b8cf08c33786ae00018fd41185dc60a7a779147fac4e9e098a1a7444
Instruction ID: 05060862bb22834415f730e6a066ed2b7b6ec951d611e7ba5b7fd3d3716755fa
Opcode Fuzzy Hash: f9ac13a6b8cf08c33786ae00018fd41185dc60a7a779147fac4e9e098a1a7444
Instruction Fuzzy Hash: 18C1C2F8D0472AEFD7118F64C940F1AF7A8FF18318F048A19E9595B242EB75E561CBA0

Function 227DC0F0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 276COMMON

Download Yara Rule

Strings

database corruption, xrefs: 227DC11F, 227DC16A
%s at line %d of [%.10s], xrefs: 227DC124, 227DC16F
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227DC115, 227DC160

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: b839f10cba9dcbf652697cbb283c9afd7c0f977a074a3a0376b767291a6c0465
Instruction ID: 037855d4f12a589e6924418f2388f2b475335b0580ecad02be6293e5d5bf63d2
Opcode Fuzzy Hash: b839f10cba9dcbf652697cbb283c9afd7c0f977a074a3a0376b767291a6c0465
Instruction Fuzzy Hash: 1AA18DB66083019BC704DF6DD980A6BBBE5FFD8314F444A6DF9489B205E731E905CB92

Function 2284E4B0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 218COMMON

Download Yara Rule

Strings

database corruption, xrefs: 2284E589, 2284E5BC
%s at line %d of [%.10s], xrefs: 2284E58E, 2284E5C1
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2284E57F, 2284E5B2

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 6c18fafbd0a86f14a8e7a644306af176bb05bdc325cf30240961b513ddc0955a
Instruction ID: 7aded3478818522167048c822a87a9b7493fe7a14983e7ef1ef808dcfd992903
Opcode Fuzzy Hash: 6c18fafbd0a86f14a8e7a644306af176bb05bdc325cf30240961b513ddc0955a
Instruction Fuzzy Hash: 66712776A043499FC300CF29DD80A6BBBE0EF44315F44466DF988C3642E738EA58C7A2

Function 227E0970 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 207COMMON

Download Yara Rule

Strings

database corruption, xrefs: 227E0A9B, 227E0B7D
%s at line %d of [%.10s], xrefs: 227E0AA0, 227E0B82
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227E0A91, 227E0B73

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: c3c54c2dd75c2f5b97d3d1e919de18f624282f5fc1bfd9481ca8045bce3984ab
Instruction ID: 9b44c1f2859c951fe03497dab17d176c95925d664de1f52e4926a6efd445ebf2
Opcode Fuzzy Hash: c3c54c2dd75c2f5b97d3d1e919de18f624282f5fc1bfd9481ca8045bce3984ab
Instruction Fuzzy Hash: A861DEB57083048FCB04DF28D984E1A77E0FB98714F4506A9EC4EAB352E775D944CBA2

Function 228AABF0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 204COMMON

Download Yara Rule

Strings

unable to delete/modify user-function due to active statements, xrefs: 228AAD61
misuse, xrefs: 228AAE18
%s at line %d of [%.10s], xrefs: 228AAE1D
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 228AAE0E

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$unable to delete/modify user-function due to active statements
API String ID: 0-3864549341
Opcode ID: 10aaef45242fd565c3be385f371a4de2407d5a78dce053ee51513775b4581581
Instruction ID: 1135ab460d1c7ccaca7f7be52029634b7b11fe6aef9acae5aefc2b10312ca57f
Opcode Fuzzy Hash: 10aaef45242fd565c3be385f371a4de2407d5a78dce053ee51513775b4581581
Instruction Fuzzy Hash: A351E276604304EFD7108E24DD90B2BB7F4EF89359F04092DF6CA96651EB3AE911CB62

Function 227AA230 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 201COMMON

Download Yara Rule

Strings

misuse, xrefs: 227AA469, 227AA4A7
%s at line %d of [%.10s], xrefs: 227AA46E, 227AA4AC
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227AA45F, 227AA49D

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: 7d155d87a5fd3846fd88e62c22d40ee2d9ede53881653082ff683df46aceae55
Instruction ID: 36646cc1dc83fd3c152d5a484a76bb9d46538c2becef3e45d4de607decac74ab
Opcode Fuzzy Hash: 7d155d87a5fd3846fd88e62c22d40ee2d9ede53881653082ff683df46aceae55
Instruction Fuzzy Hash: 627137706083419FD711CF28C964BABB7F4AF95318F00462CF9599B242E77AE545C793

Function 227BA860 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 180COMMON

Download Yara Rule

Strings

stmt-pointer, xrefs: 227BA928
tables_used, xrefs: 227BA973, 227BA97B
bytecode, xrefs: 227BA96E
argument to %s() is not a valid SQL statement, xrefs: 227BA97C

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: argument to %s() is not a valid SQL statement$bytecode$stmt-pointer$tables_used
API String ID: 0-361449301
Opcode ID: 8af854fb817818082327936afd2e4acab3af0dd30166e6a54a0701d17655ed72
Instruction ID: f90a9780689102a6c59e256d1b510495b68a8fe3e1f97b924a194c7bdda28827
Opcode Fuzzy Hash: 8af854fb817818082327936afd2e4acab3af0dd30166e6a54a0701d17655ed72
Instruction Fuzzy Hash: 1661E371508701DFE710DF24CA85B6677E4FF48305F00092EE986D7682E77AE648DBA1

Function 227A2AF4 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 167COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,229E94C2,00000104), ref: 2299EFDB

Strings

<program name unknown>, xrefs: 2299EFEA
Runtime Error!Program: , xrefs: 2299EFA7
Microsoft Visual C++ Runtime Library, xrefs: 2299F070
..., xrefs: 2299F029

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID: FileModuleName
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 514040917-4022980321
Opcode ID: 61bff7f30ee4e639863b31750228430e5928a00386cf770e53a83720f75d8f92
Instruction ID: 80db3c6dba6dc030ea91bc71b2161428f2d5325538b5a67402080dd26dade5f2
Opcode Fuzzy Hash: 61bff7f30ee4e639863b31750228430e5928a00386cf770e53a83720f75d8f92
Instruction Fuzzy Hash: 44219732A403017AF23266208DA8FABA79C9FF53B4B040626FC0C93189FA12C614C290

Function 228CBF00 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 156COMMON

Download Yara Rule

Strings

NEAR, xrefs: 228CC03A
fts5: %s queries are not supported (detail!=full), xrefs: 228CC043
fts5 expression tree is too large (maximum depth %d), xrefs: 228CC070
phrase, xrefs: 228CC035, 228CC042

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: NEAR$fts5 expression tree is too large (maximum depth %d)$fts5: %s queries are not supported (detail!=full)$phrase
API String ID: 0-593389478
Opcode ID: 5bf0cf66f4c236bb4cc059e14ba4497efc1137ac512822182969c12b27f8c37e
Instruction ID: eb6506b3b503b015d159ca84b54b49678fffb69b661f68466fe4f2ece17e6d0e
Opcode Fuzzy Hash: 5bf0cf66f4c236bb4cc059e14ba4497efc1137ac512822182969c12b27f8c37e
Instruction Fuzzy Hash: 97411379600714DFD71CCE28CA80B1EB3E4EF95324F10466EEA4987622E776ED85CB81

Function 227D23D0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 150COMMON

Download Yara Rule

Strings

database %s is locked, xrefs: 227D2541
cannot detach database %s, xrefs: 227D24C3, 227D2547
main, xrefs: 227D2491
no such database: %s, xrefs: 227D24B4

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: cannot detach database %s$database %s is locked$main$no such database: %s
API String ID: 0-3838832555
Opcode ID: 1d577111c6548d1b9e6e48aac4991313b3cb1a5a90dc3a95f812fea76b19ee6e
Instruction ID: f22585ab1e1707b4f4880175abc714e75a6da2b53a59df320d07c056aead66f9
Opcode Fuzzy Hash: 1d577111c6548d1b9e6e48aac4991313b3cb1a5a90dc3a95f812fea76b19ee6e
Instruction Fuzzy Hash: 9951D2B26083019FD714CF14C9A0F16B7A5BFA4318F50865DE8599B293DBB1EC46CBA2

Function 227D4C00 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 143COMMON

Download Yara Rule

Strings

invalid arguments to fts4aux constructor, xrefs: 227D4C9E
temp, xrefs: 227D4C3E
CREATE TABLE x(term, col, documents, occurrences, languageid HIDDEN), xrefs: 227D4CCB

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: CREATE TABLE x(term, col, documents, occurrences, languageid HIDDEN)$invalid arguments to fts4aux constructor$temp
API String ID: 0-537686372
Opcode ID: aad0b51c659c38011adc0f970719d96024c20514741edd37f60e71ff1702254c
Instruction ID: 014474ef5978b35220994f8d716c7e64b04828f21ff81ff17488c2bf2aaaada8
Opcode Fuzzy Hash: aad0b51c659c38011adc0f970719d96024c20514741edd37f60e71ff1702254c
Instruction Fuzzy Hash: 134146771093009FC7198F58D9A0AA67BE0EF44325F0449B9ED998B212D732DA02DB70

Function 227EF490 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 143COMMON

Download Yara Rule

Strings

misuse, xrefs: 227EF4BA
%s at line %d of [%.10s], xrefs: 227EF4BF
unable to delete/modify collation sequence due to active statements, xrefs: 227EF533
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227EF4B0

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 0-3348720253
Opcode ID: 8da108f292f46b16f90eb482aea7b014a7337e18ac629d392eef5a641dbd9ce8
Instruction ID: 77609ebaeb7c396cd7691db0ff6b1ebfa5f2b48483a23f2e1291cb88289ded55
Opcode Fuzzy Hash: 8da108f292f46b16f90eb482aea7b014a7337e18ac629d392eef5a641dbd9ce8
Instruction Fuzzy Hash: 90417C722083109FD7108F28EC80B6AF7E4EF91329F14456EF6599B682EB32E505C772

Function 227DE030 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 127COMMON

Download Yara Rule

Strings

database corruption, xrefs: 227DE0F2, 227DE128
%s at line %d of [%.10s], xrefs: 227DE0F7, 227DE12D
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227DE0E8, 227DE11E

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: b52fe8b1fd20c2b0fe5038479b1671b506d202a8a593bd8e8f4e5a4cdb4beefc
Instruction ID: 36afe58c83af4070f61421ac0c4e5f1f9cda87e98a0bd5be4d34925bd290f3a5
Opcode Fuzzy Hash: b52fe8b1fd20c2b0fe5038479b1671b506d202a8a593bd8e8f4e5a4cdb4beefc
Instruction Fuzzy Hash: B14123727083015BD301DE29DDC0AAABBE0EB90626F4445BDF99983781E329E558C762

Function 227BC2B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

%!.*f, xrefs: 227BC3AE

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %!.*f
API String ID: 0-786758813
Opcode ID: 04bea675526806eb209d606da96153d64f370a1eb8323b1f3f165ea102ad42db
Instruction ID: 2c423bbf9449c0097cdd249ef06bf31186802356fbb015b0b7f73523fee63fb0
Opcode Fuzzy Hash: 04bea675526806eb209d606da96153d64f370a1eb8323b1f3f165ea102ad42db
Instruction Fuzzy Hash: AD314932C0CB108FD3039A38891266B7794AF96395F85C76DEC853B112E7369597C2E3

Function 2287EBD0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

Strings

database corruption, xrefs: 2287EC4C
CREATE , xrefs: 2287EBFF
%s at line %d of [%.10s], xrefs: 2287EC51
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2287EC42

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$CREATE $database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-1360532505
Opcode ID: 2e566d4bb1ed9ac8aff76af6131c7ce2917a46a9c75dfdd284de6d7979fd31b2
Instruction ID: 0bfa8808763f18423f2a0e56bce6785f0fe058f864f219643530d62d445b1294
Opcode Fuzzy Hash: 2e566d4bb1ed9ac8aff76af6131c7ce2917a46a9c75dfdd284de6d7979fd31b2
Instruction Fuzzy Hash: A6315C6F5043C1DAF7124A5D9980B927FE5AB9531AF1401BAF8884E143E766C190C732

Function 227D7050 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 98COMMON

Download Yara Rule

Strings

out of memory, xrefs: 227D7059, 227D70A2
API call with %s database connection pointer, xrefs: 227D7074
bad parameter or other API misuse, xrefs: 227D7083
invalid, xrefs: 227D706F

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: API call with %s database connection pointer$bad parameter or other API misuse$invalid$out of memory
API String ID: 0-453588374
Opcode ID: 627fed711a5483046d0fd30a8714d02cdf37ae69d099f2f744b534428a1427ce
Instruction ID: 5f14adbe1db52536c55efcaa5c2d699e5bf149b34e3317cf60340b02d9a76603
Opcode Fuzzy Hash: 627fed711a5483046d0fd30a8714d02cdf37ae69d099f2f744b534428a1427ce
Instruction Fuzzy Hash: B3315CB3A0C70087EB1446249D56BEB23969FD0309FA8462DE5459B28FE73BD947C392

Function 228593A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 93COMMON

Download Yara Rule

Strings

database corruption, xrefs: 22859450, 22859494
%s at line %d of [%.10s], xrefs: 22859455, 22859499
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 22859446, 2285948A

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: ca0f39c31d58d18ceabe870fa7cf2c182211c1cc1983f549483d083bb9d4b846
Instruction ID: dd29276e0f24c98def4de27216d67d9256f05476a8e1618e5382991bc28e1722
Opcode Fuzzy Hash: ca0f39c31d58d18ceabe870fa7cf2c182211c1cc1983f549483d083bb9d4b846
Instruction Fuzzy Hash: 183148396407508BD324DF28C8D0AB3BBF29F99315F55845CEACA4B786E332E952C791

Function 227E4F40 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 91COMMON

Download Yara Rule

Strings

database corruption, xrefs: 227E4F6C, 227E4FFD
%s at line %d of [%.10s], xrefs: 227E4F71, 227E5002
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227E4F62, 227E4FF3

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 5e27b1ba1ca4cca1f6a8ae8fa37b60ad0495bea47714b9a98b0507d7f886a4d7
Instruction ID: 3dc9833a625874d013ac7506fdc3ec25c3bd130bded29f3206d20a9de0c73b23
Opcode Fuzzy Hash: 5e27b1ba1ca4cca1f6a8ae8fa37b60ad0495bea47714b9a98b0507d7f886a4d7
Instruction Fuzzy Hash: 6A313B7620474167D3019F29D980BA6BBE0FF59311F084266F459DB682E325E560D7A1

Function 227B1C60 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 88COMMON

Download Yara Rule

Strings

unknown database: %s, xrefs: 227B1CBD
misuse, xrefs: 227B1D46
%s at line %d of [%.10s], xrefs: 227B1D4B
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227B1D3C

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$unknown database: %s
API String ID: 0-142545749
Opcode ID: b1f2387ca059ba9898123254b8e3338d5b10f883e6d2d54a7b83097caef1e5c9
Instruction ID: 523aba552c45be4f0cf60ffefe418c9d28ad42956534f9543bf8499fd4ca3b1d
Opcode Fuzzy Hash: b1f2387ca059ba9898123254b8e3338d5b10f883e6d2d54a7b83097caef1e5c9
Instruction Fuzzy Hash: B4214875609740ABE7109B2ADD44F9B7BA99FE235AF00052CF85857292E735D604C372

Function 227E3FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 85COMMON

Download Yara Rule

Strings

database corruption, xrefs: 227E4087, 227E40B2
%s at line %d of [%.10s], xrefs: 227E408C, 227E40B7
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227E407D, 227E40A8

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: a60fbd444758afbdba5fd053157b4a3e8b3017da830789e814e73a4b5ecdf0eb
Instruction ID: 6c67319ed3dee1a5910bc4745d8df43a55b4224bc9dbf26cbb0b1802d4d2b759
Opcode Fuzzy Hash: a60fbd444758afbdba5fd053157b4a3e8b3017da830789e814e73a4b5ecdf0eb
Instruction Fuzzy Hash: 272103B3A043115BD700EE1CDC81AAB7BD0EB98661F414176FD88E7345E339D65987E2

Function 228DC6F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

Strings

a CHECK constraint, xrefs: 228DC714, 228DC72B
non-deterministic use of %s() in %s, xrefs: 228DC732
a generated column, xrefs: 228DC722
an index, xrefs: 228DC71D

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s
API String ID: 0-3705377941
Opcode ID: 701f9b336e9d33b3f2f49afddd5c6b796ebce64ec090fce1ef1fd75c23712aa6
Instruction ID: 983dee9c17cf5bf6cf34116de702c7d440f55a712ec85cc20792dde214cdee30
Opcode Fuzzy Hash: 701f9b336e9d33b3f2f49afddd5c6b796ebce64ec090fce1ef1fd75c23712aa6
Instruction Fuzzy Hash: 11210575A08311EBDB009F2CD944E6637A5BF013A5F000726FE18D72D9D775E495C791

Function 22859290 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

Strings

database corruption, xrefs: 228592A6, 22859334
%s at line %d of [%.10s], xrefs: 228592AB, 22859339
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2285929C, 2285932A

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 52412533c4249133782e94f4922c853ac16661f651b15f74f5e42a60f45e51b3
Instruction ID: d6753982c16d6e98bdc89323f9333f1fbcd12b947a67efbcfd05a81fb0743022
Opcode Fuzzy Hash: 52412533c4249133782e94f4922c853ac16661f651b15f74f5e42a60f45e51b3
Instruction Fuzzy Hash: 5721BE29244B909BD321DF38C9D0AA3BFF19F55310F45455CE6DA97386F232E591C782

Function 227C33C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

CREATE TABLE x(pgno INTEGER PRIMARY KEY, data BLOB, schema HIDDEN), xrefs: 227C33D6

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: CREATE TABLE x(pgno INTEGER PRIMARY KEY, data BLOB, schema HIDDEN)
API String ID: 0-1935849370
Opcode ID: b699335528ddf7a9d16816843c97bd3544e1cefb4ee6107a45442a13dad6c000
Instruction ID: 977f86d12fad9a5e4647e9844afce2ad570667d5c4ab0bf3ba7b17091d801034
Opcode Fuzzy Hash: b699335528ddf7a9d16816843c97bd3544e1cefb4ee6107a45442a13dad6c000
Instruction Fuzzy Hash: 3501B5357483169BD702DF29E800B8AB3E5EFD5321F198276F6048F240EBB0A58787A1

Function 22883E10 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

Strings

Wrong number of entries in %%%s table - expected %lld, actual %lld, xrefs: 22883E6C
SELECT count(*) FROM %Q.'%q%s', xrefs: 22883E26

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: SELECT count(*) FROM %Q.'%q%s'$Wrong number of entries in %%%s table - expected %lld, actual %lld
API String ID: 0-3026403748
Opcode ID: f7fa12ae401d2b769953c1e977c6198603eab6e4add7876cafe5a0b164f2e133
Instruction ID: 080ee3a611740781ab2b4e3b56a93eac189a048370c0465cc169cdb1af5141e2
Opcode Fuzzy Hash: f7fa12ae401d2b769953c1e977c6198603eab6e4add7876cafe5a0b164f2e133
Instruction Fuzzy Hash: AFF04477C04300EBDB225A04AC84F2F36E5AFE4B10F04092CF18A66501E725EA509663

Function 22955BC1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,7D25026E,?,?,00000000,229AD1CB,000000FF,?,22955B30,?,?,22955ADF,?), ref: 22955BF6
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 22955C08
FreeLibrary.KERNEL32(00000000,?,?,00000000,229AD1CB,000000FF,?,22955B30,?,?,22955ADF,?), ref: 22955C2A

Strings

CorExitProcess, xrefs: 22955C00
mscoree.dll, xrefs: 22955BEF

Memory Dump Source

Source File: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 09f67c45de7db1386cbee7df2006e49296c18745c01dadafe475b3588897cfd3
Instruction ID: 0ab5924ddbbbf9e37ceffc864ff28be041580679aeb8359472ce3c00c1125241
Opcode Fuzzy Hash: 09f67c45de7db1386cbee7df2006e49296c18745c01dadafe475b3588897cfd3
Instruction Fuzzy Hash: B9016231A58619EFDB018F94CD85BFEB7BCFF48715F010966F911A2294DB7D9900CA50

Function 228C6A20 Relevance: 8.0, APIs: 5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f68c519d8659e617010452f4e4d12213a4ab36bacff945a95e4201603eedbca
Instruction ID: e091b944920830775667cdbb7ebd6db1b82ade4b148d3774cd9205ea6dd2ad2f
Opcode Fuzzy Hash: 0f68c519d8659e617010452f4e4d12213a4ab36bacff945a95e4201603eedbca
Instruction Fuzzy Hash: 0302ADB4908315CFD304DF69D944B2AB7E4BF84315F044A2EED4897351EBB8EA58CB92

Function 2282AF80 Relevance: 7.8, APIs: 5, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9a5cc3d8b441971322789130ce95b26c6c72635188c91a8c2f70f6551539e23
Instruction ID: 1b7104b67d1e38a4653500c44e2683a4424474f6a50952d457c7215cbdd395d4
Opcode Fuzzy Hash: d9a5cc3d8b441971322789130ce95b26c6c72635188c91a8c2f70f6551539e23
Instruction Fuzzy Hash: C9A1C174D4AB51DBD7119F74CA48B3A3374BF0035AF040A26ED09A3299D77CE994CBA2

Function 228C73C0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

fts5: syntax error near "%.*s", xrefs: 228C751C

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: fts5: syntax error near "%.*s"
API String ID: 0-498961494
Opcode ID: 470870f381066b2aa6a5afc6d41488733446517eec506df40cd473de701ab20b
Instruction ID: 143be77175b48954ecd7059a1063047975a8747af14d673927849e5d32e7ed9a
Opcode Fuzzy Hash: 470870f381066b2aa6a5afc6d41488733446517eec506df40cd473de701ab20b
Instruction Fuzzy Hash: CEB1D3B4808345DFD715CF28C980BAABBE8FF44348F04492EF88997251D774E685CBA6

Function 227E0F60 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 264COMMON

Download Yara Rule

Strings

database corruption, xrefs: 227E1282
%s at line %d of [%.10s], xrefs: 227E1287
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227E126C, 227E1278

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: e27da42917b306633eef7d4d41f68c1b4c65e8d913d51e859259d9ee80e1a26e
Instruction ID: 7e4fcd4d605d42a195ffe57bf59b0ba364895f144c1bf4a56f0831d431fd066a
Opcode Fuzzy Hash: e27da42917b306633eef7d4d41f68c1b4c65e8d913d51e859259d9ee80e1a26e
Instruction Fuzzy Hash: 41A19AB0548301CBD718CF64CA85B3737E8BF44209F44092EED5BAB226E735E954CBA2

Function 227C82E0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

[%d], xrefs: 227C84C7

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: [%d]
API String ID: 0-394612830
Opcode ID: de2618977de16a292c89b62205d3644ee7050a9ec960949f7f97fb1a67aa45f5
Instruction ID: dd59461c6eb92944a3815e2523eae2f1c75aeef5d6556ae63426855fa4b1e07c
Opcode Fuzzy Hash: de2618977de16a292c89b62205d3644ee7050a9ec960949f7f97fb1a67aa45f5
Instruction Fuzzy Hash: 0571F7B5908300AFDB22CE34DD80FA777E9AF95714F844A1DE98493281E375F619CB62

Function 228A6180 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 216COMMON

Download Yara Rule

Strings

database corruption, xrefs: 228A6391
%s at line %d of [%.10s], xrefs: 228A6396
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 228A6387

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 9637086e9b503374db8605f346ea343c1197e9da2c5cfc25061397d77986639e
Instruction ID: 34c6a6a74514ad20154ca327ab0869bf7e538338716ccd91f42153923579c57b
Opcode Fuzzy Hash: 9637086e9b503374db8605f346ea343c1197e9da2c5cfc25061397d77986639e
Instruction Fuzzy Hash: A171E379A08320CBDF00DF28C9E07AA7BE1EF54314F940959E899CB346EB35D945C752

Function 227E13A0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 214COMMON

Download Yara Rule

Strings

database corruption, xrefs: 227E1463
%s at line %d of [%.10s], xrefs: 227E1468
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227E1459

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 198f7d9b0e4842427e6f1cce95ce7b1163e5371618d104e40afedd2eef945f78
Instruction ID: d2962ab2dbf13aa3bfda8005f5bd39bc7afbf83f8450a3ef606681c9be578cab
Opcode Fuzzy Hash: 198f7d9b0e4842427e6f1cce95ce7b1163e5371618d104e40afedd2eef945f78
Instruction Fuzzy Hash: 177106B16083009FC709CF28C881B6777E4AF99314F154A99F89E9B352D731ED41CBA2

Function 227B7D30 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 199COMMON

Download Yara Rule

Strings

winShmMap2, xrefs: 227B7E1F
winShmMap3, xrefs: 227B7F1D
winShmMap1, xrefs: 227B7DC5

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: winShmMap1$winShmMap2$winShmMap3
API String ID: 0-3826999013
Opcode ID: d355f04e413e694b1bb592d118714818ca31e70d8930b13b6a05600d984b888b
Instruction ID: b07c66023e8c78095d8315a0387095da07782ddc5eea0d09581b192b4639c799
Opcode Fuzzy Hash: d355f04e413e694b1bb592d118714818ca31e70d8930b13b6a05600d984b888b
Instruction Fuzzy Hash: BD611EB2A08301DFD710CF24C999B67B7E5EF84744F00492DFA829B291EB74E806CB52

Function 22950FC2 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 22950FE7
CatchIt.LIBVCRUNTIME ref: 229510CD

Strings

RCC, xrefs: 22951001
MOC, xrefs: 22950FF9

Memory Dump Source

Source File: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 862df65eff53b22f98722e05ba3daf970d8a188de93baf03cffde88aa95df651
Instruction ID: 185c835a2c6a21a22ebdb5d6687cc048fb6a6db62db15dc113b1d5bd3741f9ef
Opcode Fuzzy Hash: 862df65eff53b22f98722e05ba3daf970d8a188de93baf03cffde88aa95df651
Instruction Fuzzy Hash: C2411772A00349EFCF06CFA4CA80AAE7BB9FF48314F148599EA1477261D2359A61DF50

Function 227E3060 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 184COMMON

Download Yara Rule

Strings

database corruption, xrefs: 227E309C
%s at line %d of [%.10s], xrefs: 227E30A1
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227E3092

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: e115d37379f251e6b7fdd1954169f1f6128a8c204705091cc5470ae0aef9e869
Instruction ID: c41dca22177b06801de7d86428fbe46260f9d8bef6469ed1c24fb516a20feb2d
Opcode Fuzzy Hash: e115d37379f251e6b7fdd1954169f1f6128a8c204705091cc5470ae0aef9e869
Instruction Fuzzy Hash: 4461C1756083459FC704DF68C880AABBBE4BF88704F40495DF9899B342E735D945CBA2

Function 227ADE5A Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 180COMMON

Download Yara Rule

Strings

(subquery-%u), xrefs: 227ADFB3
(join-%u), xrefs: 227ADFA1

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: (join-%u)$(subquery-%u)
API String ID: 0-2916047017
Opcode ID: bda52c536c52c049e99a17f28ba841b16ad4459f96b565469f003e35e534bad7
Instruction ID: 55b9dbeca7822edf6c3d1f94c98c0d5833934e7431542fdf8ac48a791580de85
Opcode Fuzzy Hash: bda52c536c52c049e99a17f28ba841b16ad4459f96b565469f003e35e534bad7
Instruction Fuzzy Hash: F051D67560C3409FCB18CF24C9A5A2B77E1BF96324F044B9DFDA95B246DA31D811CB91

Function 227B4CE0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 160COMMON

Download Yara Rule

Strings

wrong number of vtable arguments, xrefs: 22843FA9
temp, xrefs: 22843F91

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: temp$wrong number of vtable arguments
API String ID: 0-2849069181
Opcode ID: bc55ce37e5369fa92a2c36470620016334b613cde271e09841336972b9ac7c62
Instruction ID: ed61c719f9637f4e6baf15e953a7420e2a491084c9992dea8424370ea7784ccd
Opcode Fuzzy Hash: bc55ce37e5369fa92a2c36470620016334b613cde271e09841336972b9ac7c62
Instruction Fuzzy Hash: 105103B9908309CFC714CF18D55095ABBF1BF99304F404A6DE9895B702D732EA5ACF92

Function 2287C640 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 150COMMON

Download Yara Rule

Strings

database corruption, xrefs: 2287C7E7
%s at line %d of [%.10s], xrefs: 2287C7EC
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2287C785, 2287C791, 2287C7DD

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 48530fd65509667bd7c8856505331d7791b0220fee16d06a4f9c408de34b1013
Instruction ID: 48fcbf72d82c813f2763a85374e2040b736ede65d4bee03417ac64d93c0d582b
Opcode Fuzzy Hash: 48530fd65509667bd7c8856505331d7791b0220fee16d06a4f9c408de34b1013
Instruction Fuzzy Hash: A2518079608341DFD304CF28C8D086ABBF1FF99204F58599DE5869B352D731E986CBA2

Function 227E35E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148COMMON

Download Yara Rule

Strings

misuse, xrefs: 227E35F4
%s at line %d of [%.10s], xrefs: 227E35F9
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227E35EA

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: adb3b5e8f74bd83df839339492d37834a206775111e8ad919e39c0af0d721151
Instruction ID: 704c27617f933ad54e52b56667b502caf622d055d2cdc6a86664f706c4b75cd1
Opcode Fuzzy Hash: adb3b5e8f74bd83df839339492d37834a206775111e8ad919e39c0af0d721151
Instruction Fuzzy Hash: FB51D3F1A08315AFDB148F24C885B26BBA5FF54728F044269FD5E5F252E331E910CBA2

Function 228596B0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 136COMMON

Download Yara Rule

Strings

database corruption, xrefs: 228597EA
%s at line %d of [%.10s], xrefs: 228597EF
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 228597E0

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: aefd1569010c6cc1be82b05c625be1a5e89d4032c1d3c151da4b8c9fa7ac6a46
Instruction ID: ed04ec2acfef56b5f625fe03e20e731e54b5e0928098216bd6e13e75139d88e6
Opcode Fuzzy Hash: aefd1569010c6cc1be82b05c625be1a5e89d4032c1d3c151da4b8c9fa7ac6a46
Instruction Fuzzy Hash: E141257A204790CFD7318F7C9480693FFE09F91225F090CABE2D98B652E322E495D7A1

Function 227B0300 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 128COMMON

Download Yara Rule

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 227B03FF
winWrite2, xrefs: 227B043B
winWrite1, xrefs: 227B045E

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: delayed %dms for lock/sharing conflict at line %d$winWrite1$winWrite2
API String ID: 0-1808655853
Opcode ID: dff9d7f71522e3ad70abb12e5d42b2093ff368adea9169dde163efab976fe027
Instruction ID: 9e7fd65f2c4e281b33f5008b4ac7502997f8a77ffd1d14e698f2598d4de914ba
Opcode Fuzzy Hash: dff9d7f71522e3ad70abb12e5d42b2093ff368adea9169dde163efab976fe027
Instruction Fuzzy Hash: F64123B2A0C3029BD7049F28C98496FB7E8FFC5714F500A2EFA26D7291D735D5458B92

Function 22925960 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 126COMMON

Download Yara Rule

Strings

misuse, xrefs: 22925980
%s at line %d of [%.10s], xrefs: 22925985
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 22925976

Memory Dump Source

Source File: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: b2258654427b75eb9212a66c44551cc5839676b4e1eaaee51906871d8a8c13a6
Instruction ID: edbfe345968bf9d6607b793da30f02730d064288f71d2e686a9637226a47677d
Opcode Fuzzy Hash: b2258654427b75eb9212a66c44551cc5839676b4e1eaaee51906871d8a8c13a6
Instruction Fuzzy Hash: 734129769007009BD3149B14CD91B9AB7E8BF98320F840669FD449B245E739EA98C392

Function 2287D2E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 119COMMON

Download Yara Rule

Strings

database corruption, xrefs: 2287D301
%s at line %d of [%.10s], xrefs: 2287D306
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2287D2F7

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 365c2bde37538da136d6ae8c163c5c60004d6a1b7b74b6d7e6f5f12a396cfc8a
Instruction ID: c26a80ccec6c5eff459a668395aee1c87b9466ba3d30a21b32d7075e34db754c
Opcode Fuzzy Hash: 365c2bde37538da136d6ae8c163c5c60004d6a1b7b74b6d7e6f5f12a396cfc8a
Instruction Fuzzy Hash: 1E31D3BA505300AFD7119A18CC40F5BBBF8EB94364F444929FA49A7292F722E951CB92

Function 22938850 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 2293895F
os_win.c:%d: (%lu) %s(%s) - %s, xrefs: 229388E2

Memory Dump Source

Source File: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: delayed %dms for lock/sharing conflict at line %d$os_win.c:%d: (%lu) %s(%s) - %s
API String ID: 0-1037342196
Opcode ID: 3f298c8811ba85f799eb02f913a006fa21ae53086dac8dc4ed057174328e12a3
Instruction ID: 9dd56d60c4867e94be0342aa9bd980d89ab377627a07a2676b16fc4e19c3ac28
Opcode Fuzzy Hash: 3f298c8811ba85f799eb02f913a006fa21ae53086dac8dc4ed057174328e12a3
Instruction Fuzzy Hash: B9215770608346AFE7229B14C988BFBBBDDBFD4304F944C6DE69887192D63598448793

Function 227E5390 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 117COMMON

Download Yara Rule

Strings

database corruption, xrefs: 227E5408
%s at line %d of [%.10s], xrefs: 227E540D
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227E53FE

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: a1b87502b8e3c81936424c42d640a143ec52e6d3930733bcd0560d11418bce27
Instruction ID: dfb1769a93756d67049d3a93f2ab9df25c879070f098e6d70ceb42c57bf3f9d2
Opcode Fuzzy Hash: a1b87502b8e3c81936424c42d640a143ec52e6d3930733bcd0560d11418bce27
Instruction Fuzzy Hash: F631C06524874486E7218F3899407E7B7E09F5271BF48046EEACFD7682E362E492C372

Function 228C7ED0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 111COMMON

Download Yara Rule

Strings

error in tokenizer constructor, xrefs: 228C7F92
no such tokenizer: %s, xrefs: 228C7F1B

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: error in tokenizer constructor$no such tokenizer: %s
API String ID: 0-815501780
Opcode ID: 4d662aa91e35cbb246f810aadfad50b85b6df1e98d16c4e589b5215dd816b7fe
Instruction ID: fd87da83ac3a0d6d4397f27d2b228f798971ce47f40b9b11deb50bf9b48d3d4f
Opcode Fuzzy Hash: 4d662aa91e35cbb246f810aadfad50b85b6df1e98d16c4e589b5215dd816b7fe
Instruction Fuzzy Hash: E8318E7A7013158FC715CE19D880BAAB3E8EF84769F1406ADE94CEB700E732E905CB61

Function 227E4130 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 109COMMON

Download Yara Rule

Strings

database corruption, xrefs: 227E4258
%s at line %d of [%.10s], xrefs: 227E425D
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227E41A3, 227E41EE, 227E41FE, 227E424E

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 98ee7ad09c5cef72b9247699e81ca2d4efbdbac63a789dd50bbd45db49cd431e
Instruction ID: 3e8ac5c8dd96d9d9eb5c7c57891deaa88c4cacea6d5bca78c25b8da77ec34d6e
Opcode Fuzzy Hash: 98ee7ad09c5cef72b9247699e81ca2d4efbdbac63a789dd50bbd45db49cd431e
Instruction Fuzzy Hash: 2431823170C36116D314CA1D98A04B6BBE1EBC5206F05467DF9DAAB1C6D63CD544C7B1

Function 227F1420 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 106COMMON

Download Yara Rule

Strings

database corruption, xrefs: 227F1475
%s at line %d of [%.10s], xrefs: 227F147A
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227F146B

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: be090d4e9cb993195e19d4467f1bbb091ef3586d28e8e9caf4bba739b4a22508
Instruction ID: c84c49bcf1d6b1814b8479f540fe326a4b801b19424ed6d15b2dbe42ba4a75a5
Opcode Fuzzy Hash: be090d4e9cb993195e19d4467f1bbb091ef3586d28e8e9caf4bba739b4a22508
Instruction Fuzzy Hash: 1231C0B56093518FC310CF29D980927FBF0EF95225F04869EE4868BB43D731E549CBA1

Function 22860010 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

Strings

database corruption, xrefs: 22860096
%s at line %d of [%.10s], xrefs: 2286009B
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2286008C, 228600C2, 228600FE

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 654e989ae15c44382015466cc86e45031bd1286cb2b5a02b0e4f4d5b3d1a077d
Instruction ID: 9ee3722e062c988ad9134e30e84981cd994089c235b0a71dd10ae8d6af30ca9c
Opcode Fuzzy Hash: 654e989ae15c44382015466cc86e45031bd1286cb2b5a02b0e4f4d5b3d1a077d
Instruction Fuzzy Hash: 3B3136342083909BC7118E289DD0476FBE1FFC5316F048A5EE999CB382D239E549CBA3

Function 227AF000 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

second argument to nth_value must be a positive integer, xrefs: 227AF0C4

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: second argument to nth_value must be a positive integer
API String ID: 0-2620530100
Opcode ID: 739ad5ee255552baff8985ce839dedb8c6e1e299abac74371b38dcc5a03af557
Instruction ID: 19a9f9c1c4211627af4fe687077d127ee9ccbed9742952f93cd1743d1e1403c9
Opcode Fuzzy Hash: 739ad5ee255552baff8985ce839dedb8c6e1e299abac74371b38dcc5a03af557
Instruction Fuzzy Hash: 663148B35083119BCB02AF24DD52B1B73E0BF60730F504B25E954A7291EB23EA5486A3

Function 227C05D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMON

Download Yara Rule

Strings

rbu(%s)/%z, xrefs: 227C0697
rbu/zipvfs setup error, xrefs: 227C061A

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: rbu(%s)/%z$rbu/zipvfs setup error
API String ID: 0-199214844
Opcode ID: d00f9f3f5f0bf7885a3a297be5c1f7080bc49ace59b2360dffbbeebca869bafd
Instruction ID: 7bd860245492e20ae200a1b4882dc5e6be631431ca30cc734b877e5c6d911921
Opcode Fuzzy Hash: d00f9f3f5f0bf7885a3a297be5c1f7080bc49ace59b2360dffbbeebca869bafd
Instruction Fuzzy Hash: 8D21E1B26043059FD710DF69DD80B56B7E5EBC9320F11447AE95997202DB32E8048B95

Function 227E5280 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

Strings

database corruption, xrefs: 227E52FC
%s at line %d of [%.10s], xrefs: 227E5301
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227E52F2

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: ba0c65f77a9bd9020d5eed5a0fde55d5e090ad545084d9b977eadbdd4ebd6790
Instruction ID: 56bae56f8051f6364542bdf674768d0cb4f3f91b2297cf1fa7c54c0699fcccc3
Opcode Fuzzy Hash: ba0c65f77a9bd9020d5eed5a0fde55d5e090ad545084d9b977eadbdd4ebd6790
Instruction Fuzzy Hash: C3110277600314A7CB105A5DFC40CDBBFA9EFD53B6F090565FA4C66222E622D921D3B2

Function 22908490 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 80COMMON

Download Yara Rule

Strings

database corruption, xrefs: 229084CB
%s at line %d of [%.10s], xrefs: 229084D0
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 229084C1

Memory Dump Source

Source File: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 7181f69fe7642442dc83642aaad2f5051aeb6d0ce79f09902bd67797fc163988
Instruction ID: c0e577c683259334b081e26a44ccf6a59c5891168e97e602cd0cb30110fe53c8
Opcode Fuzzy Hash: 7181f69fe7642442dc83642aaad2f5051aeb6d0ce79f09902bd67797fc163988
Instruction Fuzzy Hash: F621C276300B059BD7208F58D880B97B3E9FF94311F5049AEF94997742E731EA458B62

Function 227EFD60 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

Strings

database corruption, xrefs: 227EFE7D
%s at line %d of [%.10s], xrefs: 227EFE82
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227EFDE6, 227EFE61

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 328cd0505d7364146de5ab816bf2173d54a99ecbce71e07477cf5f26ea3fabde
Instruction ID: cbdc6805a5fc7678239ce8281babc3a4d57b0a54250e4edbd51b0d5352ead26b
Opcode Fuzzy Hash: 328cd0505d7364146de5ab816bf2173d54a99ecbce71e07477cf5f26ea3fabde
Instruction Fuzzy Hash: C03149682193818AD3188F24C190366BB60BF15308F25C5CDD44D8FB93E37BC483D7A6

Function 227AB220 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

Strings

misuse, xrefs: 227AB233
%s at line %d of [%.10s], xrefs: 227AB238
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227AB229

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: 07efd342102cd8b6e5031dd11e2074b27da4875dc36a7a3c04ff23218fee5698
Instruction ID: 06e93e7982c507ab331314319ed365d65403ce2350e3de16798ac014e68d5c37
Opcode Fuzzy Hash: 07efd342102cd8b6e5031dd11e2074b27da4875dc36a7a3c04ff23218fee5698
Instruction Fuzzy Hash: CE112771608700ABD3018F289DA4E5F77E9AFE4324F41452DF91997286EB31E504C3A2

Function 227FD6F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

%s%s, xrefs: 227FD725

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s%s
API String ID: 0-3252725368
Opcode ID: 2522ec0586a883e28d2ebddeef8b3014231df934aabe111dc51b42431b3027a4
Instruction ID: ba3181fdb8052ca70d1160c3e05bc42bb54954401022c6d7ec700e5146fb5b5e
Opcode Fuzzy Hash: 2522ec0586a883e28d2ebddeef8b3014231df934aabe111dc51b42431b3027a4
Instruction Fuzzy Hash: D611AF7590C311DBD7019B64D988B6B33A8FF8136AF040526FE089B359D7799614CBB2

Function 228C6140 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

Strings

fts5: error creating shadow table %q_%s: %s, xrefs: 228C6197
WITHOUT ROWID, xrefs: 228C6150, 228C6162
CREATE TABLE %Q.'%q_%q'(%s)%s, xrefs: 228C6175

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: WITHOUT ROWID$CREATE TABLE %Q.'%q_%q'(%s)%s$fts5: error creating shadow table %q_%s: %s
API String ID: 0-1971204597
Opcode ID: 585214bb164479c2a003fc50263edbcdc4e4002adca38a3e346ed5846e18fe8e
Instruction ID: 09adf179f3af82da365a930138721ff72947990d81c133df259f53f395e6e5e6
Opcode Fuzzy Hash: 585214bb164479c2a003fc50263edbcdc4e4002adca38a3e346ed5846e18fe8e
Instruction Fuzzy Hash: B9118E75A08200EFDB018F58DC88A2A77A4FF8435AF00492AF94996259D735C914DBA2

Function 2284A6B0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMON

Download Yara Rule

Strings

database corruption, xrefs: 2284A6CD
%s at line %d of [%.10s], xrefs: 2284A6D2
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 2284A6C3

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 8bb2f55039029d9220c16fc74eda1664cdc783aecf250670bd5c3095827665f4
Instruction ID: 81aeeef2ba4df872cdabdbe296d78224651967505cacc5574c9a966a80e2d796
Opcode Fuzzy Hash: 8bb2f55039029d9220c16fc74eda1664cdc783aecf250670bd5c3095827665f4
Instruction Fuzzy Hash: D8119DB66043019FD700CF58DC90F5BB7E8EBC5320F4408A9F6889B291E736E845CB62

Function 227E4DA0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65COMMON

Download Yara Rule

Strings

database corruption, xrefs: 227E4E22
%s at line %d of [%.10s], xrefs: 227E4E27
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227E4E18

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: e8b13ba32e9e5f272e59e9fd2c2885f3b448349cac4ae768d384b26aa3d87831
Instruction ID: 774f5c18ffc7a9438f8e3d5e455a0ff6d57d7490618f5afe23eed3d8d9b4bd13
Opcode Fuzzy Hash: e8b13ba32e9e5f272e59e9fd2c2885f3b448349cac4ae768d384b26aa3d87831
Instruction Fuzzy Hash: 2C119072605311DFC300DF5CC880A8AFBE5EF98759F1544AAF5499B312D332E842CBA1

Function 227B2380 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 62COMMON

Download Yara Rule

Strings

misuse, xrefs: 227B2406
%s at line %d of [%.10s], xrefs: 227B240B
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227B23FC

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: 453de90ae4a6b7e619e3f500f1f49c5f9e0fcf0bbea1709eb4cc29e80384f906
Instruction ID: f8a809479ada1a56ada320fbcdc2e82b02c9c035ae60084a5a9341174f03a498
Opcode Fuzzy Hash: 453de90ae4a6b7e619e3f500f1f49c5f9e0fcf0bbea1709eb4cc29e80384f906
Instruction Fuzzy Hash: 0B11AC70309302AFE708CF0CDC90F5AB7A4AFA8304F414098E6459B296D731E986DB91

Function 227BF8A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

integer overflow, xrefs: 227BF8ED

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: integer overflow
API String ID: 0-1678498654
Opcode ID: 880ac27dfd45388f7d4703c0485149cfa1b20ed5f8078030358b61dbb566ce94
Instruction ID: bbc1caba0d9483fda025544aa69e4d517e0466d1542e4e668d62d8b2e04639c0
Opcode Fuzzy Hash: 880ac27dfd45388f7d4703c0485149cfa1b20ed5f8078030358b61dbb566ce94
Instruction Fuzzy Hash: 0111C17180CB10AADB02AF34AC05B8E77A56F66724F160399F4545B1E2EB71C5D8C7D3

Function 22851F70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

JSON path error near '%q', xrefs: 22851F92

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: JSON path error near '%q'
API String ID: 0-481711382
Opcode ID: a8d5b097ddc1a77271438b098cc11da2cc1d9e555870f533c1ee1e44f90c34fb
Instruction ID: e96a03ed1bfd10a07718c8125570bc44ffadcd095c00059b045e105e6c284224
Opcode Fuzzy Hash: a8d5b097ddc1a77271438b098cc11da2cc1d9e555870f533c1ee1e44f90c34fb
Instruction Fuzzy Hash: EC0104B260D310BEDB119B648C00BAB7BC4DF51330F20066CF959972E0DB71E81187A2

Function 227CF0E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

INSERT INTO %Q.%Q(%Q) VALUES('flush'), xrefs: 227CF105

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: INSERT INTO %Q.%Q(%Q) VALUES('flush')
API String ID: 0-2312637080
Opcode ID: 23c384c72c1e81c6be981a83f9e39c837c55ecb1d3d49c9e49ceefe4e53f9083
Instruction ID: b45330baa38aa6e5c930f8d25107b423c8e95e2315b48e24ecb4459f3f36dcf9
Opcode Fuzzy Hash: 23c384c72c1e81c6be981a83f9e39c837c55ecb1d3d49c9e49ceefe4e53f9083
Instruction Fuzzy Hash: 9E019E363087415FD321866EFC80F97BBD8EBD4324F05056AF5ADC3201D761A8898262

Function 227B1DF0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56COMMON

Download Yara Rule

Strings

misuse, xrefs: 227B1E59
%s at line %d of [%.10s], xrefs: 227B1E63
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227B1E53

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: 52053a96f91bc8077ab7eb10bc99a5ff87c2573d597308cd01b8cb06da067423
Instruction ID: 15206c4da269794fdfd896aa9ccd875717921177ec6b7a9c47c91da57a6c1845
Opcode Fuzzy Hash: 52053a96f91bc8077ab7eb10bc99a5ff87c2573d597308cd01b8cb06da067423
Instruction Fuzzy Hash: 0E11E03860C740DFE304CE28D888E57BBA8AF86706F040569E445DB372D3B5EA05C7A2

Function 227D0D70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

INSERT INTO %Q.%Q(%Q) VALUES('flush'), xrefs: 227D0D87

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: INSERT INTO %Q.%Q(%Q) VALUES('flush')
API String ID: 0-2312637080
Opcode ID: 92cae1ea23a3cb5678e97b75ed28c998ba7dd4cd0a8132dec29519d9162bc3a1
Instruction ID: bfa49305815627231081d58a674b24885cc9e25b6decc85fda0ecd42410317b0
Opcode Fuzzy Hash: 92cae1ea23a3cb5678e97b75ed28c998ba7dd4cd0a8132dec29519d9162bc3a1
Instruction Fuzzy Hash: F2018C72208300AFE3109A5EED80F42B7E9EB88724F144569F68DDB240E7B2EC468761

Function 227AEF30 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON

Download Yara Rule

Strings

misuse, xrefs: 227AEFB0
%s at line %d of [%.10s], xrefs: 227AEFB5
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227AEFA6

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: 83ffb6753ba94dc735dceb2e51576881fc2bb770948d0973acb85c49e3d0783f
Instruction ID: 6f17ff5aea61d5d09586700153f9a89f9a201add4c7ad9804131060ef7c0727a
Opcode Fuzzy Hash: 83ffb6753ba94dc735dceb2e51576881fc2bb770948d0973acb85c49e3d0783f
Instruction Fuzzy Hash: 9F01DEB0A0A711DBE7018F08D844B5A3BA1FF86319F054929E9486B3A9D375E845CB92

Function 22819180 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

Strings

%s_stat, xrefs: 22819192

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s_stat
API String ID: 0-920702477
Opcode ID: 1b28afa6d235f7f75facb346bd0bd87f1f01ed48c93254d69cd1324da9f82dc7
Instruction ID: 53e3066a07fe4865020c77b310f2ce1119dcbf5e4d4214b3fb269ea254d57fc2
Opcode Fuzzy Hash: 1b28afa6d235f7f75facb346bd0bd87f1f01ed48c93254d69cd1324da9f82dc7
Instruction Fuzzy Hash: 13F02723B083517BE71146B9BD88B46EBD9BB54270F144726F40C93148C316ACE14391

Function 227C7F70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

CREATE TABLE x(key,value,type,atom,id,parent,fullkey,path,json HIDDEN,root HIDDEN), xrefs: 227C7F76

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: CREATE TABLE x(key,value,type,atom,id,parent,fullkey,path,json HIDDEN,root HIDDEN)
API String ID: 0-3072645960
Opcode ID: 1cdb6846997542800925b184ea0f92e79ca4902e6597df67e7b60e3c89171078
Instruction ID: 0cd8556995ee58347868804a61f18d9d22da2243c608c58e903f740321d634be
Opcode Fuzzy Hash: 1cdb6846997542800925b184ea0f92e79ca4902e6597df67e7b60e3c89171078
Instruction Fuzzy Hash: C5F0F03760C30286D7015F29FC05BC9B798AFE1321F19022AF8449B290EB70D88A87A1

Function 227E00B0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON

Download Yara Rule

Strings

database corruption, xrefs: 227E00E5
%s at line %d of [%.10s], xrefs: 227E00EA
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 227E00DB

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: ff91b1a7cb532f8a0b861a4aec6c7db7c6dd15ff053cbf30027444af4aaa147d
Instruction ID: 59a0fbb8c0f7f0c96fc1ae49be0752746468eed7cbd02696c33b471019b45fc1
Opcode Fuzzy Hash: ff91b1a7cb532f8a0b861a4aec6c7db7c6dd15ff053cbf30027444af4aaa147d
Instruction Fuzzy Hash: B2E01A707483056FE704DA28CAC1F637BD1AB94704F468594E90AFB2A6EB61ED80D772

Function 2295066B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,22950513,?,?,?,?,?,?,229507BD,00000003,FlsSetValue,229C7770,229C7778), ref: 22950678
GetLastError.KERNEL32(?,22950513,?,?,?,?,?,?,229507BD,00000003,FlsSetValue,229C7770,229C7778), ref: 22950682
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 229506AA

Strings

api-ms-, xrefs: 2295068F

Memory Dump Source

Source File: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: d437121243f97ce9cdbb280bf33eefc9492b7c9a5d37fa33a723fa5890ce895a
Instruction ID: 8d811685015271760d7207e165063d48ed348134886efe82227a5f63c6c8fe49
Opcode Fuzzy Hash: d437121243f97ce9cdbb280bf33eefc9492b7c9a5d37fa33a723fa5890ce895a
Instruction Fuzzy Hash: 90E04F70788309FBEB105E61DC0AB593F98AF45B51F108871FE0CE81E6D77AE9609A48

Function 228DC1F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 9COMMON

Download Yara Rule

Strings

misuse, xrefs: 228DC1F9
%s at line %d of [%.10s], xrefs: 228DC1FE
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 228DC1F0

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: 7fe9a703133cea77d158dcd3d079a2acb825d39841297994f622c4a9f84a8467
Instruction ID: bdcd3d8e6bc00e38a58b9df154b13ab29543342177346e9ecafba95f3b3862c9
Opcode Fuzzy Hash: 7fe9a703133cea77d158dcd3d079a2acb825d39841297994f622c4a9f84a8467
Instruction Fuzzy Hash: 2EB09269754B48B6FB012248CCD1ECB6A106BE8317F818068B6997E2EEF07A81106213

Function 228AA570 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 9COMMON

Download Yara Rule

Strings

database corruption, xrefs: 228AA579
%s at line %d of [%.10s], xrefs: 228AA57E
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 228AA570

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: c37414c7ee2dc203f2a8c86dffd5407689df8f7bd943f99a577d528d6bd16581
Instruction ID: 458ecde5959ca5623fdfaf6b316368f8c303a1b03b77e4d49c00ba106fba8295
Opcode Fuzzy Hash: c37414c7ee2dc203f2a8c86dffd5407689df8f7bd943f99a577d528d6bd16581
Instruction Fuzzy Hash: 19B0926974430032FA012258CDD2F873E1057E8741F828A64B54D7A2DAF23A84108253

Function 228A6B50 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 9COMMON

Download Yara Rule

Strings

cannot open file, xrefs: 228A6B59
%s at line %d of [%.10s], xrefs: 228A6B5E
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 228A6B50

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$cannot open file$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-1799306995
Opcode ID: 5b80d0cf7f54fe17ce01eb0a3a895e5b5d33f2597a4b3fdcacd04640260833ad
Instruction ID: 84710c76323f9e11bfa61c3aa119f99099248e534008811bc69a64b741000403
Opcode Fuzzy Hash: 5b80d0cf7f54fe17ce01eb0a3a895e5b5d33f2597a4b3fdcacd04640260833ad
Instruction Fuzzy Hash: 91B0925674438036FA012A58CCD1F872E1067E8B11F8188A4B58D3A2EEF0AAC1908213

Function 228025E0 Relevance: 6.4, APIs: 4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5493b336b8968faa778f610be5178334ce7504dd278493f5b2e81659448dff28
Instruction ID: 06dae2e0c3ead35c67c48e92f78c49145d02ca721c7092440e673d381cdc5bb0
Opcode Fuzzy Hash: 5493b336b8968faa778f610be5178334ce7504dd278493f5b2e81659448dff28
Instruction Fuzzy Hash: 7CD19274A48305DBD700DF69CD48B3A77A8BF0435AF40092AFD09D2259DBF9E654CBA2

Function 229967F5 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(7D25026E,00000000,00000000,?), ref: 22996858
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 22996AAA
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 22996AF0
GetLastError.KERNEL32 ref: 22996B93

Memory Dump Source

Source File: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: daca94d1acfb2272dba8d1e6b3614b41f08ae8cfd6e885c6f367488a5b3040d3
Instruction ID: 764c2c52e7ba0706c6fee0a8c739ef7f061e0b1f48e426de413750c521ce38b8
Opcode Fuzzy Hash: daca94d1acfb2272dba8d1e6b3614b41f08ae8cfd6e885c6f367488a5b3040d3
Instruction Fuzzy Hash: 6ED16AB5D04398EFDB05CFE8C890AEDBBB9FF09324F14456AE915EB251E630A941CB50

Function 22848EB0 Relevance: 6.2, APIs: 4, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95c50637b8ad03fe25625bd34a41d971773942f7e3b28aa3cb6fd2c5c6db0470
Instruction ID: 9faadf7d15f21c17160e507a29cb6896a8f910cd4005cf4bd20b4ee28cc96809
Opcode Fuzzy Hash: 95c50637b8ad03fe25625bd34a41d971773942f7e3b28aa3cb6fd2c5c6db0470
Instruction Fuzzy Hash: 8D516A75A043D9CFD731CF34994579AFBE4AF51314F0806A9E9C88B242EA69E588C361

Function 227C7DA0 Relevance: 6.2, APIs: 4, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cea0dc735989fb4c316a9444fe923ae1ca82cf2d7aa3e23d3042d6e880c8b587
Instruction ID: f1aeaa9ade7bfefe689ea9efeac0cce4af13bbfccbbbe9e312e376f1ae78637c
Opcode Fuzzy Hash: cea0dc735989fb4c316a9444fe923ae1ca82cf2d7aa3e23d3042d6e880c8b587
Instruction Fuzzy Hash: 2E41F1762053019FD304CF29DA80A92F7E4FF84328F10456EE9468BA62DB72FC51CB90

Function 227CCAE0 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07ae449288d8b766d68df1d558f29edcc8f280c884682dc6486a45414530b26f
Instruction ID: 6bc3210bb42db7b93fcff4d546fcbb157a399886a2953ec1daf70571a84c886e
Opcode Fuzzy Hash: 07ae449288d8b766d68df1d558f29edcc8f280c884682dc6486a45414530b26f
Instruction Fuzzy Hash: 7731ADB26087019FE714CFB8E944B56B3E4FB94321F000A7EE904CB661E321E944D7A1

Function 227CB1F0 Relevance: 6.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c84fadece956eb82bcd06ee462d33b28814fba88082786c6e23e5494ba88420
Instruction ID: 8cb3e4a58fc82e695b5210acb7874683b73f71be8e2fe396e17b554acf88e689
Opcode Fuzzy Hash: 2c84fadece956eb82bcd06ee462d33b28814fba88082786c6e23e5494ba88420
Instruction Fuzzy Hash: 0931AD71508B419ED321CF39E94479BB7E0FF95325F009A2DE89A87A05D371F489C792

Function 2283CFE0 Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67f155ee4936aae19aec06cb809ffc92085dd37a0bce870209c165f40ac7d322
Instruction ID: 0147a1294a42c3e0e5a64a41f789703deec44d682014a7cb1d1ffc1abda909a0
Opcode Fuzzy Hash: 67f155ee4936aae19aec06cb809ffc92085dd37a0bce870209c165f40ac7d322
Instruction Fuzzy Hash: 8421D075504705DFC751EF68C994A5ABBF0EFA8710F90082DF589C3222E331EA588B82

Function 2299F4CA Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,?,00000001,00000000,?,?,00000000), ref: 2299F4E0
GetLastError.KERNEL32(?,?,?,?), ref: 2299F4ED
SetFilePointerEx.KERNEL32(?,?,?,?,?), ref: 2299F513
SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,?,?,?), ref: 2299F539

Memory Dump Source

Source File: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID: FilePointer$ErrorLast
String ID:
API String ID: 142388799-0
Opcode ID: 83d93c72706fc5a8b95c1dbe304329163aeb1db76015c2cff88d8dfdaaca0d99
Instruction ID: 6a5bde5e1161823874899daa66c4dcdbf08990754e7e1c3a0aee78f4bbeaaca7
Opcode Fuzzy Hash: 83d93c72706fc5a8b95c1dbe304329163aeb1db76015c2cff88d8dfdaaca0d99
Instruction Fuzzy Hash: EE114571905219FBDF108F64CC48AEE7F79EF05360F108585F824A62A0DB359A40CBA0

Function 227A2ABD Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 229A1382
GetLastError.KERNEL32 ref: 229A138E
___initconout.LIBCMT ref: 229A139E

Part of subcall function 229A1303: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,229A13A3), ref: 229A1316

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 229A13B3

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID: ConsoleWrite$CreateErrorFileLast___initconout
String ID:
API String ID: 3431868840-0
Opcode ID: 9e972204e3ddac23c0c59a525c0ee99a79eca6bbc3539b2edd276e6be4566745
Instruction ID: 8e43673209ec3ed20ff103958eaa80c351ec794bcae3ecdd462cf47000e71c25
Opcode Fuzzy Hash: 9e972204e3ddac23c0c59a525c0ee99a79eca6bbc3539b2edd276e6be4566745
Instruction Fuzzy Hash: 4CF05836448325FBCF121E95CD18A9A3F6AEF082A1F004911FE1896234CA3A89609B84

Function 227BBE80 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

string or blob too big, xrefs: 227BC1B5

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: string or blob too big
API String ID: 0-2803948771
Opcode ID: 9cdcc93a9de472cd21663d0df3aadce77f793efa529f0cd516f5d1850defb1e4
Instruction ID: 2bbc4c0d36aa0fc30844d7a3c2a2e5471195c6a999204f8b788e1c4714145034
Opcode Fuzzy Hash: 9cdcc93a9de472cd21663d0df3aadce77f793efa529f0cd516f5d1850defb1e4
Instruction Fuzzy Hash: 58A135B150C7458FD7058E288D8072AB7D1AF9A324F189B5DFAE0573E2E770C586CB81

Function 22927300 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 242COMMON

Download Yara Rule

Strings

%!.15g, xrefs: 229275C3
-, xrefs: 22927538

Memory Dump Source

Source File: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %!.15g$-
API String ID: 0-583212262
Opcode ID: acf82b043db0ed473071bef21694df79f777475513915928095e0ec2cb9df947
Instruction ID: 88478a08a422aaddd3c20b3658f814955c401c516dbd6a4387a33baa22eeb0d1
Opcode Fuzzy Hash: acf82b043db0ed473071bef21694df79f777475513915928095e0ec2cb9df947
Instruction Fuzzy Hash: A4917C70A087428FD304CF2DD99179AFBE4AFC8314F044A6DE988D7355E7B9C9098B92

Function 227ECBF0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

string or blob too big, xrefs: 227ECE39

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: string or blob too big
API String ID: 0-2803948771
Opcode ID: e6a4c02b28b4745c3884a396b3b5347bb5551db44947a1795661dec3055f0b38
Instruction ID: 6498f3812dcbd857bfdda64c32c04852a6aab667c955c06117cbaeab51c94e0a
Opcode Fuzzy Hash: e6a4c02b28b4745c3884a396b3b5347bb5551db44947a1795661dec3055f0b38
Instruction Fuzzy Hash: D2812379A0C3018FD306CF19C981B5BB7E5BF94314F440A5CFA4AA72A2E372D945C7A2

Function 228C78F0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 214COMMON

Download Yara Rule

Strings

*, xrefs: 228C7982
?, xrefs: 228C794A

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: *$?
API String ID: 0-2367018687
Opcode ID: 0a80677a76baa7e1e7514a417b64fb41bb80e133dface090c09bb14c73ac9fb4
Instruction ID: fa558acb9442010310a1d8db6fc37710cc869d824223f8ca2ba8fb39fa3b2bfa
Opcode Fuzzy Hash: 0a80677a76baa7e1e7514a417b64fb41bb80e133dface090c09bb14c73ac9fb4
Instruction Fuzzy Hash: CF7116B4A08341CFD3188F29CD8076BBBEABF89204F44496DE98987316D779DA45C791

Function 227BC8E0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 206COMMON

Download Yara Rule

Strings

LIKE or GLOB pattern too complex, xrefs: 227BC94F
ESCAPE expression must be a single character, xrefs: 227BCA43

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 0-264706735
Opcode ID: 4dbfbf385ca14cd8fd91b9dcd49d556d429bc404081d4f5ab8fcd4ec2e14ab6c
Instruction ID: 338ac1f537ef3fa81fc88f77962bca3235c4ce3fafb7c7f1b848759c7412b236
Opcode Fuzzy Hash: 4dbfbf385ca14cd8fd91b9dcd49d556d429bc404081d4f5ab8fcd4ec2e14ab6c
Instruction Fuzzy Hash: 1B61777160C3508FEB08CB24C981B667795AF46328F24C29DF991AB2D3D676C687C391

Function 227BD0F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

string or blob too big, xrefs: 227BD213

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: string or blob too big
API String ID: 0-2803948771
Opcode ID: d90bc3ac1e2128c8a09607230f36451bcd5ebc3e9d1c87d07e7b687bb0e0a8b5
Instruction ID: cd5b3177b7e4310eb59c1f1e5d081b8e21f7afe2a3b2d3c7dcdeb537466aa635
Opcode Fuzzy Hash: d90bc3ac1e2128c8a09607230f36451bcd5ebc3e9d1c87d07e7b687bb0e0a8b5
Instruction Fuzzy Hash: 77415673D0C3458FE3108A389C41B9B7B96AF65324F150A2CFDA5933D3E626D608C392

Function 227B55D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

winDelete, xrefs: 227B569C
delayed %dms for lock/sharing conflict at line %d, xrefs: 227B56D1

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: delayed %dms for lock/sharing conflict at line %d$winDelete
API String ID: 0-1405699761
Opcode ID: 3a580f348ea6e3346402415fd0f211bac9eb395eddd9429fc96091862c4bc265
Instruction ID: 17218cb630a50217d8d54bedca03b0cb8cd7803e911f576b10310bd41801ff30
Opcode Fuzzy Hash: 3a580f348ea6e3346402415fd0f211bac9eb395eddd9429fc96091862c4bc265
Instruction Fuzzy Hash: 27317F72E4C305CBE7102B789E8897A7758EF447AEF010E33FE16D6196DAB9C844C691

Function 227BD300 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

string or blob too big, xrefs: 227BD3D5

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: string or blob too big
API String ID: 0-2803948771
Opcode ID: 1cdfe66122cc579426b250fd49716d8c96af333272f894e8c15e93e67906629c
Instruction ID: 0db3e86a270280c465dca638c6d69802342bf8837d32fdee4cfe4dafe4f38a0f
Opcode Fuzzy Hash: 1cdfe66122cc579426b250fd49716d8c96af333272f894e8c15e93e67906629c
Instruction Fuzzy Hash: 6231ACB2A0C324DBE7114A249D40B663B599FA2338F2803A8FD547F3D7D267D902D3A0

Function 2289DEE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87COMMON

Download Yara Rule

Strings

sqlite_stat1, xrefs: 2289DF30
SELECT tbl,idx,stat FROM %Q.sqlite_stat1, xrefs: 2289DF4F

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: SELECT tbl,idx,stat FROM %Q.sqlite_stat1$sqlite_stat1
API String ID: 0-3572622772
Opcode ID: 19b21e53c2edb679bd17966daf5db36d7ffc422e9e99d82e2916f3322d3fa8a7
Instruction ID: 979d406fcf323d177c28578fec5581bc7f0b9fb13977a4c37f95d3c709f4ff8f
Opcode Fuzzy Hash: 19b21e53c2edb679bd17966daf5db36d7ffc422e9e99d82e2916f3322d3fa8a7
Instruction Fuzzy Hash: 2621017AA01305DFDB10EE29C881F2AB3A4AF91724F05422CFC489B752E320F904CB99

Function 22937E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

OsError 0x%lx (%lu), xrefs: 22937ED9

Memory Dump Source

Source File: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: OsError 0x%lx (%lu)
API String ID: 0-3720535092
Opcode ID: ed49707bb560c6fb885648ace9eaaf7e1a7a0915369c51ccfbd6bd9d3d16202e
Instruction ID: 75979c7bc1c2ec308c534f6e6ef8a4b0ff6eff2800ff0a6318b4d696fad2777a
Opcode Fuzzy Hash: ed49707bb560c6fb885648ace9eaaf7e1a7a0915369c51ccfbd6bd9d3d16202e
Instruction Fuzzy Hash: 6821D331A48301EBE7119BA4CD08BAB37E8FF0435AF040926FD05D51A4DB7AD910D792

Function 227D87A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

ALTER TABLE %Q.'%q_node' RENAME TO "%w_node";ALTER TABLE %Q.'%q_parent' RENAME TO "%w_parent";ALTER TABLE %Q.'%q_rowid' RENAME TO "%w_rowid";, xrefs: 227D87B9

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: ALTER TABLE %Q.'%q_node' RENAME TO "%w_node";ALTER TABLE %Q.'%q_parent' RENAME TO "%w_parent";ALTER TABLE %Q.'%q_rowid' RENAME TO "%w_rowid";
API String ID: 0-2843444156
Opcode ID: 5850585d09829eef8d52076b5e07d5627433c8e582da4c4ff4c214abfb378d44
Instruction ID: e7466d34b592f2dce61f6ee8fcc0b1136aa3bb369bba95cbca69b0e3fd2f78ba
Opcode Fuzzy Hash: 5850585d09829eef8d52076b5e07d5627433c8e582da4c4ff4c214abfb378d44
Instruction Fuzzy Hash: F911A7B2A48200EFE2009759EC09F7B77ADEF80766F444536FD04D7258D768EC56C6A1

Function 227CF740 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

DROP TABLE '%q'.'%q_node';DROP TABLE '%q'.'%q_rowid';DROP TABLE '%q'.'%q_parent';, xrefs: 227CF752

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: DROP TABLE '%q'.'%q_node';DROP TABLE '%q'.'%q_rowid';DROP TABLE '%q'.'%q_parent';
API String ID: 0-2071071404
Opcode ID: 8c726b30cef592093f829cfcd91689dcc1c9cd682f7a1d680c9bfc1571afaa0c
Instruction ID: 76e624e7627b3cbd1f7f8e59be28fb14db768c6b9a2f2b4cc91bd9d124b5c3d1
Opcode Fuzzy Hash: 8c726b30cef592093f829cfcd91689dcc1c9cd682f7a1d680c9bfc1571afaa0c
Instruction Fuzzy Hash: 8711A771948301EFE2009B68DD88F7B33ACEF44356F40053BFD0592199EB68A954C662

Function 227A141F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

InitializeCriticalSectionEx, xrefs: 22980E84
GetXStateFeaturesMask, xrefs: 22980E34

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: GetXStateFeaturesMask$InitializeCriticalSectionEx
API String ID: 0-4196971266
Opcode ID: 9c4694f33eef9e1b454df2287002c19d2a92d1ddeb303b2e4796fa2e6a324d80
Instruction ID: 570ffdab7c2c03582f5875f3e1ed70d8e2b00c6814ff03ed8d49e97a4a2c0ccf
Opcode Fuzzy Hash: 9c4694f33eef9e1b454df2287002c19d2a92d1ddeb303b2e4796fa2e6a324d80
Instruction Fuzzy Hash: FA01F732540328BBEB212B51CC05EAF3F06EF947B1F044511FE1D2A259DA764820D6C2

Function 227D5350 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

F, xrefs: 227D539B

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-1304234792
Opcode ID: 501873b625fb76ec8c3ac233c1ed9a8298289b59925b91bce3e2c735391ca0b5
Instruction ID: 857e1dbe0f4e0034f8ed5454f08d102384db8a3d222d3436151b1fe6a2308ee0
Opcode Fuzzy Hash: 501873b625fb76ec8c3ac233c1ed9a8298289b59925b91bce3e2c735391ca0b5
Instruction Fuzzy Hash: 6C115EB260C3408BC704CF19C42575BBBE4BFE8318F84496EE98A97290E774D508CB93

Function 227FEFE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

SELECT %s WHERE rowid = ?, xrefs: 227FF017

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: SELECT %s WHERE rowid = ?
API String ID: 0-866778640
Opcode ID: 9aac63ee73bd233c464d38e2fa803ffb31be6f172271639ac20a281a1beaaba1
Instruction ID: a3376d51a49ee238715392e5cfe0f7eb1d60aea8036ecc30bd177478b05f17d1
Opcode Fuzzy Hash: 9aac63ee73bd233c464d38e2fa803ffb31be6f172271639ac20a281a1beaaba1
Instruction Fuzzy Hash: 191125323083099BD7204F9AEC40F92F794FB50331F10852EF55996A80EB72B45587A1

Function 227D7200 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

Strings

API call with %s database connection pointer, xrefs: 227D7220
invalid, xrefs: 227D721B

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: API call with %s database connection pointer$invalid
API String ID: 0-3574585026
Opcode ID: 8040242d70677c2dfe88ab2221cd93261d474ab5c38753fb869167777449e4d6
Instruction ID: 3a036b341a375089c19ada14cd5317ae89a62f0769ba34c96c743a38e2ca04a6
Opcode Fuzzy Hash: 8040242d70677c2dfe88ab2221cd93261d474ab5c38753fb869167777449e4d6
Instruction Fuzzy Hash: 18F0F632B0D7508BD6105628ED24BE377FA5F5032AF004A69F795922D4C334F454C291

Function 227B85B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

CREATE TABLE x(sql,ncol,ro,busy,nscan,nsort,naidx,nstep,reprep,run,mem), xrefs: 227B85B6

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: CREATE TABLE x(sql,ncol,ro,busy,nscan,nsort,naidx,nstep,reprep,run,mem)
API String ID: 0-3640693396
Opcode ID: 5804aacd2049486df27ff9c1f036049da5df65b942d10210cb0c3dfa2e29cdc6
Instruction ID: a984825e8d4aedc0bc1f1ee9ebd3057810887b3ab6297474a5bbaa22104c9b4f
Opcode Fuzzy Hash: 5804aacd2049486df27ff9c1f036049da5df65b942d10210cb0c3dfa2e29cdc6
Instruction Fuzzy Hash: 48F0B4326483218BC3015B2DFD40B8AB3D59FE1735F054266F804DB250E7B0ED8287A1

Function 22883C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

Strings

%z%s%z, xrefs: 22883C6B

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID:
String ID: %z%s%z
API String ID: 0-3434679432
Opcode ID: 89fbc5c3db56950f2e32cb3d18677c02293a2d723f85d80083d000a3e3f7b349
Instruction ID: 90a4c5ad29df85ee1f117cd428da55ec35d57b2271caa1af8b8c200acac5bb0d
Opcode Fuzzy Hash: 89fbc5c3db56950f2e32cb3d18677c02293a2d723f85d80083d000a3e3f7b349
Instruction Fuzzy Hash: 76F082B0914706DFF760CB15D99072372D9FF88314F04492DED8A86550E735F985CB52

Function 227A22D9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 22988850
GetCommandLineW.KERNEL32 ref: 2298885B

Strings

5x, xrefs: 22988856

Memory Dump Source

Source File: 00000002.00000002.3281892913.00000000227A1000.00000020.00001000.00020000.00000000.sdmp, Offset: 227A0000, based on PE: true

Associated: 00000002.00000002.3281875005.00000000227A0000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000227A8000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.0000000022906000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3281892913.00000000229AD000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283242944.00000000229B8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283403054.00000000229E2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229ED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3283440588.00000000229EF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_227a0000_katAE61.jbxd

Similarity

API ID: CommandLine
String ID: 5x
API String ID: 3253501508-1004774474
Opcode ID: 4f381084e56330841ade9a43dd6a81c713e95d48341697b2246b986570533a44
Instruction ID: 3f5407f5decd4bd43c4daa3fd597fbed19dcee126209b46578479912e68ec6b2
Opcode Fuzzy Hash: 4f381084e56330841ade9a43dd6a81c713e95d48341697b2246b986570533a44
Instruction Fuzzy Hash: 70C048B8888200CFAB109F60910C1253AB0BE092023C80D5BDC1282358D77E0800EB21

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report S8co1ACRdn.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFHDAEGHDGDB\AAEBAK

C:\ProgramData\AFHDAEGHDGDB\BGDHDA

C:\ProgramData\AFHDAEGHDGDB\DHDAKF

C:\ProgramData\AFHDAEGHDGDB\EBFBFB

C:\ProgramData\AFHDAEGHDGDB\GCBKEC

C:\ProgramData\AFHDAEGHDGDB\GHCAAA

C:\ProgramData\AFHDAEGHDGDB\HDBKJE

C:\ProgramData\AFHDAEGHDGDB\HDGIEB

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqlt[1].dll

C:\Users\user\AppData\Local\Temp\katAE61.tmp

Static File Info

General

Windows Analysis Report
S8co1ACRdn.exe

Function 02CBBEF0 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 317
threadmemoryfileCOMMON

Function 02CBB250 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191
filenativeCOMMON

Function 02CBB510 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115
COMMON

Function 02CBB9B0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 46
memoryCOMMON

Function 02CBC510 Relevance: .1, Instructions: 92
COMMON

Function 227B4CF0 Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 461
fileCOMMON

Function 227AFD40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 134
fileCOMMON

Function 227D04D0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15
COMMON

Function 22884140 Relevance: 47.7, APIs: 14, Strings: 13, Instructions: 461
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre