Edit tour

Windows Analysis Report
venomderek.exe

Overview

General Information

Sample name:	venomderek.exe
Analysis ID:	1568493
MD5:	8c1a3371880670ae29eb22eec13df95e
SHA1:	642e25d5a8a9e52ae970d3cc1f41388d4468259a
SHA256:	39e4e2d97af7b2be0aa8806afbc4d4766bc057264f556733b392ffb766174dce
Tags:	exeuser-aachum
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Suricata IDS alerts with low severity for network traffic

Terminates after testing mutex exists (may check infected machine status)

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

venomderek.exe (PID: 4960 cmdline: "C:\Users\user\Desktop\venomderek.exe" MD5: 8C1A3371880670AE29EB22EEC13DF95E)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "45.130.145.152", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite", "build_name": "Work", "links": "", "port": 15666}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1929160781.000002733BC90000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: venomderek.exe PID: 4960	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: venomderek.exe PID: 4960	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security
Process Memory Space: venomderek.exe PID: 4960	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.venomderek.exe.2733bde0000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.venomderek.exe.2733bde0000.0.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-04T17:09:29.817533+0100	2049441	1	A Network Trojan was detected	192.168.2.4	49730	45.130.145.152	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-04T17:09:29.817533+0100	2050806	1	A Network Trojan was detected	192.168.2.4	49730	45.130.145.152	15666	TCP
2024-12-04T17:09:29.938186+0100	2050806	1	A Network Trojan was detected	192.168.2.4	49730	45.130.145.152	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-04T17:09:29.817533+0100	2050807	1	A Network Trojan was detected	192.168.2.4	49730	45.130.145.152	15666	TCP
2024-12-04T17:09:29.938186+0100	2050807	1	A Network Trojan was detected	192.168.2.4	49730	45.130.145.152	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.venomderek.exe.2733bde0000.0.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "45.130.145.152", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite", "build_name": "Work", "links": "", "port": 15666}

Multi AV Scanner detection for submitted file

Source: venomderek.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE51EA0 CryptUnprotectData,LocalFree,	0_2_000002733BE51EA0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE15EE0 CryptUnprotectData,LocalFree,	0_2_000002733BE15EE0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE521C0 CryptProtectData,LocalFree,	0_2_000002733BE521C0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BEB2090 CryptUnprotectData,	0_2_000002733BEB2090

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: venomderek.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE99810 FindClose,FindFirstFileExW,GetLastError,		0_2_000002733BE99810
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE998C0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		0_2_000002733BE998C0

Source: C:\Users\user\Desktop\venomderek.exe

Code function: 0_2_000002733BE613B0 GetLogicalDriveStringsW,

0_2_000002733BE613B0

Source: C:\Users\user\Desktop\venomderek.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.4:49730 -> 45.130.145.152:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.4:49730 -> 45.130.145.152:15666

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 45.130.145.152:15666

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 45.130.145.152 45.130.145.152

Source: Joe Sandbox View

ASN Name: ASBAXETNRU ASBAXETNRU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.4:49730 -> 45.130.145.152:15666

Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152

Source: C:\Users\user\Desktop\venomderek.exe

Code function: 0_2_000002733BE5F200 InternetOpenA,InternetOpenUrlA,HttpQueryInfoW,HttpQueryInfoW,InternetQueryDataAvailable,InternetReadFile,InternetQueryDataAvailable,InternetCloseHandle,Concurrency::cancel_current_task,

0_2_000002733BE5F200

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: venomderek.exe, 00000000.00000003.1696145546.000002733C1F1000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1928555875.000002733C200000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1928527130.000002733C200000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1928612447.000002733C204000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsoft.t/Regi
Source: venomderek.exe, 00000000.00000003.1698368383.000002733BD54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: venomderek.exe, 00000000.00000002.1929160781.000002733BC90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: venomderek.exe, 00000000.00000002.1929160781.000002733BC90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.orgP
Source: venomderek.exe, 00000000.00000003.1708499666.000002733A497000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1708776603.000002733A442000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: venomderek.exe, 00000000.00000003.1708874852.000002733A4CE000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1708776603.000002733A442000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: venomderek.exe, 00000000.00000003.1698368383.000002733BD54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: venomderek.exe, 00000000.00000003.1698368383.000002733BD54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: venomderek.exe, 00000000.00000003.1698368383.000002733BD54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: venomderek.exe, 00000000.00000003.1708499666.000002733A497000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1708776603.000002733A442000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: venomderek.exe, 00000000.00000003.1708874852.000002733A4CE000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1708776603.000002733A442000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: venomderek.exe, 00000000.00000003.1697981552.000002733BD3B000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1698368383.000002733BD54000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1698368383.000002733BD3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: venomderek.exe, 00000000.00000003.1697981552.000002733BD3B000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1698368383.000002733BD54000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1698368383.000002733BD3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: venomderek.exe, 00000000.00000003.1697981552.000002733BD3B000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1698368383.000002733BD54000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1698368383.000002733BD3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: venomderek.exe, 00000000.00000003.1708776603.000002733A442000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: venomderek.exe, 00000000.00000003.1699663954.000002733A4A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mic
Source: venomderek.exe, 00000000.00000003.1702024780.000002733CB12000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1704041029.000002733D2CB000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1702093954.000002733BD89000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1701297813.000002733C008000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1702093954.000002733BD71000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1702773771.000002733C11C000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1701297813.000002733C000000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1702024780.000002733CB0A000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1701297813.000002733C0C0000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1701725872.000002733C114000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1701725872.000002733C0C8000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1702093954.000002733BD81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: venomderek.exe, 00000000.00000003.1705089454.000002733D72B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: venomderek.exe, 00000000.00000003.1705089454.000002733D72B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: venomderek.exe, 00000000.00000003.1698833746.000002733CAA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: venomderek.exe, 00000000.00000003.1698680563.000002733BD6A000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1698833746.000002733CA83000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1698680563.000002733BD43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: venomderek.exe, 00000000.00000003.1698833746.000002733CAA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: venomderek.exe, 00000000.00000003.1698680563.000002733BD6A000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1698833746.000002733CA83000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1698680563.000002733BD43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: venomderek.exe, 00000000.00000003.1708874852.000002733A4CE000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1708776603.000002733A442000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: venomderek.exe, 00000000.00000003.1698368383.000002733BD54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: venomderek.exe, 00000000.00000003.1708874852.000002733A4CE000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1708776603.000002733A442000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: venomderek.exe, 00000000.00000003.1698368383.000002733BD54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: venomderek.exe, 00000000.00000003.1702024780.000002733CB12000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1704041029.000002733D2CB000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1702093954.000002733BD89000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1701297813.000002733C008000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1702093954.000002733BD71000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1702773771.000002733C11C000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1701297813.000002733C000000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1702024780.000002733CB0A000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1701297813.000002733C0C0000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1701725872.000002733C114000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1701725872.000002733C0C8000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1702093954.000002733BD81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: venomderek.exe, 00000000.00000003.1705089454.000002733D72B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: venomderek.exe, 00000000.00000003.1705089454.000002733D72B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: venomderek.exe, 00000000.00000003.1701297813.000002733C124000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1701297813.000002733C00F000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1701725872.000002733C0CF000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1703284184.000002733CB1A000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1705089454.000002733D72B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: venomderek.exe, 00000000.00000003.1705089454.000002733D72B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: venomderek.exe, 00000000.00000003.1701297813.000002733C124000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1701297813.000002733C00F000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1701725872.000002733C0CF000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1703284184.000002733CB1A000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1705089454.000002733D72B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Users\user\Desktop\venomderek.exe

Code function: 0_2_000002733BE5FB30 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,EnterCriticalSection,LeaveCriticalSection,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

0_2_000002733BE5FB30

Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE63CF0 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,	0_2_000002733BE63CF0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE643F0 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,	0_2_000002733BE643F0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BEB26E0 NtAllocateVirtualMemory,	0_2_000002733BEB26E0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626BE34C0 NtQueryVirtualMemory,NtProtectVirtualMemory,	0_2_00007FF626BE34C0

Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE61FF0	0_2_000002733BE61FF0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE58F60	0_2_000002733BE58F60
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE1CF60	0_2_000002733BE1CF60
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE1ACC0	0_2_000002733BE1ACC0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE41340	0_2_000002733BE41340
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE222D0	0_2_000002733BE222D0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE5F200	0_2_000002733BE5F200
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE0F1C0	0_2_000002733BE0F1C0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE8114C	0_2_000002733BE8114C
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE670B0	0_2_000002733BE670B0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE61660	0_2_000002733BE61660
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE6662B	0_2_000002733BE6662B
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE6C55A	0_2_000002733BE6C55A
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE7749C	0_2_000002733BE7749C
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE68B70	0_2_000002733BE68B70
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE5FB30	0_2_000002733BE5FB30
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE9E968	0_2_000002733BE9E968
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE998C0	0_2_000002733BE998C0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE1C8C0	0_2_000002733BE1C8C0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE0F8B0	0_2_000002733BE0F8B0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE60820	0_2_000002733BE60820
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE1B820	0_2_000002733BE1B820
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE4CF70	0_2_000002733BE4CF70
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE0FEE0	0_2_000002733BE0FEE0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE89EA0	0_2_000002733BE89EA0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE5AE50	0_2_000002733BE5AE50
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE7EE06	0_2_000002733BE7EE06
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BDE5DB0	0_2_000002733BDE5DB0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE70D98	0_2_000002733BE70D98
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE4FDB0	0_2_000002733BE4FDB0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE84D78	0_2_000002733BE84D78
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BDE6D20	0_2_000002733BDE6D20
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE72CD0	0_2_000002733BE72CD0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE78C34	0_2_000002733BE78C34
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE4CC50	0_2_000002733BE4CC50
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE643F0	0_2_000002733BE643F0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE083D0	0_2_000002733BE083D0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE813C8	0_2_000002733BE813C8
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE2E320	0_2_000002733BE2E320
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE4C300	0_2_000002733BE4C300
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE102E0	0_2_000002733BE102E0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE9E2CC	0_2_000002733BE9E2CC
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE4D2A0	0_2_000002733BE4D2A0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE58230	0_2_000002733BE58230
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE551E0	0_2_000002733BE551E0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE501F0	0_2_000002733BE501F0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE1A1F0	0_2_000002733BE1A1F0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BDE6180	0_2_000002733BDE6180
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE16130	0_2_000002733BE16130
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE2E130	0_2_000002733BE2E130
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE19090	0_2_000002733BE19090
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE77060	0_2_000002733BE77060
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE4F040	0_2_000002733BE4F040
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE75044	0_2_000002733BE75044
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE7F7F4	0_2_000002733BE7F7F4
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE747FC	0_2_000002733BE747FC
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE56760	0_2_000002733BE56760
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE64740	0_2_000002733BE64740
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE7E6F8	0_2_000002733BE7E6F8
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE44710	0_2_000002733BE44710
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE286D0	0_2_000002733BE286D0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE366A0	0_2_000002733BE366A0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE506A6	0_2_000002733BE506A6
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE6B68A	0_2_000002733BE6B68A
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE745F8	0_2_000002733BE745F8
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE4C600	0_2_000002733BE4C600
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BDE6610	0_2_000002733BDE6610
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE355B0	0_2_000002733BE355B0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE05520	0_2_000002733BE05520
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE60500	0_2_000002733BE60500
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE06510	0_2_000002733BE06510
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE854E8	0_2_000002733BE854E8
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE8A438	0_2_000002733BE8A438
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE17B8D	0_2_000002733BE17B8D
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE829F4	0_2_000002733BE829F4
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE74A00	0_2_000002733BE74A00
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE39A10	0_2_000002733BE39A10
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE819B8	0_2_000002733BE819B8
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE86984	0_2_000002733BE86984
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE48950	0_2_000002733BE48950
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE4C930	0_2_000002733BE4C930
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE528C0	0_2_000002733BE528C0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE758D0	0_2_000002733BE758D0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE7088C	0_2_000002733BE7088C
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE2C820	0_2_000002733BE2C820
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C1F7EC	0_2_00007FF626C1F7EC
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C207B4	0_2_00007FF626C207B4
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C027B0	0_2_00007FF626C027B0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C28758	0_2_00007FF626C28758
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C328CC	0_2_00007FF626C328CC
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C2C8B4	0_2_00007FF626C2C8B4
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C26844	0_2_00007FF626C26844
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C1C550	0_2_00007FF626C1C550
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626BF6730	0_2_00007FF626BF6730
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626BF66E0	0_2_00007FF626BF66E0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C223EC	0_2_00007FF626C223EC
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C27358	0_2_00007FF626C27358
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C2A448	0_2_00007FF626C2A448
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C181D0	0_2_00007FF626C181D0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C1A140	0_2_00007FF626C1A140
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C122E8	0_2_00007FF626C122E8
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C202A8	0_2_00007FF626C202A8
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C1AF56	0_2_00007FF626C1AF56
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C17F90	0_2_00007FF626C17F90
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C1CFA0	0_2_00007FF626C1CFA0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C24110	0_2_00007FF626C24110
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C3209C	0_2_00007FF626C3209C
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C030B0	0_2_00007FF626C030B0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C43DA0	0_2_00007FF626C43DA0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C2FF2C	0_2_00007FF626C2FF2C
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C1CEB2	0_2_00007FF626C1CEB2
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C19C10	0_2_00007FF626C19C10
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C14C30	0_2_00007FF626C14C30
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C18C30	0_2_00007FF626C18C30
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C1FBF4	0_2_00007FF626C1FBF4
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C12B97	0_2_00007FF626C12B97
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C29CD8	0_2_00007FF626C29CD8
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C26CD8	0_2_00007FF626C26CD8
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C1CA20	0_2_00007FF626C1CA20
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626BF39E0	0_2_00007FF626BF39E0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C1F9F0	0_2_00007FF626C1F9F0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C2FA90	0_2_00007FF626C2FA90

Source: C:\Users\user\Desktop\venomderek.exe	Code function: String function: 000002733BE0B930 appears 32 times
Source: C:\Users\user\Desktop\venomderek.exe	Code function: String function: 000002733BE25330 appears 70 times
Source: C:\Users\user\Desktop\venomderek.exe	Code function: String function: 000002733BE14C00 appears 41 times
Source: C:\Users\user\Desktop\venomderek.exe	Code function: String function: 00007FF626BF51F0 appears 69 times

Source: classification engine

Classification label: mal100.troj.spyw.winEXE@1/0@1/2

Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE65970 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,		0_2_000002733BE65970
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BEB2008 AdjustTokenPrivileges,CredEnumerateA,		0_2_000002733BEB2008

Source: C:\Users\user\Desktop\venomderek.exe

Code function: 0_2_000002733BE1C8C0 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_000002733BE1C8C0

Source: C:\Users\user\Desktop\venomderek.exe

Code function: 0_2_000002733BE4F1B5 CoCreateInstance,

0_2_000002733BE4F1B5

Source: C:\Users\user\Desktop\venomderek.exe

Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E696346D1D357

Source: venomderek.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\venomderek.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: venomderek.exe

ReversingLabs: Detection: 44%

Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\venomderek.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\venomderek.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: venomderek.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: venomderek.exe

Static file information: File size 3341824 > 1048576

Source: venomderek.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x2bd800

Source: venomderek.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: venomderek.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: venomderek.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: venomderek.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: venomderek.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: venomderek.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: venomderek.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: venomderek.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: venomderek.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: venomderek.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: venomderek.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: venomderek.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: venomderek.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\venomderek.exe

Code function: 0_2_000002733BE1B820 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_000002733BE1B820

Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE5E89C push rbx; iretd	0_2_000002733BE5E89D
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE5E874 push rbx; iretd	0_2_000002733BE5E875
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C1D8A1 push rdi; ret	0_2_00007FF626C1D8A5
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C1D2C0 push rcx; iretd	0_2_00007FF626C1D2C1
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C1DB8C push rdi; ret	0_2_00007FF626C1DB90
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C1DB93 push rcx; iretd	0_2_00007FF626C1DB94

Source: C:\Users\user\Desktop\venomderek.exe

Code function: 0_2_000002733BE56480 ExitProcess,OpenMutexA,ExitProcess,CreateMutexA,CreateMutexExA,ExitProcess,ReleaseMutex,CloseHandle,

0_2_000002733BE56480

Source: C:\Users\user\Desktop\venomderek.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE99810 FindClose,FindFirstFileExW,GetLastError,		0_2_000002733BE99810
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE998C0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		0_2_000002733BE998C0

Source: C:\Users\user\Desktop\venomderek.exe

Code function: 0_2_000002733BE613B0 GetLogicalDriveStringsW,

0_2_000002733BE613B0

Source: C:\Users\user\Desktop\venomderek.exe

Code function: 0_2_000002733BE77348 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

0_2_000002733BE77348

Source: C:\Users\user\Desktop\venomderek.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: venomderek.exe, 00000000.00000003.1696909206.000002733A435000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000002.1928982571.000002733A3F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWu
Source: venomderek.exe, 00000000.00000003.1696909206.000002733A435000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000002.1928982571.000002733A3F9000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000002.1929160781.000002733BCAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\venomderek.exe	API call chain: ExitProcess graph end node			graph_0-94876
Source: C:\Users\user\Desktop\venomderek.exe	API call chain: ExitProcess graph end node			graph_0-94882

Source: C:\Users\user\Desktop\venomderek.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\venomderek.exe

Code function: 0_2_000002733BE643F0 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,

0_2_000002733BE643F0

Source: C:\Users\user\Desktop\venomderek.exe

Code function: 0_2_000002733BEB22C8 IsDebuggerPresent,

0_2_000002733BEB22C8

Source: C:\Users\user\Desktop\venomderek.exe

Code function: 0_2_000002733BE9BB14 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_000002733BE9BB14

Source: C:\Users\user\Desktop\venomderek.exe

Code function: 0_2_000002733BE1B820 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_000002733BE1B820

Source: C:\Users\user\Desktop\venomderek.exe

Code function: 0_2_000002733BE87F00 GetProcessHeap,

0_2_000002733BE87F00

Source: C:\Users\user\Desktop\venomderek.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BEB22D8 SetUnhandledExceptionFilter,	0_2_000002733BEB22D8
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_000002733BE6F920 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000002733BE6F920
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C21E68 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF626C21E68
Source: C:\Users\user\Desktop\venomderek.exe	Code function: 0_2_00007FF626C35AC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF626C35AC0

Source: C:\Users\user\Desktop\venomderek.exe

Code function: 0_2_000002733BE551E0 ShellExecuteW,

0_2_000002733BE551E0

Source: C:\Users\user\Desktop\venomderek.exe

Code function: 0_2_00007FF626C29AA0 cpuid

0_2_00007FF626C29AA0

Source: C:\Users\user\Desktop\venomderek.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_000002733BE86F14
Source: C:\Users\user\Desktop\venomderek.exe	Code function: EnumSystemLocalesW,	0_2_000002733BE7BC68
Source: C:\Users\user\Desktop\venomderek.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_000002733BE873D8
Source: C:\Users\user\Desktop\venomderek.exe	Code function: GetLocaleInfoW,	0_2_000002733BEB2398
Source: C:\Users\user\Desktop\venomderek.exe	Code function: EnumSystemLocalesW,	0_2_000002733BE87340
Source: C:\Users\user\Desktop\venomderek.exe	Code function: EnumSystemLocalesW,	0_2_000002733BE87270
Source: C:\Users\user\Desktop\venomderek.exe	Code function: GetLocaleInfoW,	0_2_000002733BE7C1A8
Source: C:\Users\user\Desktop\venomderek.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_000002733BE87778
Source: C:\Users\user\Desktop\venomderek.exe	Code function: GetLocaleInfoW,	0_2_000002733BE87620
Source: C:\Users\user\Desktop\venomderek.exe	Code function: GetLocaleInfoEx,FormatMessageA,	0_2_000002733BE99480
Source: C:\Users\user\Desktop\venomderek.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_000002733BE8795C
Source: C:\Users\user\Desktop\venomderek.exe	Code function: GetLocaleInfoW,	0_2_000002733BE87828
Source: C:\Users\user\Desktop\venomderek.exe	Code function: GetLocaleInfoW,	0_2_00007FF626C2D758
Source: C:\Users\user\Desktop\venomderek.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF626C2D88C
Source: C:\Users\user\Desktop\venomderek.exe	Code function: GetLocaleInfoW,	0_2_00007FF626C2D550
Source: C:\Users\user\Desktop\venomderek.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF626C2D6A8
Source: C:\Users\user\Desktop\venomderek.exe	Code function: GetLocaleInfoW,	0_2_00007FF626C291E0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: EnumSystemLocalesW,	0_2_00007FF626C2D1A0
Source: C:\Users\user\Desktop\venomderek.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF626C2D308
Source: C:\Users\user\Desktop\venomderek.exe	Code function: EnumSystemLocalesW,	0_2_00007FF626C2D270
Source: C:\Users\user\Desktop\venomderek.exe	Code function: EnumSystemLocalesW,	0_2_00007FF626C28E4C
Source: C:\Users\user\Desktop\venomderek.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF626C2CE44

Source: C:\Users\user\Desktop\venomderek.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\venomderek.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\Desktop\venomderek.exe

Code function: 0_2_000002733BE8DC18 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_000002733BE8DC18

Source: C:\Users\user\Desktop\venomderek.exe

Code function: 0_2_000002733BE60110 GetUserNameW,

0_2_000002733BE60110

Source: C:\Users\user\Desktop\venomderek.exe

Code function: 0_2_000002733BE8114C _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_000002733BE8114C

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: venomderek.exe PID: 4960, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.venomderek.exe.2733bde0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.venomderek.exe.2733bde0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1929160781.000002733BC90000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: venomderek.exe PID: 4960, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: venomderek.exe, 00000000.00000002.1929160781.000002733BC90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum\wallets
Source: venomderek.exe, 00000000.00000002.1929160781.000002733BC90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\config
Source: venomderek.exe, 00000000.00000003.1699713651.000002733A495000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ny1aaXAgMjMuMDEgKHg2NCkgWzIzLjAxXQpNb3ppbGxhIEZpcmVmb3ggKHg2NCBlbi1VUykgWzExOC4wLjFdCk1vemlsbGEgTWFpbnRlbmFuY2UgU2VydmljZSBbMTE4LjAuMV0KTWljcm9zb2Z0IE9mZmljZSBQcm9mZXNzaW9uYWwgUGx1cyAyMDE5IC0gZW4tdXMgWzE2LjAuMTY4MjcuMjAxMzBdCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMjIgWDY0IEFkZGl0aW9uYWwgUnVudGltZSAtIDE0LjM2LjMyNTMyIFsxNC4zNi4zMjUzMl0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBMaWNlbnNpbmcgQ29tcG9uZW50IFsxNi4wLjE2ODI3LjIwMTMwXQpPZmZpY2UgMTYgQ2xpY2stdG8tUnVuIEV4dGVuc2liaWxpdHkgQ29tcG9uZW50IDY0LWJpdCBSZWdpc3RyYXRpb24gWzE2LjAuMTY4MjcuMjAwNTZdCkFkb2JlIEFjcm9iYXQgKDY0LWJpdCkgWzIzLjAwNi4yMDMyMF0KTWljcm9zb2Z0IFZpc3VhbCBDKysgMjAyMiBYNjQgTWluaW11bSBSdW50aW1lIC0gMTQuMzYuMzI1MzIgWzE0LjM2LjMyNTMyXQpHb29nbGUgQ2hyb21lIFsxMTcuMC41OTM4LjEzMl0KTWljcm9zb2Z0IEVkZ2UgWzExNy4wLjIwNDUuNDddCk1pY3Jvc29mdCBFZGdlIFVwZGF0ZSBbMS4zLjE3Ny4xMV0KTWljcm9zb2Z0IEVkZ2UgV2ViVmlldzIgUnVudGltZSBbMTE3LjAuMjA0NS40N10KSmF2YSBBdXRvIFVwZGF0ZXIgWzIuOC4zODEuOV0KSmF2YSA4IFVwZGF0ZSAzODEgWzguMC4zODEwLjldCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMTUtMjAyMiBSZWRpc3RyaWJ1dGFibGUgKHg2NCkgLSAxNC4zNi4zMjUzMiBbMTQuMzYuMzI1MzIuMF0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBFeHRlbnNpYmlsaXR5IENvbXBvbmVudCBbMTYuMC4xNjgyNy4yMDEzMF0K
Source: venomderek.exe, 00000000.00000003.1708776603.000002733A472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallets\
Source: venomderek.exe, 00000000.00000003.1708776603.000002733A472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystoreofilesh5
Source: venomderek.exe, 00000000.00000002.1929160781.000002733BC90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: venomderek.exe, 00000000.00000003.1708776603.000002733A472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\Local Storage\leveldbks
Source: venomderek.exe, 00000000.00000002.1929160781.000002733BC90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: venomderek.exe, 00000000.00000003.1708776603.000002733A472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\walletsF:s
Source: venomderek.exe, 00000000.00000003.1708776603.000002733A472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*85
Source: venomderek.exe, 00000000.00000002.1929160781.000002733BC90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\venomderek.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\venomderek.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\venomderek.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\venomderek.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match

File source: Process Memory Space: venomderek.exe PID: 4960, type: MEMORYSTR

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: venomderek.exe PID: 4960, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.venomderek.exe.2733bde0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.venomderek.exe.2733bde0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1929160781.000002733BC90000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: venomderek.exe PID: 4960, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Access Token Manipulation	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Query Registry	Remote Desktop Protocol	1 Email Collection	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	2 Obfuscated Files or Information	Security Account Manager	31 Security Software Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	2 Process Discovery	Distributed Component Object Model	2 Data from Local System	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Account Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	3 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	34 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
venomderek.exe	45%	ReversingLabs	Win64.Trojan.CrypterX

Source	Detection	Scanner	Label	Link
https://api.ipify.orgP	0%	Avira URL Cloud	safe
https://support.mic	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.13.205	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	venomderek.exe, 00000000.00000003.1697981552.000002733BD3B000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1698368383.000002733BD54000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1698368383.000002733BD3B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	venomderek.exe, 00000000.00000003.1705089454.000002733D72B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	venomderek.exe, 00000000.00000003.1697981552.000002733BD3B000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1698368383.000002733BD54000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1698368383.000002733BD3B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	venomderek.exe, 00000000.00000003.1708499666.000002733A497000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1708776603.000002733A442000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	venomderek.exe, 00000000.00000003.1698368383.000002733BD54000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	venomderek.exe, 00000000.00000003.1708499666.000002733A497000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1708776603.000002733A442000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	venomderek.exe, 00000000.00000003.1697981552.000002733BD3B000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1698368383.000002733BD54000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1698368383.000002733BD3B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	venomderek.exe, 00000000.00000003.1708874852.000002733A4CE000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1708776603.000002733A442000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	venomderek.exe, 00000000.00000003.1698368383.000002733BD54000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	venomderek.exe, 00000000.00000003.1698833746.000002733CAA7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	venomderek.exe, 00000000.00000003.1698833746.000002733CAA7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mic	venomderek.exe, 00000000.00000003.1699663954.000002733A4A4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	venomderek.exe, 00000000.00000003.1698368383.000002733BD54000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	venomderek.exe, 00000000.00000003.1705089454.000002733D72B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	venomderek.exe, 00000000.00000003.1698368383.000002733BD54000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	venomderek.exe, 00000000.00000003.1708874852.000002733A4CE000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1708776603.000002733A442000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	venomderek.exe, 00000000.00000003.1708776603.000002733A442000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	venomderek.exe, 00000000.00000003.1698680563.000002733BD6A000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1698833746.000002733CA83000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1698680563.000002733BD43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	venomderek.exe, 00000000.00000003.1698368383.000002733BD54000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.ipify.orgP	venomderek.exe, 00000000.00000002.1929160781.000002733BC90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	venomderek.exe, 00000000.00000003.1702024780.000002733CB12000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1704041029.000002733D2CB000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1702093954.000002733BD89000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1701297813.000002733C008000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1702093954.000002733BD71000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1702773771.000002733C11C000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1701297813.000002733C000000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1702024780.000002733CB0A000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1701297813.000002733C0C0000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1701725872.000002733C114000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1701725872.000002733C0C8000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1702093954.000002733BD81000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	venomderek.exe, 00000000.00000003.1698680563.000002733BD6A000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1698833746.000002733CA83000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1698680563.000002733BD43000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ns.microsoft.t/Regi	venomderek.exe, 00000000.00000003.1696145546.000002733C1F1000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1928555875.000002733C200000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1928527130.000002733C200000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1928612447.000002733C204000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	venomderek.exe, 00000000.00000003.1698368383.000002733BD54000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	venomderek.exe, 00000000.00000003.1708874852.000002733A4CE000.00000004.00000020.00020000.00000000.sdmp, venomderek.exe, 00000000.00000003.1708776603.000002733A442000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
45.130.145.152	unknown	Russian Federation		49392	ASBAXETNRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1568493
Start date and time:	2024-12-04 17:08:32 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	venomderek.exe
Detection:	MAL
Classification:	mal100.troj.spyw.winEXE@1/0@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 100 Number of non-executed functions: 123
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: venomderek.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.13.205	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	api.ipify.org/
45.130.145.152	siveria.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	unique.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	siveria.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	chelentano.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	bv2DbIiZeK.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	brozer.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	YU7jHNMJjG.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	Documenti di spedizione.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	Order NO 000293988494948595850000595995000.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	Employee_Bonus_Notlce.pdf	Get hash	malicious	Unknown	Browse	172.67.74.152
	Employee_Important_Message.pdf	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	v58HgfB8Af.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	zwW6sDt6hU.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.12.205
	e7lGwhCp7r.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Svku9pKypu.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.12.205
	pR65xo6sud.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	uLFOeGZaJS.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.3.89
	nbjekadkthgawd.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	fukjsefsdfh.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.82.174
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	17333253674c71ac3d5875ca830e11f4630bf65d3b8b7e2686361e216df980d330c80afb30623.dat-decoded.exe	Get hash	malicious	Remcos	Browse	162.159.61.3
	downloader2.hta	Get hash	malicious	XWorm	Browse	104.21.80.1
	1733325245efb540ba670bc87cda05695e7839c909eeca3e1633b495d258461820ead14a47442.dat-decoded.exe	Get hash	malicious	Unknown	Browse	172.67.211.47
	https://larester.es/rhude/Odrivex/	Get hash	malicious	Unknown	Browse	104.16.124.96
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	188.114.97.6
	rOJS25YL2e.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
ASBAXETNRU	botnet.sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	212.196.108.28
	mips.elf	Get hash	malicious	Unknown	Browse	212.192.15.158
	ppc.elf	Get hash	malicious	Unknown	Browse	212.192.15.158
	hmips.elf	Get hash	malicious	Unknown	Browse	212.192.15.158
	siveria.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	unique.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	siveria.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	1732748284fd56a2da13edf4ae4b865c44fa6834581d27eb2edbfe3fc50ef131cb95db5639506.dat-decoded.exe	Get hash	malicious	Remcos	Browse	45.135.232.38
	mips.elf	Get hash	malicious	Unknown	Browse	212.192.15.158
	chelentano.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	Ttok18.exe	Get hash	malicious	Vidar	Browse	104.26.13.205
	jtkhikadjthsad.exe	Get hash	malicious	Vidar	Browse	104.26.13.205
	file.exe	Get hash	malicious	Vidar	Browse	104.26.13.205
	1733325245efb540ba670bc87cda05695e7839c909eeca3e1633b495d258461820ead14a47442.dat-decoded.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	FwhEhTLFjX.lnk	Get hash	malicious	Unknown	Browse	104.26.13.205
	7oE3oHSo29.lnk	Get hash	malicious	Unknown	Browse	104.26.13.205
	zLL6hlzpzh.lnk	Get hash	malicious	Unknown	Browse	104.26.13.205
	RcF6bkWVZQ.lnk	Get hash	malicious	Unknown	Browse	104.26.13.205
	3FHcnOdHz2.lnk	Get hash	malicious	Unknown	Browse	104.26.13.205
	N6qmjsVv1D.lnk	Get hash	malicious	Unknown	Browse	104.26.13.205

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	4.216644182067662
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	venomderek.exe
File size:	3'341'824 bytes
MD5:	8c1a3371880670ae29eb22eec13df95e
SHA1:	642e25d5a8a9e52ae970d3cc1f41388d4468259a
SHA256:	39e4e2d97af7b2be0aa8806afbc4d4766bc057264f556733b392ffb766174dce
SHA512:	8e7b06b4dbe4277390d504a628ada5ff65261408352c9ea66ebcec5f3afd7a7ed7cb2106cec632870d6a7945e96b44818585c21659dc4d6562d473b3e73367a1
SSDEEP:	24576:S/frmzI7lsX7Rh7lmXh0lhSMXlWuyuLNMkda9L9kKVHnwWt:KfrmzI7OXBGuyuza9n
TLSH:	F4F5AD6BEE4064F2D874D13488A3076BBA767481C37183C75A98672A5F527E43F3AF84
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N..f...5...5...5.x.4...5.x.4...5.x.4V..5A..4...5A..4...5A..4...52\|.4$..52\|.4...5By.4...5A..4...5...5...5Ay.4...5AyH5...5Ay.4...

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x140055a30
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67451F50 [Tue Nov 26 01:07:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	de1751741e7d5e07ce98493d3f0130fc

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F66F0D8CD3Ch
dec eax
add esp, 28h
jmp 00007F66F0D8C0BFh
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007F66F0D8C252h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007F66F0D8C255h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007F66F0D8C24Dh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007F66F0D8BC86h
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0001563Fh]
dec eax
mov ecx, ebx
call dword ptr [0001562Eh]
call dword ptr [000155B0h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00015624h]
dec eax
mov dword ptr [esp+00h], ecx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x327b9c	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x332000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x32c000	0x57e4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x333000	0x1d38	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x320ef0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x321100	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x320db0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x6b000	0x330	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x692f0	0x69400	201d673c76ad9fae647f8cd6a278e333	False	0.4342200489904988	data	6.181155425260236	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x6b000	0x2bd696	0x2bd800	6599172dd241f7d115afebbfecce8712	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x329000	0x2f1c	0x1600	8e0cf2168d43982c322bc34eed94de2b	False	0.18980823863636365	data	3.2059756111359152	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x32c000	0x57e4	0x5800	4c0d14150dd6a4ac35b35408d7a8233d	False	0.47767223011363635	data	5.711183919097264	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x332000	0x1e0	0x200	0c1ab865bc43ec75ebd479502575ccef	False	0.525390625	data	4.700456763479242	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x333000	0x1d38	0x1e00	3d9cd06dc9d02c11c130514ad02ec0c5	False	0.6712239583333334	data	6.471011674882192	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x332060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
ntdll.dll	RtlImageDirectoryEntryToData, RtlLeaveCriticalSection, RtlEnterCriticalSection, RtlCompareMemory, NtProtectVirtualMemory, RtlImageNtHeader, NtQueryVirtualMemory, RtlGetNtVersionNumbers
KERNEL32.dll	GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, FindNextFileW, FindFirstFileExW, FindClose, VirtualFree, VirtualAlloc, GetModuleHandleW, LoadLibraryA, ReadFile, WriteFile, CreateFileW, CloseHandle, GetProcAddress, GetCurrentProcess, VirtualQuery, EnterCriticalSection, GetModuleFileNameW, LeaveCriticalSection, MultiByteToWideChar, ExitProcess, WideCharToMultiByte, GetLastError, DeleteCriticalSection, SetLastError, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, GetSystemTimeAsFileTime, HeapAlloc, HeapFree, GetCurrentThreadId, GetStdHandle, GetFileType, FreeEnvironmentStringsW, RaiseException, HeapReAlloc, HeapSize, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, InitializeCriticalSectionAndSpinCount, FreeLibrary, LoadLibraryExW, LCMapStringW, GetLocaleInfoW, IsValidLocale, EnumSystemLocalesW, GetCPInfo, GetStringTypeW, IsValidCodePage, GetACP, GetOEMCP, GetModuleHandleExW, GetConsoleOutputCP, GetConsoleMode, GetFileSizeEx, SetFilePointerEx, GetProcessHeap, SetStdHandle, ReadConsoleW, FlushFileBuffers, WriteConsoleW, QueryPerformanceCounter, GetCurrentProcessId, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, RtlUnwind, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetUserDefaultLCID, InitializeCriticalSectionEx, DecodePointer, LCMapStringEx
USER32.dll	LoadAcceleratorsA, LoadAcceleratorsW
ADVAPI32.dll	GetTokenInformation, OpenProcessToken

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-04T17:09:29.817533+0100	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.4	49730	45.130.145.152	15666	TCP
2024-12-04T17:09:29.817533+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	49730	45.130.145.152	15666	TCP
2024-12-04T17:09:29.817533+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49730	45.130.145.152	15666	TCP
2024-12-04T17:09:29.938186+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	49730	45.130.145.152	15666	TCP
2024-12-04T17:09:29.938186+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49730	45.130.145.152	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 4, 2024 17:09:23.638418913 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:23.758595943 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:23.758871078 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:23.959229946 CET	49731	443	192.168.2.4	104.26.13.205
Dec 4, 2024 17:09:23.959294081 CET	443	49731	104.26.13.205	192.168.2.4
Dec 4, 2024 17:09:23.959361076 CET	49731	443	192.168.2.4	104.26.13.205
Dec 4, 2024 17:09:23.969393969 CET	49731	443	192.168.2.4	104.26.13.205
Dec 4, 2024 17:09:23.969432116 CET	443	49731	104.26.13.205	192.168.2.4
Dec 4, 2024 17:09:25.209085941 CET	443	49731	104.26.13.205	192.168.2.4
Dec 4, 2024 17:09:25.209306002 CET	49731	443	192.168.2.4	104.26.13.205
Dec 4, 2024 17:09:25.507194042 CET	49731	443	192.168.2.4	104.26.13.205
Dec 4, 2024 17:09:25.507230043 CET	443	49731	104.26.13.205	192.168.2.4
Dec 4, 2024 17:09:25.507594109 CET	443	49731	104.26.13.205	192.168.2.4
Dec 4, 2024 17:09:25.507666111 CET	49731	443	192.168.2.4	104.26.13.205
Dec 4, 2024 17:09:25.517707109 CET	49731	443	192.168.2.4	104.26.13.205
Dec 4, 2024 17:09:25.559329033 CET	443	49731	104.26.13.205	192.168.2.4
Dec 4, 2024 17:09:25.850214958 CET	443	49731	104.26.13.205	192.168.2.4
Dec 4, 2024 17:09:25.850274086 CET	443	49731	104.26.13.205	192.168.2.4
Dec 4, 2024 17:09:25.850332975 CET	49731	443	192.168.2.4	104.26.13.205
Dec 4, 2024 17:09:25.850399017 CET	49731	443	192.168.2.4	104.26.13.205
Dec 4, 2024 17:09:25.850790024 CET	49731	443	192.168.2.4	104.26.13.205
Dec 4, 2024 17:09:25.850805998 CET	443	49731	104.26.13.205	192.168.2.4
Dec 4, 2024 17:09:29.817533016 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:29.938066006 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:29.938088894 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:29.938100100 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:29.938139915 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:29.938185930 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:29.938191891 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:29.938203096 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:29.938206911 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:29.938210964 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:29.938218117 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:29.938226938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:29.938246012 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:29.938287020 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:29.938415051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:29.938468933 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.060913086 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.060928106 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.060945988 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.060955048 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.061017036 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.061219931 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.061249971 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.061268091 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.061391115 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.061966896 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.062417030 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.062524080 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.188072920 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.188124895 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.188167095 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.188239098 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.188251019 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.188266039 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.188322067 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.188328028 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.190726042 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.384722948 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.384983063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.429171085 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.429306030 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.429323912 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.429420948 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.429512024 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.429522038 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.429526091 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.429567099 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.429569006 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.429579020 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.429624081 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.429625988 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.429635048 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.429682970 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.429725885 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.429765940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.429815054 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.429828882 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.429924011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.429980040 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.429980993 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.429989100 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.430038929 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.430124044 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.430133104 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.430161953 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.430183887 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.430186987 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.430208921 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.430231094 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.430252075 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.430260897 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.430293083 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.430315971 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.430341959 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.430351973 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.430393934 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.430444956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.430454016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.430495977 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.430501938 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.430504084 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.430541992 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.430546999 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.430598021 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.430604935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.430634975 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.430685043 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.430692911 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.430701971 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.430747032 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.430768967 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.430778980 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.430825949 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.430865049 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.430891037 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.430948019 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.431006908 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.431041956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.431092978 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.431126118 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.434726954 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.505036116 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.505058050 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.505109072 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.505145073 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.549675941 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.549700975 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.549710989 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.549736023 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.549761057 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.549791098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.549809933 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.549858093 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.549882889 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.549901962 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.549930096 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.549995899 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.550007105 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.550064087 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.550065041 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.550100088 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.550108910 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.550147057 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.550148964 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.550193071 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.550201893 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.550244093 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.550259113 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.550275087 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.550299883 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.550311089 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.550401926 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.550455093 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.550476074 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.550486088 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.550518990 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.550534010 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.550539017 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.550545931 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.550580025 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.550604105 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.550649881 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.550669909 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.550693989 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.550715923 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.550739050 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.550806999 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.550816059 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.550856113 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.550872087 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.550919056 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.550925970 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.550941944 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.550972939 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.550992012 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.624757051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.624846935 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.669398069 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.669418097 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.669503927 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.669512987 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.669548988 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.669568062 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.669617891 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.669665098 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.669698954 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.669720888 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.669740915 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.669990063 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.670000076 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.670047045 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.670090914 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.670118093 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.670142889 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.670160055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.670217991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.670227051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.670278072 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.670308113 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.670356989 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.670397043 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.670406103 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.670413971 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.670448065 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.670459986 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.670469046 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.670469999 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.670502901 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.670516968 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.670553923 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.670572042 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.670603991 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.670615911 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.670648098 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.670672894 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.670702934 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.670723915 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.670763969 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.670793056 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.670828104 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.670839071 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.670923948 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.670943022 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.670975924 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.670984983 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.671040058 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.671092033 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.671107054 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.671123981 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.671159029 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.671180964 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.671209097 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.671217918 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.671225071 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.671261072 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.671272039 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.744690895 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.744709015 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.744824886 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.789427996 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.789448023 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.789462090 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.789470911 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.789545059 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.789556980 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.789565086 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.789575100 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.789622068 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.789622068 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.789633036 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.789652109 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.789681911 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.789742947 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.789793968 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.789886951 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.789935112 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.790009022 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.790030003 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.790039062 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.790066004 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.790083885 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.790087938 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.790143967 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.790154934 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.790179014 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.790205002 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.790225983 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.790229082 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.790271044 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.790322065 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.790368080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.790373087 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.790384054 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.790436983 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.790462017 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.790471077 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.790518045 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.790572882 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.790581942 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.790610075 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.790627956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.790630102 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.790658951 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.790673018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.790721893 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.790731907 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.790766954 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.790775061 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.790776968 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.790818930 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.790899992 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.790952921 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.864653111 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.864715099 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.909115076 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.909132004 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.909162045 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.909209013 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.909271002 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.909315109 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.909442902 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.909459114 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.909476042 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.909495115 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.909518003 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.909524918 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.909569979 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.909596920 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.909606934 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.909646988 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.909740925 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.909750938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.909780979 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.909789085 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.909801006 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.909828901 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.909857035 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.909970999 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.909997940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.910015106 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.910042048 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.910108089 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.910118103 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.910161018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.910212040 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.910259962 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.910263062 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.910307884 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.910334110 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.910368919 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.910379887 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.910412073 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.910521030 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.910530090 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.910542011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.910578966 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.910592079 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.910593033 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.910618067 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.910629988 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.910660982 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.910686016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.910712004 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.910729885 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.910758018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.910819054 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.910828114 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.910866022 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.910928965 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.910964012 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.910972118 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.911011934 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.911039114 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.911087036 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.911102057 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.911145926 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:30.984488010 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:30.984594107 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.029632092 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.029674053 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.029726982 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.029731989 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.029758930 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.029767990 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.029783964 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.029787064 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.029814005 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.029820919 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.029830933 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.029841900 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.029867887 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.029877901 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.029895067 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.029926062 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.029939890 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.029947996 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.029973984 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.029997110 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.030021906 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.030023098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.030049086 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.030092955 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.030097008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.030123949 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.030149937 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.030177116 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.030185938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.030213118 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.030241013 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.030267000 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.030278921 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.030304909 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.030329943 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.030354977 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.030406952 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.030435085 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.030459881 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.030466080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.030491114 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.030493975 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.030517101 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.030549049 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.030571938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.030601025 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.030622005 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.030632973 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.030648947 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.030659914 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.030694962 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.030731916 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.030757904 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.030785084 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.030817986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.030821085 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.030843019 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.030864954 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.030867100 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.030910015 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.030915976 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.030963898 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.031001091 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.031028032 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.031055927 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.031075001 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.031081915 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.031133890 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.104990005 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.105134964 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.149410009 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.149441004 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.149518967 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.149538040 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.149548054 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.149583101 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.149600983 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.149607897 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.149636984 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.149653912 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.149697065 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.149769068 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.149826050 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.149863958 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.149916887 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.150038004 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.150069952 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.150091887 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.150129080 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.150233984 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.150274992 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.150288105 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.150331974 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.150485039 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.150512934 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.150538921 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.150554895 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.150609970 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.150654078 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.150717020 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.150748014 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.150779009 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.150793076 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.150835991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.150886059 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.150985956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.151012897 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.151034117 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.151057959 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.151060104 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.151108027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.151118994 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.151134968 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.151160002 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.151184082 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.151197910 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.151211977 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.151237011 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.151259899 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.151261091 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.151288033 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.151315928 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.151339054 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.151351929 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.151393890 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.151403904 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.151421070 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.151446104 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.151463032 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.151479959 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.151515007 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.151523113 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.151542902 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.151568890 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.151577950 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.151596069 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.151606083 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.151623011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.151623011 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.151653051 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.151654959 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.151683092 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.151715040 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.225008011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.225306034 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.269154072 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.269185066 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.269221067 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.269244909 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.269285917 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.269314051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.269340992 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.269340992 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.269367933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.269371033 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.269395113 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.269402027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.269428968 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.269435883 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.269454002 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.269455910 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.269478083 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.269512892 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.269519091 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.269567966 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.269578934 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.269613981 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.269625902 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.269640923 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.269673109 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.269711971 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.269716978 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.269740105 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.269769907 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.269771099 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.269792080 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.269798040 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.269824982 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.269828081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.269850016 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.269876003 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.269882917 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.269927025 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.269998074 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.270052910 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.270061970 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.270118952 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.270143986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.270172119 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.270198107 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.270219088 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.270230055 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.270256996 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.270286083 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.270287991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.270306110 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.270335913 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.270339012 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.270385981 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.270426989 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.270473957 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.270492077 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.270507097 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.270535946 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.270559072 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.270570040 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.270617008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.270625114 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.270643950 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.270670891 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.270693064 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.270699024 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.270720005 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.270744085 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.270767927 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.270823002 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.270876884 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.270941019 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.270972013 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.270997047 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.271018982 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.345067978 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.345179081 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.391271114 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.391349077 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.391380072 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.391407967 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.391438007 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.391458988 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.391462088 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.391513109 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.391534090 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.391540051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.391556978 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.391566038 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.391592026 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.391597986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.391611099 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.391623020 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.391644001 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.391670942 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.391704082 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.391731024 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.391750097 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.391772985 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.391793013 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.391819954 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.391844034 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.391869068 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.391932011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.391963005 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.391987085 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.392031908 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.392059088 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.392072916 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.392091036 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.392093897 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.392119884 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.392142057 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.392174959 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.392222881 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.392265081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.392273903 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.392297983 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.392312050 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.392323971 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.392345905 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.392369032 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.392472982 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.392518997 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.392581940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.392628908 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.392680883 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.392714977 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.392729998 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.392771959 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.392827034 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.392853975 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.392879963 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.392900944 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.392913103 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.392927885 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.392956018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.392973900 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.392975092 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.393002033 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.393032074 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.393055916 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.393085957 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.393112898 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.393141985 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.393146038 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.393173933 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.393189907 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.393192053 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.393248081 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.393296957 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.393323898 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.393352985 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.393373966 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.464813948 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.464895964 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.512778997 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.512829065 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.512862921 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.512898922 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.513015032 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.513035059 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.513062954 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.513082027 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.513181925 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.513200045 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.513227940 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.513242960 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.513336897 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.513355017 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.513381004 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.513394117 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.513458967 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.513477087 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.513505936 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.513524055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.513566017 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.513585091 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.513608932 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.513626099 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.513628006 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.513643026 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.513679981 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.513770103 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.513798952 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.513818979 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.513844013 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.513953924 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.514005899 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.514023066 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.514071941 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.514154911 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.514202118 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.514214039 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.514256954 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.514339924 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.514386892 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.514395952 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.514441013 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.514517069 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.514525890 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.514570951 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.514575005 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.514584064 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.514626980 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.514653921 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.514662981 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.514705896 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.514781952 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.514827967 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.514837980 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.514885902 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.514934063 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.514942884 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.514983892 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.515000105 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.515010118 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.515052080 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.515053988 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.515064001 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.515094995 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.515104055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.515140057 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.515145063 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.515187979 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.515191078 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.515240908 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.585422039 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.585484982 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.585490942 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.585520029 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.585689068 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.632158995 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.632196903 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.632251024 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.632266045 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.632282019 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.632288933 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.632302999 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.632375002 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.632375002 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.632424116 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.632428885 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.632481098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.632524967 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.632553101 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.632580042 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.632586002 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.632601023 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.632652998 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.632822990 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.632850885 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.632877111 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.632898092 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.632919073 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.632951975 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.632972002 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.633001089 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.633002043 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.633029938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.633059025 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.633080006 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.633080006 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.633106947 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.633131981 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.633138895 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.633157015 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.633189917 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.633224964 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.633251905 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.633272886 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.633300066 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.633300066 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.633327007 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.633348942 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.633353949 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.633379936 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.633400917 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.633429050 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.633455992 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.633477926 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.633486986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.633506060 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.633513927 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.633541107 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.633564949 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.633569002 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.633626938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.633627892 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.633654118 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.633680105 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.633683920 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.633711100 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.633728981 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.633733034 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.633786917 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.633800030 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.633826971 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.633851051 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.633872032 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.633876085 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.633903980 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.633929968 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.633930922 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.633941889 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.633980036 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.633980989 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.634006977 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.634037971 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.634061098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.705205917 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.705239058 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.705281019 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.705298901 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.754204035 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.754254103 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.754287004 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.754334927 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.754440069 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.754507065 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.754535913 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.754568100 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.754590034 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.754633904 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.754662037 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.754690886 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.754702091 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.754710913 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.754736900 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.754761934 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.754796982 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.754848003 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.754901886 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.754905939 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.754981041 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.755120039 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.755168915 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.755176067 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.755220890 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.755254030 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.755301952 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.755302906 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.755352974 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.755377054 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.755403996 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.755429029 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.755448103 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.755501032 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.755531073 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.755552053 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.755570889 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.755630016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.755682945 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.755686045 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.755733013 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.756234884 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.756278992 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.756284952 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.756306887 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.756330013 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.756339073 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.756367922 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.756370068 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.756378889 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.756395102 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.756421089 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.756421089 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.756444931 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.756448030 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.756474018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.756478071 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.756496906 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.756505013 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.756525993 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.756531000 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.756556034 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.756557941 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.756584883 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.756587029 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.756611109 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.756618023 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.756628990 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.756659031 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.756669998 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.756686926 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.756715059 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.756716967 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.756736040 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.756781101 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.825022936 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.825054884 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.825100899 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.825119019 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.874531031 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.874572992 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.874627113 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.874654055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.874682903 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.874712944 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.874735117 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.874743938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.874763012 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.874775887 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.874840021 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.874870062 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.874900103 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.874923944 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.874996901 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.875005960 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.875032902 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.875058889 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.875103951 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.875107050 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.875145912 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.875179052 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.875184059 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.875206947 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.875207901 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.875240088 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.875241995 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.875252008 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.875267029 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.875299931 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.875323057 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.875353098 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.875415087 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.875471115 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.875534058 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.875540018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.875576973 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.875595093 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.875629902 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.875639915 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.875684023 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.875699043 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.875741959 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.920643091 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.920715094 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.944904089 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.944964886 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.994843960 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.994900942 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.994911909 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.994951963 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.994957924 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.995012045 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.995038033 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.995094061 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.995240927 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.995269060 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.995304108 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.995320082 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.995342970 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.995393991 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.995404959 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.995460033 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.995577097 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.995629072 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.995676041 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.995728016 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.995781898 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.995846987 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.995898962 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.995925903 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.995954037 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.995954037 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.995980978 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.995985031 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.996001959 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.996033907 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:31.996048927 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:31.996098995 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.064795017 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.064908028 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.110297918 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.110387087 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.116858006 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.116933107 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.117145061 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.117193937 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.117223978 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.117285013 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.117320061 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.117372990 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.117398024 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.117444992 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.117650986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.117706060 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.117769957 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.117814064 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.117821932 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.117863894 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.118029118 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.118079901 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.118115902 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.118165970 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.118247986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.118273973 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.118294954 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.118325949 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.118335009 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.118383884 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.118402958 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.118452072 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.118535042 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.118587017 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.118607044 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.118652105 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.118714094 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.118745089 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.118767977 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.118798018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.118829966 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.118860960 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.118877888 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.118907928 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.184907913 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.184988022 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.237544060 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.237574100 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.237621069 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.237648964 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.237669945 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.237694979 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.237704039 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.237704992 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.237742901 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.237761974 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.237793922 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.237797976 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.237843037 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.237858057 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.237889051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.237899065 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.237921000 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.237950087 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.237968922 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.237979889 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.237996101 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.238023043 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.238049984 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.238089085 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.238146067 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.238332987 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.238404989 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.238440037 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.238466978 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.238492012 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.238497019 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.238518000 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.238547087 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.284147978 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.284240007 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.304733992 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.305011988 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.357510090 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.357573032 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.357628107 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.357702971 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.357732058 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.357795954 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.357855082 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.357903957 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.357969046 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.358032942 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.358067989 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.358124018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.358155012 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.358212948 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.358223915 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.358252048 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.358283043 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.358293056 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.358310938 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.358314037 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.358330011 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.358381987 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.358442068 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.358474970 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.358501911 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.358525038 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.358578920 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.358632088 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.358710051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.358764887 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.358839989 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.358871937 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.358896017 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.358937979 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.359059095 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.359127045 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.400186062 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.400289059 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.425178051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.425380945 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.478631020 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.478719950 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.478787899 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.478821993 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.478853941 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.478873968 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.478909016 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.479046106 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.479104996 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.479171038 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.479217052 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.479232073 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.479279041 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.479331017 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.479389906 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.479571104 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.479603052 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.479635000 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.479661942 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.480015993 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.480104923 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.480118990 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.480187893 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.544728041 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.544812918 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.598263025 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.598349094 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.598351002 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.598423004 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.598572969 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.598629951 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.598747969 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.598809958 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.598845959 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.598905087 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.598968029 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.599021912 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.599052906 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.599113941 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.599128008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.599179029 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.599215984 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.599267960 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.599344969 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.599400997 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.599489927 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.599545956 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.599597931 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.599658012 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.600431919 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.600511074 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.600514889 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.600544930 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.600600958 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.644248962 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.644459009 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.664628983 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.664820910 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.719409943 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.719517946 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.719824076 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.719887018 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.719897985 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.719968081 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.720011950 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.720066071 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.720110893 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.720168114 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.720190048 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.720238924 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.720336914 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.720406055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.720464945 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.720516920 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.720592976 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.720618010 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.720643997 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.720666885 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.720701933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.720750093 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.720803976 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.720859051 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.720875025 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.720932007 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.720967054 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.721019030 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.721040964 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.721091032 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.721476078 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.721513987 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.721529961 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.721565962 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.721594095 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.721651077 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.786330938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.786463976 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.847806931 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.847996950 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.906014919 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.906088114 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.952183008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.952240944 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.959861040 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.959893942 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.959934950 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.959969997 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.960042000 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.960098982 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.960650921 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.960736036 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.960767984 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.960829020 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.961208105 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.961256981 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.961797953 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.961848021 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.961850882 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.961899996 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:32.967602968 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:32.967660904 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.008177996 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.008232117 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.026633978 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.026729107 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.079996109 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.080061913 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.080257893 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.080332041 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.080585957 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.080645084 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.080991030 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.081056118 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.081151009 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.081197023 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.081207037 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.081250906 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.081911087 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.081958055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.081988096 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.082034111 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.087505102 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.087595940 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.132586002 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.132675886 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.146372080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.146492958 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.199739933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.199763060 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.199866056 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.199881077 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.199887991 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.199913979 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.199929953 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.199959993 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.200124979 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.200166941 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.200196981 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.200210094 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.200248003 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.200259924 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.200453997 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.200500011 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.200619936 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.200671911 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.200687885 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.200731993 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.200803041 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.200853109 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.200891018 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.200936079 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.201103926 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.201153994 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.201226950 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.201272011 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.201287985 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.201334953 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.201420069 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.201468945 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.201574087 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.201623917 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.201802015 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.201843023 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.201914072 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.201958895 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.202033997 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.202089071 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.207300901 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.207360983 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.266752005 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.266856909 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.319605112 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.319628000 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.319788933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.319844961 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.319863081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.319876909 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.319922924 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.320314884 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.320372105 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.320420027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.320432901 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.320509911 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.320523977 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.320593119 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.320624113 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.320674896 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.320713043 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.320722103 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.320763111 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.320771933 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.320811033 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.320813894 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.320863962 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.320882082 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.320919991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.320934057 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.320981026 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.321320057 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.321373940 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.321425915 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.321477890 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.326904058 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.326965094 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.387902975 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.388124943 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.439352989 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.439594030 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.439677954 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.439717054 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.439748049 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.439779043 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.440078974 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.440093040 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.440140963 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.440499067 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.440582037 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.440620899 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.440676928 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.440699100 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.440753937 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.440949917 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.441005945 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.441128016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.441178083 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.446542025 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.446579933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.446631908 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.446656942 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.508881092 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.508958101 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.566916943 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.567076921 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.568905115 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.568989038 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.629807949 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.629924059 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.680318117 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.680399895 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.680435896 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.680490971 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.680529118 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.680583954 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.680608034 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.680655956 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.680828094 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.680874109 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.681046963 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.681097984 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.681170940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.681219101 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.681277990 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.681325912 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.681401968 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.681448936 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.681543112 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.681581020 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.681678057 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.681721926 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.681785107 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.681797028 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.681842089 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.681878090 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.681886911 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.681894064 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.681936026 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.681950092 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.682034016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.682043076 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.682096004 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.687521935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.687594891 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.728873014 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.728967905 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.749728918 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.749835014 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.800539017 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.800601006 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.800668001 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.800708055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.800719976 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.800775051 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.800884962 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.800939083 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.800957918 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.801012039 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.801269054 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.801335096 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.801420927 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.801430941 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.801440954 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.801484108 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.801503897 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.801528931 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.801583052 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.801604033 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.801654100 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.801707983 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.801757097 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.801912069 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.801968098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.802025080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.802078962 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.802088976 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.802138090 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.802145958 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.802191019 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.807357073 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.807434082 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.853060961 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.853131056 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.870606899 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.870811939 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.922837019 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.922904015 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.923010111 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.923089027 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.923096895 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.923151970 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.923232079 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.923284054 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.923347950 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.923397064 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.923405886 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.923450947 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.923599958 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.923638105 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.923648119 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.923681974 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.923702955 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.923737049 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.923749924 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.923780918 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.923871040 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.923924923 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.923928022 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.923975945 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.924043894 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.924053907 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.924099922 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.924109936 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.924134970 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.924153090 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.924165964 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.924190044 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.924220085 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.928508043 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.928560972 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.928616047 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.928666115 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:33.990247011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:33.990431070 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.043050051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.043081999 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.043098927 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.043139935 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.043183088 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.043201923 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.043217897 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.043272972 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.043356895 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.043412924 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.043492079 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.043549061 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.043602943 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.043662071 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.043685913 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.043720961 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.043739080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.043767929 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.043798923 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.043797970 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.043818951 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.043845892 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.043848991 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.043889999 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.043905020 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.043946028 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.043983936 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.044015884 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.044042110 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.044073105 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.044106960 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.044150114 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.044161081 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.044199944 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.044204950 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.044250011 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.048861980 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.048932076 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.048949003 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.049005985 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.093355894 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.093458891 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.111222982 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.111289978 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.162998915 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.163054943 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.163090944 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.163119078 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.163165092 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.163239002 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.163281918 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.163346052 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.163449049 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.163501024 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.163588047 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.163620949 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.163649082 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.163671017 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.163846016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.163897038 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.163966894 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.164025068 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.164124012 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.164181948 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.164232016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.164294004 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.164385080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.164443016 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.164490938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.164549112 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.164587975 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.164616108 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.164644003 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.164671898 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.164674044 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.164699078 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.164725065 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.164729118 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.164748907 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.164792061 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.169511080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.169599056 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.231955051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.232059956 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.276473999 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.276566982 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.282758951 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.282792091 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.282824039 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.282831907 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.282854080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.282859087 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.282883883 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.282901049 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.282975912 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.283025026 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.283191919 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.283220053 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.283247948 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.283269882 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.283492088 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.283521891 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.283549070 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.283582926 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.283646107 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.283704996 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.283785105 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.283814907 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.283850908 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.283870935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.283879042 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.283926010 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.284009933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.284037113 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.284059048 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.284090996 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.284193039 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.284245014 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.288965940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.289036989 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.289098024 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.289125919 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.289155006 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.289182901 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.355026007 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.355264902 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.408279896 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.408410072 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.408468962 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.408479929 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.408504963 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.408525944 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.408550978 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.408576965 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.408684015 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.408746004 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.408786058 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.408842087 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.408924103 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.408979893 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.409025908 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.409077883 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.409153938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.409204960 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.409218073 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.409271955 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.409331083 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.409341097 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.409390926 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.409461975 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.409527063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.409599066 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.409652948 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.409658909 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.409708977 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.409751892 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.409802914 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.409895897 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.409950018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.414779902 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.414839029 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.414869070 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.414923906 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.414988995 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.415047884 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.456223965 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.456403017 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.475486994 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.475826979 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.528047085 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.528198004 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.528306961 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.528366089 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.528465986 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.528472900 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.528522015 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.528592110 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.528656006 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.528665066 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.528688908 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.528712034 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.528743029 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.528789997 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.528841019 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.528865099 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.528911114 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.528917074 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.528969049 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.529026031 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.529057026 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.529078007 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.529103994 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.529252052 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.529305935 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.529350042 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.529403925 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.529459000 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.529510021 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.534399986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.534481049 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.534490108 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.534522057 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.534544945 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.534579992 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.576303959 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.576462984 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.594865084 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.594928026 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.647810936 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.647857904 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.647886992 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.647913933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.647942066 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.647974014 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.647975922 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.648040056 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.648087025 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.648150921 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.648165941 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.648226023 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.648375988 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.648443937 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.648606062 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.648638964 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.648665905 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.648665905 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.648696899 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.648699999 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.648721933 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.648749113 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.648827076 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.648889065 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.648905039 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.648966074 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.649032116 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.649089098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.649125099 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.649179935 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.654165030 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.654227018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.654254913 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.654311895 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.696017027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.696093082 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.715809107 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.715897083 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.756237984 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.756433964 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.767652988 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.767735004 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.767819881 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.767875910 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.767930984 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.767982960 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.768096924 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.768150091 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.768239975 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.768300056 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.768409014 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.768466949 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.768580914 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.768635035 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.768786907 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.768843889 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.768965960 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.769016027 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.769093037 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.769144058 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.769229889 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.769237995 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.769290924 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.769321918 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.769375086 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.769378901 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.769434929 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.769579887 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.769633055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.769694090 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.769702911 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.769753933 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.769964933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.770023108 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.774152040 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.774216890 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.815864086 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.815886021 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.815932035 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.815958977 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.835367918 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.835422039 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.888380051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.888448000 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.888494968 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.888545036 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.888649940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.888704062 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.888848066 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.888916016 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.889101028 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.889163971 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.889202118 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.889249086 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.889309883 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.889363050 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.889391899 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.889441013 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.889523983 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.889569044 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.889615059 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.889662027 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.889818907 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.889866114 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.889899015 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.889946938 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.893804073 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.893892050 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.893939972 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.894000053 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.894020081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.894071102 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.936011076 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.936188936 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.936193943 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.936247110 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:34.955835104 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:34.955919027 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.008455038 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.008626938 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.008652925 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.008748055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.008753061 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.008785009 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.008806944 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.008814096 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.008837938 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.008862972 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.008866072 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.008913994 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.008923054 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.008975029 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.008991957 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.009042025 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.009218931 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.009273052 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.009344101 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.009377003 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.009397030 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.009424925 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.009426117 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.009476900 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.009480953 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.009535074 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.009560108 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.009593010 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.009612083 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.009641886 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.009835005 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.009896040 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.013804913 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.013864994 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.013931990 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.013983965 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.056200981 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.056390047 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.056396961 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.056448936 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.075443983 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.075539112 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.128752947 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.128842115 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.128962994 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.129889011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.129971027 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.130002022 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.130060911 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.131006956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.131068945 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.131078005 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.131129980 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.131134033 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.131175995 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.131186008 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.131232023 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.132240057 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.132292986 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.132509947 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.132539034 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.132575035 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.132591009 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.133496046 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.133524895 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.133547068 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.133574009 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.134932041 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.134984016 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.136096001 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.136148930 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.136151075 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.136202097 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.137645006 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.137697935 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.137697935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.137752056 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.138770103 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.138823032 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.175949097 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.176048994 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.176111937 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.176305056 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.195211887 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.195352077 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.195452929 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.248897076 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.248949051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.249157906 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.249814987 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.249880075 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.249974012 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.250809908 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.250860929 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.250863075 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.250891924 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.250916958 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.250938892 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.250979900 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.251960993 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.252007961 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.252202988 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.252255917 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.253562927 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.253616095 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.253626108 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.253671885 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.253674030 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.253720999 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.255384922 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.255440950 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.255511045 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.255568027 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.256764889 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.256814003 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.256922007 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.256973982 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.258364916 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.258541107 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.259330034 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.259408951 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.295469046 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.295639038 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.295649052 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.295695066 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.315701962 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.315788984 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.368652105 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.368946075 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.369716883 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.369784117 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.369784117 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.369838953 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.370419979 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.370471954 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.370649099 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.370678902 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.370704889 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.370709896 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.370726109 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.370760918 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.370776892 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.370826960 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.371959925 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.372018099 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.373188972 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.373245955 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.373250008 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.373306990 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.373368979 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.373431921 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.375111103 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.375164032 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.375180006 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.375217915 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.376400948 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.376456976 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.376565933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.376625061 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.378184080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.378232956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.378240108 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.378298998 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.378951073 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.379024029 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.415927887 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.415982008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.415994883 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.416064978 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.435966969 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.436031103 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.488385916 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.488455057 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.488508940 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.488533974 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.488676071 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.488738060 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.489468098 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.489526033 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.489577055 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.489639997 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.490122080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.490176916 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.490221977 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.490272045 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.490282059 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.490328074 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.490329027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.490379095 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.490386963 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.490433931 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.491698027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.491758108 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.493139982 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.493201017 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.493534088 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.493563890 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.493597031 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.493614912 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.495342016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.495369911 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.495394945 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.495426893 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.496292114 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.496351957 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.496412992 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.496471882 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.497955084 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.498012066 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.498397112 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.498465061 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.498972893 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.499052048 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.536247969 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.536350012 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.536398888 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.536457062 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.559017897 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.559134007 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.609386921 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.609416962 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.609585047 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.609695911 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.609781027 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.610407114 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.610436916 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.610471964 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.610496998 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.611149073 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.611208916 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.611339092 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.611366987 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.611397982 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.611421108 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.611464024 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.611512899 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.611515999 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.611569881 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.612514973 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.612569094 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.614105940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.614165068 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.614245892 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.614306927 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.614402056 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.614459038 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.615535021 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.615593910 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.615705013 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.615760088 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.617305040 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.617369890 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.617468119 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.617527008 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.618845940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.618872881 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.618904114 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.618932962 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.619771957 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.619849920 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.656182051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.656315088 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.656363964 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.656383991 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.656413078 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.656425953 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.656471014 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.676294088 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.676388979 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.729805946 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.729902983 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.729913950 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.729965925 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.732515097 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.732543945 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.732569933 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.732598066 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.732609034 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.732629061 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.732657909 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.732671976 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.732685089 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.732700109 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.732727051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.732736111 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.732749939 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.732784033 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.732851982 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.732906103 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.734328985 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.734390020 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.734424114 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.734487057 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.737456083 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.737485886 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.737512112 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.737517118 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.737544060 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.737571001 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.737927914 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.737981081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.737984896 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.738034964 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.739422083 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.739480972 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.739500046 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.739561081 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.740159988 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.740237951 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.777539968 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.777630091 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.777673006 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.777822018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.780548096 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.780599117 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.798038960 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.798125029 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.844218016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.844428062 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.852349997 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.852468967 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.852739096 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.852777958 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.852812052 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.852833033 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.852869987 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.852920055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.852951050 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.853003979 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.853208065 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.853254080 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.853302956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.853348970 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.853353977 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.853399038 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.857805967 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.857860088 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.857919931 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.857949972 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.857970953 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.858001947 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.858026028 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.858040094 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.858050108 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.858072996 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.858105898 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.858123064 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.858166933 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.858218908 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.858264923 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.859136105 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.859199047 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.859216928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.859258890 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.861840963 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.861895084 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.897922993 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.898156881 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.900335073 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.900410891 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.923829079 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.923916101 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.973886967 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.973948956 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.974307060 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.974376917 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.974416971 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.974466085 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.974541903 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.974587917 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.974647999 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.974668980 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.974893093 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.975027084 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.975076914 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.979216099 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.979285955 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.980463982 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.980525970 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.980568886 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.980580091 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.980628014 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.980632067 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.980680943 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.980681896 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.980721951 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.980747938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.980797052 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.980820894 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.980864048 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.980910063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:35.982865095 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:35.982927084 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.018930912 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.018990040 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.019083977 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.019134045 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.019819975 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.019897938 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.045494080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.045681953 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.092206955 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.092400074 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.093421936 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.093476057 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.093524933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.093571901 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.093630075 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.093676090 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.093682051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.093729019 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.093786001 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.093833923 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.093985081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.094037056 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.094100952 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.094147921 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.094196081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.094240904 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.094279051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.094322920 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.094327927 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.094367981 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.094830036 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.094875097 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.099174976 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.099235058 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.100547075 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.100627899 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.102461100 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.102530956 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.138853073 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.138964891 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.139022112 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.139061928 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.142540932 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.142595053 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.142719030 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.142807961 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.165993929 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.166114092 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.213556051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.213587046 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.213640928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.213697910 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.213821888 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.213846922 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.213895082 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.214170933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.214227915 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.214261055 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.214298964 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.214308023 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.214345932 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.214386940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.214433908 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.214683056 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.214731932 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.219227076 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.219285965 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.219295979 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.219343901 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.219347000 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.219397068 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.223720074 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.223789930 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.224020958 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.224072933 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.224577904 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.224625111 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.224630117 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.224678993 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.224715948 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.224766970 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.224786997 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.224838972 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.224891901 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.224927902 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.224944115 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.224980116 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.261132002 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.261241913 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.261388063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.262319088 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.262371063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.262773991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.262820959 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.287359953 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.287457943 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.328253984 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.328459024 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.333487988 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.333549976 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.333708048 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.333771944 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.333795071 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.333856106 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.333858967 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.333908081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.333911896 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.333965063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.334090948 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.334141016 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.334165096 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.334218979 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.334302902 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.334311962 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.334342957 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.334368944 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.334404945 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.334662914 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.334721088 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.341902971 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.341979980 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.342012882 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.342067957 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.349193096 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.349204063 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.349258900 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.353298903 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.353313923 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.353372097 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.353408098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.358011007 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.358071089 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.358319044 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.358374119 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.360189915 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.360244036 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.382381916 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.382391930 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.382487059 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.383419037 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.383569956 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.383723974 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.383785009 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.407588959 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.407728910 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.407751083 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.407789946 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.453172922 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.453255892 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.453342915 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.453383923 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.453397036 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.453442097 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.453531981 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.453573942 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.453583002 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.453624964 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.453625917 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.453679085 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.453990936 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.454044104 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.454051971 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.454106092 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.454231024 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.454287052 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.454287052 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.454341888 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.454399109 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.454448938 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.461675882 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.461756945 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.461762905 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.461812973 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.469072104 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.469136000 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.469196081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.469244003 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.473335028 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.473407030 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.473433971 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.473478079 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.478399038 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.478466034 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.478549004 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.478593111 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.480216980 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.480268002 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.502480984 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.502548933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.502676010 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.502686977 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.502847910 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.503098965 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.503154993 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.503679991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.503731012 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.527401924 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.527503967 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.568272114 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.568339109 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.573411942 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.573503017 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.573750973 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.573801994 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.573810101 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.573851109 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.574234009 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.574243069 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.574286938 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.581331015 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.581340075 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.581393957 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.588901043 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.588958979 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.592963934 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.593014002 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.593298912 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.593343019 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.598297119 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.598351002 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.598412037 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.598459959 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.599941015 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.599988937 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.623080015 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.623140097 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.623187065 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.623235941 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.623327971 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.623378992 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.623586893 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.623632908 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.623922110 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.623970985 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.647077084 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.647186041 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.688271999 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.688350916 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.693295002 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.693372965 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.693381071 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.693406105 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.693427086 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.693453074 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.693464041 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.693500042 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.693541050 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.693583012 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.693615913 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.693666935 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.693943977 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.693989038 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.701364040 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.701432943 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.701433897 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.701478958 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.708543062 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.708600044 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.708630085 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.708678961 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.712877989 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.712932110 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.718087912 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.718156099 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.718235016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.718282938 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.720390081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.720451117 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.743525982 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.743573904 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.743624926 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.743670940 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.743716002 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.743727922 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.743757963 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.743772030 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.743982077 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.744025946 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.744476080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.744525909 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.766757965 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.766823053 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.808368921 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.808536053 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.812978029 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.813000917 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.813066006 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.813234091 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.813306093 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.813332081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.813354015 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.813386917 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.813400984 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.813406944 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.813461065 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.814304113 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.814359903 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.821501017 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.821556091 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.821571112 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.821618080 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.828345060 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.828403950 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.828424931 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.828474045 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.832386971 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.832458973 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.832546949 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.832601070 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.837781906 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.837846994 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.837924004 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.837979078 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.839932919 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.839983940 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.863611937 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.863667965 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.863722086 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.863770962 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.863775969 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.863810062 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.863826036 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.863858938 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.863926888 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.863979101 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.864011049 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.864059925 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.864473104 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.864523888 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.886452913 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.886517048 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.932557106 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.932651997 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.932984114 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.933049917 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.933085918 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.933130980 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.933219910 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.933249950 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.933260918 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.933291912 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.933296919 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.933343887 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.933506012 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.933549881 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.933604956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.933638096 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.933651924 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.933680058 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.933689117 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.933734894 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.934005022 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.934055090 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.941226959 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.941283941 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.941507101 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.941555023 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.948127985 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.948178053 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.948401928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.948451996 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.952522039 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.952605009 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.957561016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.957622051 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.959733009 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.959789038 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.983191013 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.983334064 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.983525991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.983589888 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.983601093 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.983699083 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.983772993 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.983871937 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.983925104 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.983982086 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:36.984411955 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:36.984476089 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.006751060 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.006808043 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.053210020 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.053313017 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.053498030 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.053553104 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.053594112 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.053638935 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.053749084 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.053792000 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.053890944 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.053932905 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.054027081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.054071903 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.054147005 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.054177046 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.054186106 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.054231882 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.054258108 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.054295063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.061671972 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.061731100 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.061794996 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.061841965 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.068805933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.068869114 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.068929911 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.068977118 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.072990894 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.073044062 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.077294111 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.077358961 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.079401970 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.079457045 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.079459906 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.079502106 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.103766918 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.103846073 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.104527950 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.104584932 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.126352072 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.126419067 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.173942089 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.173995972 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.174046993 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.174078941 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.174087048 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.174120903 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.174416065 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.174473047 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.174496889 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.174556017 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.174623966 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.174669027 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.174675941 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.174734116 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.182909012 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.182972908 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.182986021 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.183037043 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.183037043 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.190099955 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.190166950 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.194226980 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.194278955 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.194279909 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.194324970 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.198139906 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.198191881 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.198208094 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.198266983 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.200084925 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.200143099 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.200160027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.200200081 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.222745895 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.222801924 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.222896099 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.222951889 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.223222017 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.223267078 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.223354101 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.223400116 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.223484039 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.223524094 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.223855019 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.223896980 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.246968985 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.247036934 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.288369894 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.288465023 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.295021057 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.295075893 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.295101881 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.295151949 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.295262098 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.295334101 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.295382023 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.295392036 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.295434952 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.295438051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.295470953 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.295480013 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.295509100 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.295619965 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.295658112 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.295686960 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.295723915 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.295737982 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.295778036 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.303175926 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.303229094 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.303256989 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.303271055 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.303298950 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.303318977 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.310188055 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.310231924 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.310324907 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.310368061 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.314193964 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.314248085 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.314532042 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.314582109 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.318033934 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.318084955 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.319875002 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.319922924 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.344316006 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.344475031 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.344477892 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.344532967 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.345212936 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.345273018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.345515013 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.345557928 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.345578909 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.345621109 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.345639944 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.345685005 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.345711946 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.345721960 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.345760107 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.367981911 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.368067026 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.415426016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.415617943 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.415851116 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.415930986 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.423727989 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.423784971 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.430732965 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.430795908 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.435101986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.435151100 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.438513041 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.438564062 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.440370083 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.440442085 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.464920044 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.465002060 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.466011047 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.466075897 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.488838911 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.488924980 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.534801006 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.534897089 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.535092115 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.535170078 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.535351038 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.535418987 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.543838978 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.543898106 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.563338041 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.563539028 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.603224039 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.603338957 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.607523918 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.607580900 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.608839035 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.608894110 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.655067921 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.655122042 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.655127048 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.655168056 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.655172110 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.655221939 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.655302048 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.655318975 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.655348063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.655364037 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.655388117 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.655425072 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.655591011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.655639887 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.655708075 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.655761003 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.655874968 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.655920029 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.655977964 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.656016111 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.656044960 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.656085968 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.663439989 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.663487911 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.663502932 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.663558960 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.669627905 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.669684887 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.669698000 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.669747114 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.673386097 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.673428059 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.673438072 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.673471928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.673502922 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.673512936 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.673520088 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.676918983 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.676974058 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.678939104 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.678987026 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.679073095 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.679121017 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.679124117 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.679169893 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.703907013 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.703960896 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.703990936 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.704031944 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.704082966 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.704127073 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.704164028 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.704209089 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.704463959 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.704514027 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.705008030 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.705049038 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.705133915 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.705178022 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.705241919 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.705290079 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.705302000 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.705332994 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.705383062 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.705425024 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.727360010 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.727426052 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.772313118 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.772377968 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.774703026 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.774775982 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.774910927 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.774981022 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.774981976 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.775028944 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.775144100 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.775177002 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.775192976 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.775222063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.775331974 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.775377035 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.775444031 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.775490046 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.775494099 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.775546074 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.775625944 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.775672913 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.775960922 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.776025057 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.783641100 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.783701897 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.783804893 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.783857107 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.789758921 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.789809942 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.789829016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.789882898 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.793529034 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.793586016 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.793760061 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.793818951 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.796758890 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.796812057 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.798634052 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.798688889 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.798801899 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.798855066 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.824192047 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.824259996 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.824350119 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.824395895 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.824470043 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.824517965 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.824791908 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.824845076 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.825170040 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.825222015 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.825241089 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.825273037 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.825292110 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.825320005 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.825380087 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.825429916 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.847090006 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.847155094 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.847385883 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.847438097 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.892429113 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.892600060 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.894553900 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.894617081 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.894792080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.894844055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.894896030 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.894951105 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.895067930 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.895102978 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.895122051 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.895160913 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.895241022 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.895291090 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.895499945 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.895560980 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.895584106 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.895642042 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.895642042 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.895670891 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.895690918 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.895716906 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.895720005 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.895761967 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.903214931 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.903283119 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.903367996 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.903422117 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.910027027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.910089970 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.910120964 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.910176039 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.913575888 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.913634062 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.913723946 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.913753033 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.913778067 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.913815022 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.917197943 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.917258978 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.918734074 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.918775082 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.918800116 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.918838978 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.918863058 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.918895006 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.918915987 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.918948889 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.943897009 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.943962097 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.944039106 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.944066048 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.944094896 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.944113970 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.944343090 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.944392920 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.944941044 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.944988012 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.945060015 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.945106030 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.945132971 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.945184946 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.945252895 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.945298910 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.966914892 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.967014074 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:37.967102051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:37.967154026 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.012484074 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.012577057 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.014637947 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.014678955 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.014695883 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.014736891 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.015016079 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.015049934 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.015085936 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.015111923 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.015162945 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.015198946 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.015224934 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.015243053 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.015300989 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.015362024 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.015423059 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.015474081 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.015535116 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.015575886 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.015594006 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.015625954 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.015678883 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.015727997 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.015733957 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.015755892 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.015779018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.015803099 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.022970915 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.023032904 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.023099899 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.023161888 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.029661894 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.029731989 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.033261061 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.033322096 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.033406019 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.033469915 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.036640882 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.036700010 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.038543940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.038599968 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.038631916 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.038676023 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.038693905 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.038764000 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.063852072 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.063987017 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.064028025 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.064047098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.064285994 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.064349890 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.064821005 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.064855099 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.064881086 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.064898968 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.064920902 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.064944983 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.064985991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.065013885 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.065042019 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.065067053 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.086678028 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.086751938 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.133125067 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.133317947 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.135037899 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.135096073 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.135134935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.135188103 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.135346889 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.135407925 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.135476112 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.135533094 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.135627031 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.135675907 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.135787964 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.135819912 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.135843039 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.135869026 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.135936022 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.135979891 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.135987997 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.136028051 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.136032104 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.136084080 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.136111021 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.136162043 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.136173964 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.136223078 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.136282921 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.136334896 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.136387110 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.136419058 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.136432886 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.136471987 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.136499882 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.136557102 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.143594027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.143667936 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.143673897 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.143728971 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.150026083 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.150085926 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.150096893 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.150142908 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.150152922 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.150202990 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.153059959 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.153131008 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.153261900 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.153317928 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.153343916 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.153393030 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.156438112 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.156507015 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.158068895 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.158138990 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.158185005 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.158246994 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.158386946 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.158413887 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.158438921 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.158473015 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.184020042 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.184056044 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.184096098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.184107065 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.184269905 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.184443951 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.184498072 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.185009956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.185070992 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.185070992 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.185127020 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.185132027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.185182095 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.185190916 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.185237885 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.185261011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.185292006 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.185314894 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.185343027 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.206396103 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.206553936 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.248296022 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.248397112 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.252717018 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.252789974 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.254895926 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.254930019 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.254957914 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.254975080 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.255033016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.255086899 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.255086899 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.255136967 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.255167007 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.255192995 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.255229950 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.255256891 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.255280972 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.255341053 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.255347967 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.255397081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.255402088 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.255454063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.255506992 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.255557060 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.255604029 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.255652905 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.255697966 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.255749941 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.255860090 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.255912066 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.256067991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.256125927 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.256177902 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.256236076 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.263377905 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.263456106 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.263546944 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.263709068 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.270087957 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.270140886 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.270148039 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.270211935 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.270277023 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.270334959 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.273197889 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.273252010 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.273281097 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.273329973 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.273339033 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.273387909 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.276371956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.276426077 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.276572943 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.276617050 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.278170109 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.278223991 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.278297901 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.278352976 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.278402090 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.278450966 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.303859949 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.303945065 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.304006100 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.304079056 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.304267883 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.304325104 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.304371119 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.304416895 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.305063009 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.305114031 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.305156946 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.305185080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.305208921 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.305217028 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.305237055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.305269003 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.305291891 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.305341959 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.326426983 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.326524019 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.368422985 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.368503094 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.373022079 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.373090982 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.375065088 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.375130892 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.375181913 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.375245094 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.375351906 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.375397921 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.375402927 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.375451088 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.375555992 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.375608921 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.375610113 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.375663042 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.375735044 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.375765085 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.375787020 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.375809908 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.375840902 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.375886917 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.375890017 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.375936985 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.375977993 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.376023054 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.376055956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.376108885 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.376235962 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.376266956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.376288891 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.376310110 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.376327991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.376354933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.376382113 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.376391888 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.376411915 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.376440048 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.376454115 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.376507998 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.383018970 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.383074999 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.383142948 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.383208990 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.389774084 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.389844894 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.389844894 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.389873981 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.389897108 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.389925957 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.393079042 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.393137932 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.393140078 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.393172979 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.393191099 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.393223047 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.393224001 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.393270969 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.396146059 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.396198988 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.397713900 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.397769928 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.397872925 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.397922993 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.397924900 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.397972107 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.424756050 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.424772978 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.424808025 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.424820900 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.424823046 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.424861908 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.424869061 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.424905062 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.425096035 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.425151110 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.425923109 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.425975084 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.426002979 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.426048994 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.426074028 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.426117897 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.426147938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.426196098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.426229954 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.426239014 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.426284075 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.446432114 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.446492910 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.492630005 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.492669106 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.492784977 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.494754076 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.494779110 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.494896889 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.494924068 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.494949102 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.494997025 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.495042086 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.495141983 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.495186090 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.495501041 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.495527029 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.495549917 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.495573044 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.495640039 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.495687008 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.495817900 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.495863914 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.495924950 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.495979071 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.496059895 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.496105909 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.496145964 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.496191978 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.496259928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.496303082 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.496337891 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.496360064 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.496438980 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.496488094 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.496511936 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.496556997 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.496639967 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.496689081 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.496694088 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.496737957 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.502830029 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.502914906 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.509357929 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.509422064 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.509459019 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.509501934 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.509517908 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.512746096 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.512856960 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.512897015 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.512927055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.512943983 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.515820026 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.517446041 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.517528057 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.517584085 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.517671108 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.517724991 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.517744064 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.518769026 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.544724941 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.544795036 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.544863939 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.544882059 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.544990063 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.545140028 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.545157909 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.545197010 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.545229912 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.545278072 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.546192884 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.546231985 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.546277046 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.546282053 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.546354055 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.546400070 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.546405077 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.546772003 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.566370010 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.566883087 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.608263969 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.610796928 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.613312006 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.613475084 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.615175009 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.615245104 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.615303040 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.615339994 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.615358114 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.615361929 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.615406990 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.615447998 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.615535021 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.615576982 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.615586042 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.615619898 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.615632057 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.615668058 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.615788937 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.615871906 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.615922928 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.615978956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.615988016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.616034985 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.616178036 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.616287947 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.616342068 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.616405010 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.616486073 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.616523027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.616539001 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.616576910 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.623023033 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.623132944 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.623150110 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.623183966 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.629160881 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.629225969 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.629300117 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.629349947 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.629396915 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.629406929 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.629460096 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.632347107 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.632491112 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.632591009 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.632647991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.632695913 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.635413885 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.635472059 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.637001038 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.637017965 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.637093067 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.637101889 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.637126923 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.637188911 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.637209892 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.637259960 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.638525963 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.638577938 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.664911032 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.664988041 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.665074110 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.665107012 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.665121078 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.665195942 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.665216923 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.665266991 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.665399075 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.665445089 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.665467024 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.665493011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.665518045 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.665545940 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.666238070 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.666286945 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.666413069 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.666474104 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.666533947 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.666574001 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.666624069 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.666728020 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.666771889 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.686767101 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.686856985 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.729080915 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.729135990 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.732876062 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.732943058 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.732948065 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.733001947 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.734786987 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.734834909 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.734884024 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.734929085 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.735009909 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.735054970 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.735187054 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.735215902 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.735232115 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.735260963 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.735308886 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.735354900 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.735378027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.735407114 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.735433102 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.735450983 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.735465050 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.735479116 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.735491991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.735506058 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.735517979 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.735533953 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.735549927 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.735558987 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.735600948 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.735613108 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.735701084 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.735707045 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.735749006 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.735768080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.735815048 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.735904932 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.735950947 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.735965967 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.736012936 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.736040115 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.736071110 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.736123085 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.742752075 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.742889881 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.742950916 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.749151945 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.749198914 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.749253988 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.749303102 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.752692938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.752893925 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.752944946 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.752976894 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.753012896 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.753031015 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.753061056 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.755835056 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.755887985 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.757358074 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.757412910 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.757441998 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.757500887 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.757797956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.757831097 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.757846117 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.757864952 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.759185076 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.759234905 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.785821915 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.785890102 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.786031008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.786083937 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.786097050 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.786142111 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.786195040 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.786242962 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.786251068 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.786300898 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.787134886 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 4, 2024 17:09:38.787180901 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 4, 2024 17:09:38.787208080 CET	15666	49730	45.130.145.152	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 4, 2024 17:09:23.809360027 CET	192.168.2.4	1.1.1.1	0xda19	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 4, 2024 17:09:23.951849937 CET	1.1.1.1	192.168.2.4	0xda19	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Dec 4, 2024 17:09:23.951849937 CET	1.1.1.1	192.168.2.4	0xda19	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Dec 4, 2024 17:09:23.951849937 CET	1.1.1.1	192.168.2.4	0xda19	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	104.26.13.205	443	4960	C:\Users\user\Desktop\venomderek.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-04 16:09:25 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2024-12-04 16:09:25 UTC	424	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 16:09:25 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8ecd0f8f78ba41ba-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1793&min_rtt=1675&rtt_var=865&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2820&recv_bytes=738&delivery_rate=1113653&cwnd=192&unsent_bytes=0&cid=3b0b1bdd7e4a2cbb&ts=653&x=0"
2024-12-04 16:09:25 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38 Data Ascii: 8.46.123.228

Target ID:	0
Start time:	11:09:22
Start date:	04/12/2024
Path:	C:\Users\user\Desktop\venomderek.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\venomderek.exe"
Imagebase:	0x7ff626be0000
File size:	3'341'824 bytes
MD5 hash:	8C1A3371880670AE29EB22EEC13DF95E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000000.00000002.1929160781.000002733BC90000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	90.8%
Signature Coverage:	22.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	128

Executed Functions

Function 000002733BE5FB30 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 225
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 000002733BE5FB71
GetSystemMetrics.USER32 ref: 000002733BE5FB7F
GetSystemMetrics.USER32 ref: 000002733BE5FB8D
GetSystemMetrics.USER32 ref: 000002733BE5FB9B
GetDC.USER32 ref: 000002733BE5FBA5
GetDeviceCaps.GDI32 ref: 000002733BE5FBBB
GetDeviceCaps.GDI32 ref: 000002733BE5FBCB
CreateCompatibleDC.GDI32 ref: 000002733BE5FBD8
CreateCompatibleBitmap.GDI32 ref: 000002733BE5FBF0
SelectObject.GDI32 ref: 000002733BE5FC06
BitBlt.GDI32 ref: 000002733BE5FC3C
SHCreateMemStream.SHLWAPI ref: 000002733BE5FC72
SelectObject.GDI32 ref: 000002733BE5FC88
DeleteDC.GDI32 ref: 000002733BE5FC91
ReleaseDC.USER32 ref: 000002733BE5FC9C
DeleteObject.GDI32 ref: 000002733BE5FCA5
EnterCriticalSection.KERNEL32 ref: 000002733BE5FD9C
LeaveCriticalSection.KERNEL32 ref: 000002733BE5FDAE
IStream_Size.SHLWAPI ref: 000002733BE5FDE5
IStream_Reset.SHLWAPI ref: 000002733BE5FDF6
IStream_Read.SHLWAPI ref: 000002733BE5FE7B
SelectObject.GDI32 ref: 000002733BE5FED5
DeleteDC.GDI32 ref: 000002733BE5FEDE
ReleaseDC.USER32 ref: 000002733BE5FEEB
DeleteObject.GDI32 ref: 000002733BE5FEF4

Strings

, xrefs: 000002733BE5FC11

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Object$DeleteMetricsSystem$CreateSelectStream_$CapsCompatibleCriticalDeviceReleaseSection$BitmapEnterLeaveReadResetSizeStream
String ID:
API String ID: 3214587331-3916222277
Opcode ID: e8e9b911cd9b9f557c011d0a693391b94df579aa06795856880fde4b09ecdcd5
Instruction ID: e8dfaef397f0c5545f025d72632950568a32b5e5782e0ff40d9389c9dc106de8
Opcode Fuzzy Hash: e8e9b911cd9b9f557c011d0a693391b94df579aa06795856880fde4b09ecdcd5
Instruction Fuzzy Hash: B7B11E7261DBC086E670EB25F8583DAB7A5F789B80F404655DA8E43B69DF38C184DB80

Function 000002733BE998C0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32 ref: 000002733BE9996D
GetLastError.KERNEL32 ref: 000002733BE99977
FindFirstFileW.KERNEL32 ref: 000002733BE9998E
GetLastError.KERNEL32 ref: 000002733BE9999A
FindClose.KERNEL32 ref: 000002733BE999A8
__std_fs_open_handle.LIBCPMT ref: 000002733BE99A3B
CloseHandle.KERNEL32 ref: 000002733BE99A51
CloseHandle.KERNEL32 ref: 000002733BE99BC4

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: 9b9cafa6476ba7d57e6375b49b2d31870033937920a690a77e8b0d8031f3f21f
Instruction ID: a8de14c7586719cecb2f14717bac6268d9111356aa38cf3a8c026aa185ff09ea
Opcode Fuzzy Hash: 9b9cafa6476ba7d57e6375b49b2d31870033937920a690a77e8b0d8031f3f21f
Instruction Fuzzy Hash: 0E91A53530DA0186E674EB2DB8487DA3791EB857B4F1447909AFE476D4EB3CCA09A780

Function 000002733BE61660 Relevance: 26.6, APIs: 4, Strings: 10, Instructions: 2133timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 000002733BE61990

Strings

gpu, xrefs: 000002733BE62522
system, xrefs: 000002733BE623E4, 000002733BE624D3, 000002733BE625C9, 000002733BE626C3, 000002733BE6280B, 000002733BE62905, 000002733BE629F8, 000002733BE62B7F, 000002733BE62D70, 000002733BE62FF1, 000002733BE631B4, 000002733BE633CE, 000002733BE6356D, 000002733BE63717, 000002733BE637DD
timezone, xrefs: 000002733BE63414
%d-%m-%Y, %H:%M:%S, xrefs: 000002733BE62F5F
computer_name, xrefs: 000002733BE62954
user_name, xrefs: 000002733BE6242F
time, xrefs: 000002733BE63041
cpu, xrefs: 000002733BE62618
ram, xrefs: 000002733BE6285B
[UTC, xrefs: 000002733BE61963

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: %d-%m-%Y, %H:%M:%S$[UTC$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 565725191-1610854563
Opcode ID: 642a681db4093793f1ccd725a39e58c07c82e1680a0ac04f48c002ccdd36d47c
Instruction ID: 79e0eaecbbe070dd96f6e25e2ca2444f222c9359ec884eaf88d426cabcdb54b2
Opcode Fuzzy Hash: 642a681db4093793f1ccd725a39e58c07c82e1680a0ac04f48c002ccdd36d47c
Instruction Fuzzy Hash: 4A239D33A18BC485EB21DB29E8443DD77A1F789798F405315EA9D47BA9EB78C380D780

Function 000002733BE61FF0 Relevance: 22.5, APIs: 3, Strings: 9, Instructions: 1516COMMON

Download Yara Rule

APIs

Part of subcall function 000002733BE60C30: GetCurrentHwProfileW.ADVAPI32 ref: 000002733BE60C6C

Part of subcall function 000002733BE60500: EnumDisplayDevicesW.USER32 ref: 000002733BE60617
Part of subcall function 000002733BE60500: EnumDisplayDevicesW.USER32 ref: 000002733BE606BB

Part of subcall function 000002733BE60420: RegGetValueA.ADVAPI32 ref: 000002733BE60489

Part of subcall function 000002733BE60110: GetUserNameW.ADVAPI32 ref: 000002733BE60155

Part of subcall function 000002733BE601B0: GetComputerNameW.KERNEL32 ref: 000002733BE601F5

GlobalMemoryStatusEx.KERNEL32 ref: 000002733BE6277C
wcsftime.LIBCMT ref: 000002733BE62F72
GetModuleFileNameA.KERNEL32 ref: 000002733BE63106

Strings

gpu, xrefs: 000002733BE62522
system, xrefs: 000002733BE623E4, 000002733BE624D3, 000002733BE625C9, 000002733BE626C3, 000002733BE6280B, 000002733BE62905, 000002733BE629F8, 000002733BE62B7F, 000002733BE62D70, 000002733BE62FF1, 000002733BE631B4, 000002733BE633CE, 000002733BE6356D, 000002733BE63717, 000002733BE637DD
timezone, xrefs: 000002733BE63414
%d-%m-%Y, %H:%M:%S, xrefs: 000002733BE62F5F
computer_name, xrefs: 000002733BE62954
user_name, xrefs: 000002733BE6242F
time, xrefs: 000002733BE63041
cpu, xrefs: 000002733BE62618
ram, xrefs: 000002733BE6285B

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Name$DevicesDisplayEnum$ComputerCurrentFileGlobalMemoryModuleProfileStatusUserValuewcsftime
String ID: %d-%m-%Y, %H:%M:%S$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 2509368203-1182675529
Opcode ID: 651cfcef4566506e5ace81f37ff1620ea6e6137fc1fc0d78e1bfedf283b572e2
Instruction ID: 318b94b50140a88739546b759caf97e38145e2a9d10e7df79801809e596ac22a
Opcode Fuzzy Hash: 651cfcef4566506e5ace81f37ff1620ea6e6137fc1fc0d78e1bfedf283b572e2
Instruction Fuzzy Hash: EFF27C32618BC485DB21DF29E8943DD77A1F789798F409316EA9D07BA9EB78C380D740

Function 000002733BE1B820 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 862
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000002733BE1B90C
GetProcAddress.KERNEL32 ref: 000002733BE1BA17
GetProcAddress.KERNEL32 ref: 000002733BE1BAD9
GetProcAddress.KERNEL32 ref: 000002733BE1BB53
GetProcAddress.KERNEL32 ref: 000002733BE1BBD5
GetProcAddress.KERNEL32 ref: 000002733BE1BC4F
GetProcAddress.KERNEL32 ref: 000002733BE1BCD3
FreeLibrary.KERNEL32 ref: 000002733BE1C801

Strings

vault, xrefs: 000002733BE1C663
system, xrefs: 000002733BE1C60D
cannot use push_back() with , xrefs: 000002733BE1C84F

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: cannot use push_back() with $system$vault
API String ID: 2449869053-1741236777
Opcode ID: 8877454632e1459ab6d46cc5bdd39f33383bd42217b921f3bd281377c5b98e97
Instruction ID: 5fe8da0deb67d0eef4f30b0558983af3dcaf9333557ed849bca87cae183ab3d7
Opcode Fuzzy Hash: 8877454632e1459ab6d46cc5bdd39f33383bd42217b921f3bd281377c5b98e97
Instruction Fuzzy Hash: 42923832609BC489DB70DF29E8853DD73A4F789798F204216EA9C5BB99EF74C684D340

Function 000002733BE56480 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002733BE59760: GetCurrentProcess.KERNEL32 ref: 000002733BE5979B
Part of subcall function 000002733BE59760: OpenProcessToken.ADVAPI32 ref: 000002733BE597AE
Part of subcall function 000002733BE59760: GetTokenInformation.ADVAPI32 ref: 000002733BE597EA

ExitProcess.KERNEL32 ref: 000002733BE564C7
OpenMutexA.KERNEL32 ref: 000002733BE565E2
ExitProcess.KERNEL32 ref: 000002733BE565F2
CreateMutexA.KERNEL32 ref: 000002733BE56611
ExitProcess.KERNEL32 ref: 000002733BE56637

Part of subcall function 000002733BE59AA0: GetModuleFileNameW.KERNEL32 ref: 000002733BE59AEA

Part of subcall function 000002733BE64740: CoInitializeEx.OLE32 ref: 000002733BE647AA

Strings

SeImpersonatePrivilege, xrefs: 000002733BE564DA
SeDebugPrivilege, xrefs: 000002733BE564CE

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Process$Exit$MutexOpenToken$CreateCurrentFileInformationInitializeModuleName
String ID: SeDebugPrivilege$SeImpersonatePrivilege
API String ID: 470559343-3768118664
Opcode ID: 934d3a2081db48a5f146861ee3081173b62aac492e54dfc993cfb13fb8228311
Instruction ID: 68bd15c65a15b92e3d066de7cb41401afecd581d5080d81dbd9627e6f041ec0b
Opcode Fuzzy Hash: 934d3a2081db48a5f146861ee3081173b62aac492e54dfc993cfb13fb8228311
Instruction Fuzzy Hash: A861936160CA8046FA30FB6CF45D3DEA394EB85790F505796E69D426DBDF28C284E7C0

Function 000002733BE8114C Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 000002733BE81191

Part of subcall function 000002733BE807F8: _invalid_parameter_noinfo.LIBCMT ref: 000002733BE8080C

Part of subcall function 000002733BE7B550: HeapFree.KERNEL32 ref: 000002733BE7B566
Part of subcall function 000002733BE7B550: GetLastError.KERNEL32 ref: 000002733BE7B570

Part of subcall function 000002733BE89D94: _invalid_parameter_noinfo.LIBCMT ref: 000002733BE89CDF

_get_daylight.LIBCMT ref: 000002733BE81180

Part of subcall function 000002733BE80858: _invalid_parameter_noinfo.LIBCMT ref: 000002733BE8086C

_get_daylight.LIBCMT ref: 000002733BE813F6
_get_daylight.LIBCMT ref: 000002733BE81407
_get_daylight.LIBCMT ref: 000002733BE81418
GetTimeZoneInformation.KERNEL32 ref: 000002733BE8143F

Strings

Eastern Summer Time, xrefs: 000002733BE814FD
Eastern Standard Time, xrefs: 000002733BE814E5

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 355007559-239921721
Opcode ID: 7c59d7ccbe5d7300b5b7a10bdfa8df02b94e7a90d3a9da5a0b2f52bbfcd600ed
Instruction ID: efda3fcbb40510c6a69e7d331359af0a62b386bf4b5af141a669d2e702a724f5
Opcode Fuzzy Hash: 7c59d7ccbe5d7300b5b7a10bdfa8df02b94e7a90d3a9da5a0b2f52bbfcd600ed
Instruction Fuzzy Hash: 01D1F62A708A4086E730FF29F8593E977A1F748F85F444265EE4D87A96DB38C641E7C0

Function 000002733BE5F200 Relevance: 13.9, APIs: 9, Instructions: 408
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 000002733BE5F3CB
InternetOpenUrlA.WININET ref: 000002733BE5F4A8
HttpQueryInfoW.WININET ref: 000002733BE5F509
HttpQueryInfoW.WININET ref: 000002733BE5F5A2
InternetQueryDataAvailable.WININET ref: 000002733BE5F5E6
InternetReadFile.WININET ref: 000002733BE5F6A9
InternetQueryDataAvailable.WININET ref: 000002733BE5F774
InternetCloseHandle.WININET ref: 000002733BE5F81E
Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE5F87B

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Internet$Query$AvailableDataHttpInfoOpen$CloseConcurrency::cancel_current_taskFileHandleRead
String ID:
API String ID: 1475545111-0
Opcode ID: bb750a931f0c3528aa084ba8e17e664c1c9461fed7d521bc4a8be10c0a63c358
Instruction ID: 4a781b72f07aa6d27c91c5fefaeaacca6efe6b997bb269ae0652dc90a3c9f1e0
Opcode Fuzzy Hash: bb750a931f0c3528aa084ba8e17e664c1c9461fed7d521bc4a8be10c0a63c358
Instruction Fuzzy Hash: 99028032A18B9485EB10DB69F84439E77B5F795798F204316EE9C57BA8DF38C180D780

Function 000002733BE9E968 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002733BE9E54C: _invalid_parameter_noinfo.LIBCMT ref: 000002733BE9E58D
Part of subcall function 000002733BE9E54C: _invalid_parameter_noinfo.LIBCMT ref: 000002733BE9E60B
Part of subcall function 000002733BE9E54C: _invalid_parameter_noinfo.LIBCMT ref: 000002733BE9E65C

CreateFileW.KERNEL32 ref: 000002733BE9EA6E
CreateFileW.KERNEL32 ref: 000002733BE9EABE
GetLastError.KERNEL32 ref: 000002733BE9EAEE
GetFileType.KERNEL32 ref: 000002733BE9EB03
GetLastError.KERNEL32 ref: 000002733BE9EB0D
CloseHandle.KERNEL32 ref: 000002733BE9EB40
CloseHandle.KERNEL32 ref: 000002733BE9ECA3
CreateFileW.KERNEL32 ref: 000002733BE9ECD8
GetLastError.KERNEL32 ref: 000002733BE9ECE7

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 484b9744f6cc28d441a3ba22cd2a9bb849a09fc1e06d845b9773f87c4c6ec638
Instruction ID: 73e1f011e778f2eb676fff9ed25528f61914f0c9ea17ee2bd07114f4bebd1a23
Opcode Fuzzy Hash: 484b9744f6cc28d441a3ba22cd2a9bb849a09fc1e06d845b9773f87c4c6ec638
Instruction Fuzzy Hash: 28C1DF32728A4486EB20EFA8E4957EC3761F389B98F015345DB6E97394CB38C659D380

Function 000002733BE58F60 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 451
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32 ref: 000002733BE591A1
SetFilePointer.KERNEL32 ref: 000002733BE59254
ReadFile.KERNEL32 ref: 000002733BE59283

Strings

ios_base::badbit set, xrefs: 000002733BE596B1, 000002733BE5972F
ios_base::eofbit set, xrefs: 000002733BE596C4
ios_base::failbit set, xrefs: 000002733BE596BD
exists, xrefs: 000002733BE5970A

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: File$PointerReadSize
String ID: exists$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 404940565-15404121
Opcode ID: 57c087d1bcc7dd28c00b8731d35cf4ee4eae3dcd7d8679c2c37a17ed44cae6af
Instruction ID: 0b8e3050db49ffb3d2817fd5c1289e80e6dc210d7ab9ff12ef526c1f39e103b3
Opcode Fuzzy Hash: 57c087d1bcc7dd28c00b8731d35cf4ee4eae3dcd7d8679c2c37a17ed44cae6af
Instruction Fuzzy Hash: 08323636618BC489EB20DF38E8843DD37A1F785B88F548356DA8D4BB99EB74C644D780

Function 000002733BE813C8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 000002733BE813F6

Part of subcall function 000002733BE80858: _invalid_parameter_noinfo.LIBCMT ref: 000002733BE8086C

_get_daylight.LIBCMT ref: 000002733BE81407

Part of subcall function 000002733BE807F8: _invalid_parameter_noinfo.LIBCMT ref: 000002733BE8080C

_get_daylight.LIBCMT ref: 000002733BE81418

Part of subcall function 000002733BE80828: _invalid_parameter_noinfo.LIBCMT ref: 000002733BE8083C

Part of subcall function 000002733BE7B550: HeapFree.KERNEL32 ref: 000002733BE7B566
Part of subcall function 000002733BE7B550: GetLastError.KERNEL32 ref: 000002733BE7B570

GetTimeZoneInformation.KERNEL32 ref: 000002733BE8143F

Strings

Eastern Summer Time, xrefs: 000002733BE814FD
Eastern Standard Time, xrefs: 000002733BE814E5

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 94df1ec9e2384a72c79be9da220bb4aa566035efaa8ab6aaac74d351b0b15fee
Instruction ID: 52b211416bf5efc0b73846b232514bc514d700a17ecc149eeb21cf032dd334c6
Opcode Fuzzy Hash: 94df1ec9e2384a72c79be9da220bb4aa566035efaa8ab6aaac74d351b0b15fee
Instruction Fuzzy Hash: 1651D336708A4096E730FF29F8987D97760F748B85F445766EA4D83B96DB38C640A7C0

Function 000002733BE7749C Relevance: 9.2, APIs: 6, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002733BE774BE
_get_daylight.LIBCMT ref: 000002733BE7751E
_get_daylight.LIBCMT ref: 000002733BE7752F
_get_daylight.LIBCMT ref: 000002733BE77540
_isindst.LIBCMT ref: 000002733BE77591
_isindst.LIBCMT ref: 000002733BE775E4

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: _get_daylight$_isindst$_invalid_parameter_noinfo
String ID:
API String ID: 1405656091-0
Opcode ID: 842d06e59cb7d0c874962108e89d6781c57040cb1ba9c53ec58eb2fa30030a5a
Instruction ID: 340d8d75c3aa0bfd796585f7db9018ff2c4df5edf9ae4ee77ef327e4c544b5bf
Opcode Fuzzy Hash: 842d06e59cb7d0c874962108e89d6781c57040cb1ba9c53ec58eb2fa30030a5a
Instruction Fuzzy Hash: 9F81FDB27047454BDB68DF3CD9063EC37A5E754789F049225EA0D8B789EB38D641D780

Function 000002733BE68B70 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 000002733BE68D24
__std_exception_destroy.LIBVCRUNTIME ref: 000002733BE68D32
__std_exception_destroy.LIBVCRUNTIME ref: 000002733BE68FB5
__std_exception_destroy.LIBVCRUNTIME ref: 000002733BE68FC3

Strings

value, xrefs: 000002733BE68C4A, 000002733BE68EE3

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: 7db0fb4280830bd968022b08d4860836b32ff7c776b1dea3ea839d99690749e7
Instruction ID: 6def9a082d0a1a19ab73f7a39e6f1b8bb40412570e6751f163aabe0d7a26a668
Opcode Fuzzy Hash: 7db0fb4280830bd968022b08d4860836b32ff7c776b1dea3ea839d99690749e7
Instruction Fuzzy Hash: 6202B723A18BC085EB20EB78E4883DD6761E7857A4F505342FA9D47BDADF78C685D380

Function 000002733BE1C8C0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 328processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000002733BE1C90A
Process32FirstW.KERNEL32 ref: 000002733BE1C94C
Process32NextW.KERNEL32 ref: 000002733BE1CB43
CloseHandle.KERNEL32 ref: 000002733BE1CDBA

Strings

[PID: , xrefs: 000002733BE1C98E

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 420147892-2210602247
Opcode ID: fa9b7cce1dff8c802d6dd4d3c9cf34b89bf5d1bdb666e1801b15b029693efdfa
Instruction ID: d221de706d7d6391f7f2ee04d63eca5ccebc85cf9fcfe4db42433ce4c362fc06
Opcode Fuzzy Hash: fa9b7cce1dff8c802d6dd4d3c9cf34b89bf5d1bdb666e1801b15b029693efdfa
Instruction Fuzzy Hash: C5E19072618BC085EB30EB29E8843DD77A5F7897A4F504315EA9D4BB99DF38C284D780

Function 000002733BE65970 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000002733BE659BE
OpenProcessToken.ADVAPI32 ref: 000002733BE659D1
LookupPrivilegeValueW.ADVAPI32 ref: 000002733BE659F2
AdjustTokenPrivileges.ADVAPI32 ref: 000002733BE65A38
CloseHandle.KERNEL32 ref: 000002733BE65A58

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3038321057-0
Opcode ID: 29a02e95aae9899e0029659e102052f54fff5397b51cb33b914b83ea41570e5f
Instruction ID: 7d69b0b96070249fe0c3c79d4fde7112af455e20817e79d96fdba538e456912c
Opcode Fuzzy Hash: 29a02e95aae9899e0029659e102052f54fff5397b51cb33b914b83ea41570e5f
Instruction Fuzzy Hash: AA21A23221CB8086E720DF55F44839BB7A0FB88B80F558226EA8D47B58DF7CC644DB80

Function 000002733BE41340 Relevance: 6.8, Strings: 5, Instructions: 599COMMON

Download Yara Rule

Strings

directory_iterator::directory_iterator, xrefs: 000002733BE420E3, 000002733BE43764
exists, xrefs: 000002733BE4374D
cannot use push_back() with , xrefs: 000002733BE42095
status, xrefs: 000002733BE420D1, 000002733BE420F3, 000002733BE4211B, 000002733BE42143
prefs.js, xrefs: 000002733BE428A2

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID: cannot use push_back() with $directory_iterator::directory_iterator$exists$prefs.js$status
API String ID: 0-2713369562
Opcode ID: 71dba8fe4d069a4c72edf69e3e28f617b4c9908de53c25944bf430d96a657617
Instruction ID: 048e5c87a14a3a2b3732f5c994777737da07ebcf92988fe9a86bc185d000032e
Opcode Fuzzy Hash: 71dba8fe4d069a4c72edf69e3e28f617b4c9908de53c25944bf430d96a657617
Instruction Fuzzy Hash: D6521632609FC484E6B1EB19F8853DAB3A4F7C9784F505265DACC42B59EF78C294DB80

Function 000002733BE1ACC0 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 671COMMON

Download Yara Rule

APIs

CredEnumerateA.ADVAPI32 ref: 000002733BE1AD22
CredFree.ADVAPI32 ref: 000002733BE1B746

Strings

cannot use push_back() with , xrefs: 000002733BE1B794

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Cred$EnumerateFree
String ID: cannot use push_back() with
API String ID: 3403564193-4122110429
Opcode ID: 12ca8fc5de2e866e5bab1b12bd58c09a8c2b6936a8841043e04f785ce2c2cce2
Instruction ID: c1a96987c54fa499983aa5d2e5ba790190946cfd6f90179a27f79da190fba33f
Opcode Fuzzy Hash: 12ca8fc5de2e866e5bab1b12bd58c09a8c2b6936a8841043e04f785ce2c2cce2
Instruction Fuzzy Hash: 69627D32608BC489EB30DF29E8843DD77A1F789798F505355EAAD17B99DB38C284D780

Function 000002733BE6C55A Relevance: 5.6, Strings: 4, Instructions: 566COMMON

Download Yara Rule

Strings

object separator, xrefs: 000002733BE6CAB3, 000002733BE6CDEE
object, xrefs: 000002733BE6CD39
array, xrefs: 000002733BE6CC84
object key, xrefs: 000002733BE6CB5C, 000002733BE6CEA3

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID: array$object$object key$object separator
API String ID: 0-2277530871
Opcode ID: 72950a1bde4fdda7b4d36e74d2cebb25999317ca60ff6dc3ef4ca15f3533fbf5
Instruction ID: 8fe5c05f9f64ab5318cb3aabdf1c6ce778bd2b40d731fecd94bc2d9c133aad1e
Opcode Fuzzy Hash: 72950a1bde4fdda7b4d36e74d2cebb25999317ca60ff6dc3ef4ca15f3533fbf5
Instruction Fuzzy Hash: 4E420362618B8496EB20FF78E4493ED2361F796784F906742EA4D47A9ADF74C384D3C0

Function 00007FF626BE34C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 00007FF626BE3527
NtProtectVirtualMemory.NTDLL ref: 00007FF626BE3591

Strings

0, xrefs: 00007FF626BE3507

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID: MemoryVirtual$ProtectQuery
String ID: 0
API String ID: 1355999870-4108050209
Opcode ID: 89413ede3b1e85be20c8f272e65a27b8bfe40e2a2e38e4141ba162e5d23f76ce
Instruction ID: f46d81ac9bdf45efb62c641f9c58757a733a6bf7d002356f841284415339b0b8
Opcode Fuzzy Hash: 89413ede3b1e85be20c8f272e65a27b8bfe40e2a2e38e4141ba162e5d23f76ce
Instruction Fuzzy Hash: 77213E36618B8586EB50CB15F85435A73A1FB887A4F900335EBAD83BA8DF7ED144CB01

Function 000002733BE51EA0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 000002733BE51EF8
LocalFree.KERNEL32 ref: 000002733BE51F8A

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 534917215b691bdf8008ca3940d01222a19eb5e5d5bf9c8332b99172fc4e0cb2
Instruction ID: e230637aa263830adc85211f8f280deedf65f9df84e25a5b6fe30554710f6961
Opcode Fuzzy Hash: 534917215b691bdf8008ca3940d01222a19eb5e5d5bf9c8332b99172fc4e0cb2
Instruction Fuzzy Hash: 17414932718B80CAE320DF74E8443DD37A4F75978CF444269AB8C06E8ADB79C6A4D394

Function 000002733BE613B0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32 ref: 000002733BE61421

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: 05563d9c9f8d9765ab942f76f343afa8ceddb3167ad04ffcdfa04968ca2d4d44
Instruction ID: a5e2b4c525e5cebcec032d4e2a13bfb8c47cd9988c117cedc74fb75b3854867a
Opcode Fuzzy Hash: 05563d9c9f8d9765ab942f76f343afa8ceddb3167ad04ffcdfa04968ca2d4d44
Instruction Fuzzy Hash: 84417E33A18B8082E720DF25F88439EB774F794784F145255EA8C23A69DB78D6D1EB80

Function 000002733BE60110 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 000002733BE60155

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 5706546f313706de72a237bf98d2ae5729b4666c4094d2ca0903643dc08702f3
Instruction ID: d5668f3add3d6cff931e6158ae653847d4d7048daa72f377647ee0826cbf31ac
Opcode Fuzzy Hash: 5706546f313706de72a237bf98d2ae5729b4666c4094d2ca0903643dc08702f3
Instruction Fuzzy Hash: FF01963261C78082E770DF25F8553DAB3A4FB98788F444256EACD42659DFBCC294DB80

Function 000002733BE60820 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

cores, xrefs: 000002733BE60A7E

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID: cores
API String ID: 0-2370456839
Opcode ID: 5b8c3754b5ba17353c18ca675a3acc20a40739b5da0fab98165202c1fc5fcc7d
Instruction ID: 0a73a67fabdc7d08052c27dc726b7e6e4dcd5e4aa9afe08a7f7590861cce5029
Opcode Fuzzy Hash: 5b8c3754b5ba17353c18ca675a3acc20a40739b5da0fab98165202c1fc5fcc7d
Instruction Fuzzy Hash: CCC10563E18B808AF720DF78E4443ED7761F7997A8F105345EE9C16A9ADB78C285D380

Function 000002733BE670B0 Relevance: 1.5, Strings: 1, Instructions: 212COMMON

Download Yara Rule

Strings

\u%04x, xrefs: 000002733BE672A2

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID: \u%04x
API String ID: 0-2916071157
Opcode ID: 06a80ac53363f504e8d291dc153b6a47b21947aca11156197ff4547b1ef6832f
Instruction ID: f5722d23ec54fdff40d59a6c98e728cf64c430b507c2a3ba60a47e396e581226
Opcode Fuzzy Hash: 06a80ac53363f504e8d291dc153b6a47b21947aca11156197ff4547b1ef6832f
Instruction Fuzzy Hash: 6E81252231868481EA60EF29F5587EE6760F785B80F849662DF4E43B95DF38C715F380

Function 000002733BE6662B Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

": , xrefs: 000002733BE66711, 000002733BE667BE

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID: ":
API String ID: 0-3662656813
Opcode ID: dc23cd7c05b45f6358bc94f03c57da0058f789e31f7f5886284275ec2c8a9573
Instruction ID: a3ea6ae3541ba4355a49be942f3c7d27716c033282e767d33bebaa51305b4da3
Opcode Fuzzy Hash: dc23cd7c05b45f6358bc94f03c57da0058f789e31f7f5886284275ec2c8a9573
Instruction Fuzzy Hash: 27911576308A8585DB20EF2AE19879D6761F788FC8F419202CF9E07B65CF39C658D781

Function 000002733BE222D0 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 000002733BE22359

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
API String ID: 0-1713319389
Opcode ID: 0e1e18df8e43834f8c2d261b7060e305521bf1430a60c216941d6cdd0af00934
Instruction ID: 3f7e572fb493ac6864a8277cdd951a703df9b549658f4915021681934b4a2e35
Opcode Fuzzy Hash: 0e1e18df8e43834f8c2d261b7060e305521bf1430a60c216941d6cdd0af00934
Instruction Fuzzy Hash: F041C26361D6E049D712CB3994113BDBFB1E366B88F1C8292DBD887746D62DC306D710

Function 000002733BE1CF60 Relevance: .7, Instructions: 715COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c3274f3897a4260cc07431a4745c89ee4e825440cd4388d0ffdf9914fab499b
Instruction ID: fe5f0178c61640e2ac7884a7c65d9275e0104bcde04fd2426f71bd1b7dc95c1e
Opcode Fuzzy Hash: 5c3274f3897a4260cc07431a4745c89ee4e825440cd4388d0ffdf9914fab499b
Instruction Fuzzy Hash: 15725B72A18BC489EB20DF69E8443DDB3A1F789798F504315EADC57B99EB78C280D740

Function 000002733BE0F1C0 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd5453b7988ad3d0afd5be8f12c431266e20323cc7e8afb3c7b6a1d0fa614844
Instruction ID: a4c54f70508344ffa8d922b40e354c3f654157eee54b0d91ed15f9300f3650a1
Opcode Fuzzy Hash: bd5453b7988ad3d0afd5be8f12c431266e20323cc7e8afb3c7b6a1d0fa614844
Instruction Fuzzy Hash: 17F14E72A18F848AEB20DB69F44539D77A0F78D798F104315EEDC56B99EB38C290D780

Function 000002733BE0F8B0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c80b7fb06ebb8ad4856598de8f4359555bd2c91437dc04e710ed0b72b5e4ded9
Instruction ID: daae4b984663aba99f49ba2e07bcaf66c67f70d9d18a1852aab8d9314afb7d9c
Opcode Fuzzy Hash: c80b7fb06ebb8ad4856598de8f4359555bd2c91437dc04e710ed0b72b5e4ded9
Instruction Fuzzy Hash: 70F14E32608F848AEB20DB69F44539D77A0F78D7A8F105315EEDC57B99EB38C2919780

Function 000002733BE58B30 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 194
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002733BE588B0: InitializeCriticalSectionEx.KERNEL32 ref: 000002733BE58901
Part of subcall function 000002733BE588B0: GetLastError.KERNEL32 ref: 000002733BE5890B

EnterCriticalSection.KERNEL32 ref: 000002733BE58B71
GdiplusStartup.GDIPLUS ref: 000002733BE58B98
LeaveCriticalSection.KERNEL32 ref: 000002733BE58BA6
LeaveCriticalSection.KERNEL32 ref: 000002733BE58BD4
GdipGetImageEncodersSize.GDIPLUS ref: 000002733BE58BE2
GdipGetImageEncoders.GDIPLUS ref: 000002733BE58C76
GdipCreateBitmapFromScan0.GDIPLUS ref: 000002733BE58D40
GdipSaveImageToStream.GDIPLUS ref: 000002733BE58D5E
GdipDisposeImage.GDIPLUS ref: 000002733BE58DC3
GdipDisposeImage.GDIPLUS ref: 000002733BE58DD7

Strings

&, xrefs: 000002733BE58D3A

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream
String ID: &
API String ID: 1703174404-3042966939
Opcode ID: e0228fc8eea7d5b1ef60bb9784c8d30ef67e4de2cf218bbc2f582390e882f76a
Instruction ID: 46575172475f06efa56a28caf09ce217e6cbae9b5a6479f0901d5260055db163
Opcode Fuzzy Hash: e0228fc8eea7d5b1ef60bb9784c8d30ef67e4de2cf218bbc2f582390e882f76a
Instruction Fuzzy Hash: 88918F32609B449AEB30EF29F8087D837A4F754B98F458356EA4D47B94DB38C685E3C0

Function 000002733BE59BE0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 250
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002733BE5F890: GetUserGeoID.KERNEL32 ref: 000002733BE5F8B7
Part of subcall function 000002733BE5F890: GetGeoInfoA.KERNEL32 ref: 000002733BE5F8D1
Part of subcall function 000002733BE5F890: GetGeoInfoA.KERNEL32 ref: 000002733BE5F921

WSAStartup.WS2_32 ref: 000002733BE59D59
socket.WS2_32 ref: 000002733BE59D7A
htons.WS2_32 ref: 000002733BE59DA0
inet_pton.WS2_32 ref: 000002733BE59DE3
connect.WS2_32 ref: 000002733BE59DFD
closesocket.WS2_32 ref: 000002733BE59E1C
WSACleanup.WS2_32 ref: 000002733BE59E22

Strings

system, xrefs: 000002733BE59CC5
geo, xrefs: 000002733BE59D06

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Info$CleanupStartupUserclosesocketconnecthtonsinet_ptonsocket
String ID: geo$system
API String ID: 213021568-2364779556
Opcode ID: 8d507ed780ab9415465bea42d74918d4bd8e0c0aefd231a4a2bfbea2f08b141c
Instruction ID: 7815334a70aa9e64f6fcdef8530d217c94ecc6389c1c81f442b7ed29c1e30a98
Opcode Fuzzy Hash: 8d507ed780ab9415465bea42d74918d4bd8e0c0aefd231a4a2bfbea2f08b141c
Instruction Fuzzy Hash: 86C1B076B09B4085FB20EB68E8483DC23B2AB54798F415752DE5D1B7A9DE38C685E380

Function 000002733BE63B30 Relevance: 13.6, APIs: 9, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000002733BE63B61
GetProcessId.KERNEL32 ref: 000002733BE63B6A
RmStartSession.RSTRTMGR ref: 000002733BE63B8A
RmRegisterResources.RSTRTMGR ref: 000002733BE63BB5
RmGetList.RSTRTMGR ref: 000002733BE63BEE
RmGetList.RSTRTMGR ref: 000002733BE63C50
RmEndSession.RSTRTMGR ref: 000002733BE63C8B
RmEndSession.RSTRTMGR ref: 000002733BE63CC2
RmEndSession.RSTRTMGR ref: 000002733BE63CD7

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Session$ListProcess$CurrentRegisterResourcesStart
String ID:
API String ID: 3299295986-0
Opcode ID: fd498ee3de36280c394abacf9467fc5b9ce5ac8d70b1b0db778499f5d870b0f3
Instruction ID: b548dc8f6d2b7a2ff2021623e4214eb442149e20cea3aafb5cebf8c74f2c2ea7
Opcode Fuzzy Hash: fd498ee3de36280c394abacf9467fc5b9ce5ac8d70b1b0db778499f5d870b0f3
Instruction Fuzzy Hash: 72513032B09A418AF720DFA8F4587DD77A1B748748F504269EE0E63B94DE38CA05D790

Function 000002733BE7D5F0 Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002733BE7DA1D

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 197761c4084f71b538abde1851977105dd70471639988d7dce5d49f8975dacdd
Instruction ID: 3ed6444b1b42f59fd4db4afb81852dd052d4a134d032726ed2baa52e30ee68f0
Opcode Fuzzy Hash: 197761c4084f71b538abde1851977105dd70471639988d7dce5d49f8975dacdd
Instruction Fuzzy Hash: F1C1C3A220C78583F771EB9DA44A3DD7B61F780B80F558395FA8E03391DB79CA45A381

Function 000002733BE58990 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 000002733BE589D3
EnterCriticalSection.KERNEL32 ref: 000002733BE589E5
EnterCriticalSection.KERNEL32 ref: 000002733BE589F5
GdiplusShutdown.GDIPLUS ref: 000002733BE58A03
LeaveCriticalSection.KERNEL32 ref: 000002733BE58A10
LeaveCriticalSection.KERNEL32 ref: 000002733BE58A1A

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: 83031f1c3d95a3b59bc2a22e43b72ccd41805d9851eefa9cc92077698de98015
Instruction ID: a8b2206430438141a9b4559c7418f2ed7adf25f1af0991d8117a5d1205e599db
Opcode Fuzzy Hash: 83031f1c3d95a3b59bc2a22e43b72ccd41805d9851eefa9cc92077698de98015
Instruction Fuzzy Hash: B7116A3250AB40C1EB20EF28F85819973B4FB44FA4B684356DA6E462A4DF34CA96D3C0

Function 00007FF626BF7980 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF626BF7C00: Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00007FF626BF7C0E

Part of subcall function 00007FF626BE6610: char_traits.LIBCPMTD ref: 00007FF626BE663D

Part of subcall function 00007FF626BF7DC0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF626BF7ED5

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF626BF7AFA

Strings

LeaveCriticalSection, xrefs: 00007FF626BF79C5
LoadAcceleratorsW, xrefs: 00007FF626BF7A33
LoadAcceleratorsA, xrefs: 00007FF626BF7A73
EnterCriticalSection, xrefs: 00007FF626BF79FC

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID: Concurrency::details::_CriticalLock::_ProcessorReentrantScoped_lockScoped_lock::~_Virtual$Concurrency::RootRoot::char_traits
String ID: EnterCriticalSection$LeaveCriticalSection$LoadAcceleratorsA$LoadAcceleratorsW
API String ID: 2378420206-1394853731
Opcode ID: 04327c45c70a67150be1c73c2e078c6eac2a998af2c452a8fcebf7652b8d46cf
Instruction ID: 17c2e95a7d354bfa88a1141162b92c8426ee63931ca77e01a4f6890bdaf15128
Opcode Fuzzy Hash: 04327c45c70a67150be1c73c2e078c6eac2a998af2c452a8fcebf7652b8d46cf
Instruction Fuzzy Hash: 1D514F2651D98291DE30EB64FC513EEA360FBC2345F901072E68DC3AAAEE2DD915CB41

Function 000002733BE5E9F0 Relevance: 6.4, APIs: 4, Instructions: 417networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 000002733BE5EBCC
recv.WS2_32 ref: 000002733BE5F0AC
closesocket.WS2_32 ref: 000002733BE5F0BE
WSACleanup.WS2_32 ref: 000002733BE5F0C4

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: recv$Cleanupclosesocket
String ID:
API String ID: 146070474-0
Opcode ID: 64d328896e954a547c3b29eb49fb77e27025de37278f77c6f89290b4beb24637
Instruction ID: 138e25f2f0d924fd994b2958340ec082cff37526b21c26ad13f1e26220086f9a
Opcode Fuzzy Hash: 64d328896e954a547c3b29eb49fb77e27025de37278f77c6f89290b4beb24637
Instruction Fuzzy Hash: 7812A37261CBC481EA30EB18F4583DE6761F789790F505352EAED46AEADF78C680D780

Function 00007FF626BF7FD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF626BF80EF
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF626BF8197

Part of subcall function 00007FF626C377D4: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF626C3651B), ref: 00007FF626C37824
Part of subcall function 00007FF626C377D4: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF626C3651B), ref: 00007FF626C37865

Strings

1.3.1.zlib-ng, xrefs: 00007FF626BF802D

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_$ExceptionFileHeaderRaise
String ID: 1.3.1.zlib-ng
API String ID: 543713560-992988628
Opcode ID: 8956c29817721c66e9a5c783700e556b24576ee2f69ddabf96bd024d6e1e8483
Instruction ID: 4c03dd71271f46f3748d94e2181bf796f72637fe1147d4f271cca7f5532eb1fe
Opcode Fuzzy Hash: 8956c29817721c66e9a5c783700e556b24576ee2f69ddabf96bd024d6e1e8483
Instruction Fuzzy Hash: 2A61F83261CA8586DE70DB14E8513EEB3A0FBD9345F900135EACD82AA9DF3DD654CB41

Function 000002733BE60420 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegGetValueA.ADVAPI32 ref: 000002733BE60489

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 000002733BE6047B
ProductName, xrefs: 000002733BE60474

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Value
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-1787575317
Opcode ID: 4b31b020cac4b58e91cc22bf7df28ffde147e0876d00deb1f16a5955c36cd2ac
Instruction ID: 30a504198d49432ce782d326282d0486c73f42ba355fdd56e8b9ac1f898918b1
Opcode Fuzzy Hash: 4b31b020cac4b58e91cc22bf7df28ffde147e0876d00deb1f16a5955c36cd2ac
Instruction Fuzzy Hash: B6118E3220CB8082EB20DF25F84439AB3A4F789784F414316EA9C07B59CFBCC294CB80

Function 000002733BE6B090 Relevance: 4.9, APIs: 3, Instructions: 440COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE6B26B
Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE6B474
Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE6B5F0

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 2ccb1c66db1857d2f97d686fc6af02b5fe4d084d8bfe71cc9a34bb5c39443187
Instruction ID: 14522d67cace02142f73a57ab570409d4065e851fe14288dbb998ddde71ae254
Opcode Fuzzy Hash: 2ccb1c66db1857d2f97d686fc6af02b5fe4d084d8bfe71cc9a34bb5c39443187
Instruction Fuzzy Hash: 46F1C032215B8481EA24EB29F4497EE63A4F748BE4F144725AFAD47795EF38C291D380

Function 000002733BE5ED77 Relevance: 4.7, APIs: 3, Instructions: 182networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 000002733BE5F0AC
closesocket.WS2_32 ref: 000002733BE5F0BE
WSACleanup.WS2_32 ref: 000002733BE5F0C4

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Cleanupclosesocketrecv
String ID:
API String ID: 3447645871-0
Opcode ID: 5f43de0dc1a28afc19fc76975d6654e0929afc1745546c7a5a358dfe4b68544a
Instruction ID: e1af696365c22ed2eda5c9ce989f51bb497a69e3973efc282972d307063715f1
Opcode Fuzzy Hash: 5f43de0dc1a28afc19fc76975d6654e0929afc1745546c7a5a358dfe4b68544a
Instruction Fuzzy Hash: CF917663A18BC441EA30E718F4583DE6751F7997A0F105346DAAD47BEADF78C580E780

Function 000002733BE61111 Relevance: 4.7, APIs: 3, Instructions: 163registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000002733BE61129
RegEnumKeyExA.ADVAPI32 ref: 000002733BE6116E
RegCloseKey.ADVAPI32 ref: 000002733BE61364

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: 5bdcb49920ee0669aa8e284a80da3776a59de088301a5c323abb8112722a4b35
Instruction ID: 4f5de72e19ac898a493faf53cdc1742417c75dced664647f67b788dd28ed9c1e
Opcode Fuzzy Hash: 5bdcb49920ee0669aa8e284a80da3776a59de088301a5c323abb8112722a4b35
Instruction Fuzzy Hash: F3719F72B08B8085EB21EB69F4483DD7760F7857A8F105705EAAD17AE9DB78C1C1E780

Function 00007FF626BED7F0 Relevance: 4.6, APIs: 3, Instructions: 112COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FF626BED8DD
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FF626BED9C0
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF626BED9E9

Part of subcall function 00007FF626BE6610: char_traits.LIBCPMTD ref: 00007FF626BE663D

Part of subcall function 00007FF626BEDAA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF626BEDAB8

Part of subcall function 00007FF626BEDB00: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF626BEDB13

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID: Concurrency::details::Work$EmptyQueue::Structured$Base::ContextIdentityQueue$char_traits
String ID:
API String ID: 2573577243-0
Opcode ID: f26d7d76682de479d1a510b7515a2100360f65aa1e8371ebd0398830a94be955
Instruction ID: b4307e35bf43c503285fb59eba2266fe97c92be4e86bdf6fa9496ef5ea8724b8
Opcode Fuzzy Hash: f26d7d76682de479d1a510b7515a2100360f65aa1e8371ebd0398830a94be955
Instruction Fuzzy Hash: A7513C6260CB8691DE209B15E8503EFB360FBC6781F804072E6CD87BAAEF6DD515CB41

Function 000002733BE610A0 Relevance: 4.6, APIs: 3, Instructions: 96registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000002733BE61129
RegEnumKeyExA.ADVAPI32 ref: 000002733BE6116E

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: EnumOpen
String ID:
API String ID: 3231578192-0
Opcode ID: a8920e58832bf877e089fa0af907033f7a3b2d639e35d700202a240f283f6ca3
Instruction ID: a32cee49e94f28d097153729773fc434a3c00c624035f081f4464f52cb1f5da8
Opcode Fuzzy Hash: a8920e58832bf877e089fa0af907033f7a3b2d639e35d700202a240f283f6ca3
Instruction Fuzzy Hash: 29319F32B08B8085E720DF65F8487DE7774F744798F205215EE9D17A54DB78C692D780

Function 00007FF626BF17D0 Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

_CallMemberFunction0.LIBCPMTD ref: 00007FF626BF1850
_CallMemberFunction0.LIBCPMTD ref: 00007FF626BF18CD
_CallMemberFunction0.LIBCPMTD ref: 00007FF626BF1928

Part of subcall function 00007FF626BEA560: char_traits.LIBCPMTD ref: 00007FF626BEA593

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID: CallFunction0Member$char_traits
String ID:
API String ID: 1927575840-0
Opcode ID: b3a0a285e39b8cf687cbf5e33b540a6d49c497df54d9ecd142d2dcea34095149
Instruction ID: c5532d5ca764491560400253896142544875c05f0efd076160054a1792c06d40
Opcode Fuzzy Hash: b3a0a285e39b8cf687cbf5e33b540a6d49c497df54d9ecd142d2dcea34095149
Instruction Fuzzy Hash: A2314F35A0C64285EE20EB15EC4017E77E1FB86785F404535FA8DC7AAADF3EE5118B42

Function 000002733BE60DDB Relevance: 4.6, APIs: 3, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000002733BE60DF7
RegQueryValueExA.ADVAPI32 ref: 000002733BE60E36
RegCloseKey.ADVAPI32 ref: 000002733BE60ED4

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 167b3dbd054041ffdb8ff7b27bb51a5af926637fa25483a72cd675fd3e38e6c5
Instruction ID: 43fbf8f5cc11cb01c21a1a60433f1e4af37c333b12d0681db77b87cb3af48cbb
Opcode Fuzzy Hash: 167b3dbd054041ffdb8ff7b27bb51a5af926637fa25483a72cd675fd3e38e6c5
Instruction Fuzzy Hash: DB21EA2261DB9081EE70EB29F08439EA750FBD57D4F405312FA8D42A99DF3CC284D780

Function 00007FF626BF82A0 Relevance: 4.6, APIs: 3, Instructions: 51COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF626BF82DB
OpenProcessToken.ADVAPI32 ref: 00007FF626BF82EE
GetTokenInformation.KERNELBASE ref: 00007FF626BF8336

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID: ProcessToken$CurrentInformationOpen
String ID:
API String ID: 2743777493-0
Opcode ID: 722ab832dbefb05b570a67b2cccdef345e5e387398dfdff30b5f0e262e84267a
Instruction ID: bc45adb0e5c8004a76e8b53aada5861a5e8b3172364839672217633ac9e14a1c
Opcode Fuzzy Hash: 722ab832dbefb05b570a67b2cccdef345e5e387398dfdff30b5f0e262e84267a
Instruction Fuzzy Hash: BB21622662C68185EF50DB10E8503AE7770FB82345F901035FA8E87AA9DF7ED504CB01

Function 000002733BE5F890 Relevance: 4.6, APIs: 3, Instructions: 50COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32 ref: 000002733BE5F8B7
GetGeoInfoA.KERNEL32 ref: 000002733BE5F8D1
GetGeoInfoA.KERNEL32 ref: 000002733BE5F921

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: d34c2ece54cb3812040e4eef0477fed434900964bc97860851aa3e607d5351a2
Instruction ID: 76c7defdbb70cc29b7a230085401829e57541d9a5f066867b3598890610e6470
Opcode Fuzzy Hash: d34c2ece54cb3812040e4eef0477fed434900964bc97860851aa3e607d5351a2
Instruction Fuzzy Hash: 95119D32A18B8082E720EF65F41475EB7A1FB84B88F045225EB8903B59DF7CD6909BC4

Function 000002733BE59760 Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000002733BE5979B
OpenProcessToken.ADVAPI32 ref: 000002733BE597AE
GetTokenInformation.ADVAPI32 ref: 000002733BE597EA

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: ProcessToken$CurrentInformationOpen
String ID:
API String ID: 2743777493-0
Opcode ID: 5cf106d3b2ffd2a7e9a61a7f883b18dc6c947c023f1ec599732081f4b0d6fdce
Instruction ID: af890438ec4fbc4f1c9f8e5a7f1436634aab6cd97ebb194cf0a6e1c210e729fa
Opcode Fuzzy Hash: 5cf106d3b2ffd2a7e9a61a7f883b18dc6c947c023f1ec599732081f4b0d6fdce
Instruction Fuzzy Hash: EA11513261DB4082EB60DF15F84438AB7A0FB84B80F445266EB8D43B68CF3CC545DB80

Function 000002733BE83270 Relevance: 4.5, APIs: 3, Instructions: 15COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000002733BE83281
TerminateProcess.KERNEL32 ref: 000002733BE8328C
ExitProcess.KERNEL32 ref: 000002733BE8329B

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: f80d91bcf93e8424b3640f1b7356e3f7b22acd1ad7b3684da8aa45f97133e79c
Instruction ID: 0438c14518a7b1fdfc67086279b0421df78b5a240b6e498f8e183361324b0407
Opcode Fuzzy Hash: f80d91bcf93e8424b3640f1b7356e3f7b22acd1ad7b3684da8aa45f97133e79c
Instruction Fuzzy Hash: 2CD09E1470DB0452EA38FB78789D6DD17155F49B02F005EACA90F4A397CD2D874D62C0

Function 000002733BE1F350 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE1F53C

Strings

, xrefs: 000002733BE1F3D3

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-3916222277
Opcode ID: d64c194b8d63a2c56f4a75dcc143c28c30b6ecabf1f09533ba250de39c4b8e28
Instruction ID: 2869ff60e57dd34759dc386613ef06f11dd91819866db5eb2f6fb5c3a5b95702
Opcode Fuzzy Hash: d64c194b8d63a2c56f4a75dcc143c28c30b6ecabf1f09533ba250de39c4b8e28
Instruction Fuzzy Hash: 48515C72208B4496EB25DF2EE19839C73A0F348B94F644662CB5D53BA2CF38D5A1D3C0

Function 000002733BE60C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32 ref: 000002733BE60C6C

Strings

Unknown, xrefs: 000002733BE60D26

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: 327d7d51cf89ce8cae5e34d504ec04f85fc3bceab43135c4ad84e114b6f625fa
Instruction ID: edb15ce7319dce20e6ff6e3cb252c43f79447f46d9a23d608e843d9c3d676466
Opcode Fuzzy Hash: 327d7d51cf89ce8cae5e34d504ec04f85fc3bceab43135c4ad84e114b6f625fa
Instruction Fuzzy Hash: 6831EF2362CBC086E720DF24F4443EAA760F799B84F546215EBCD12A4ADB7CC684DB80

Function 00007FF626BEFAE0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_CRT_INIT.LIBCMTD ref: 00007FF626BEFB9A

Strings

@, xrefs: 00007FF626BEFB6E

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: b337b7728e22acf7a85b468339197ec44de5b842342dd1561fc2dcb21d3dd529
Instruction ID: 31d6a9c9933d88d4a795477facc50b39da95e2f3e77e99794ee1d3438f53e640
Opcode Fuzzy Hash: b337b7728e22acf7a85b468339197ec44de5b842342dd1561fc2dcb21d3dd529
Instruction Fuzzy Hash: 22312836A1CB818ADB60CB25E89422EBBE4F7C9784F500165FA8D83B58DF3DD5108F00

Function 000002733BE251E0 Relevance: 3.2, APIs: 2, Instructions: 192COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE25320
Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE2541F

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 418ad345e38e5ece6923477ef3d4cd48538987449be9ede3b57e8d5671647296
Instruction ID: 724a4d801449242eecc3211cde72a840e635448bf336dedc67cc81292492ed16
Opcode Fuzzy Hash: 418ad345e38e5ece6923477ef3d4cd48538987449be9ede3b57e8d5671647296
Instruction Fuzzy Hash: 0B51F962309B4085EE34FB19B6083DD63D1A708BE5F584761DEBD0F7D6EA78C681A380

Function 000002733BE58E10 Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 000002733BE58E69
CoTaskMemFree.OLE32 ref: 000002733BE58F2A

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: FolderFreeKnownPathTask
String ID:
API String ID: 969438705-0
Opcode ID: 742bb63662d3073f9ee8af471a8bc599662f9952876318b13433662567a57a6c
Instruction ID: 5b71fd7615d3ea839bebac349e54afc4773d05276f8521046f2471c6af6238a2
Opcode Fuzzy Hash: 742bb63662d3073f9ee8af471a8bc599662f9952876318b13433662567a57a6c
Instruction Fuzzy Hash: 4E316572918B8481E720DF29F44439EB761F7997E4F105316FAAD03795DB7CC2819B80

Function 000002733BE6E614 Relevance: 3.1, APIs: 2, Instructions: 77COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002733BE6E63B

Part of subcall function 000002733BE6E5D0: _invalid_parameter_noinfo.LIBCMT ref: 000002733BE6E5E7

_invalid_parameter_noinfo.LIBCMT ref: 000002733BE6E6EF

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cb30a7c2c620b97f400ef9b33bc0fdb0214d80daa24a11497eeb67f4fc095207
Instruction ID: f827aebea589fcfc7e997370a0386f24daf4bbea804ff6de2b35d0915388980a
Opcode Fuzzy Hash: cb30a7c2c620b97f400ef9b33bc0fdb0214d80daa24a11497eeb67f4fc095207
Instruction Fuzzy Hash: 7C319532618A4881EA74FF58F8593ED3361E7A4B80F9417A1E65D473D2EE78C314A380

Function 000002733BE57390 Relevance: 3.1, APIs: 2, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000002733BE573E1
RegCloseKey.ADVAPI32 ref: 000002733BE573F3

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: f079ec761da95b766b8b6afbeec7fda29d97571b2deafd3f5d4343d11bd09f0c
Instruction ID: 40cf912a2310e02719e40d0986dc8b991bfed68eeeb3b588ca67060a3c5a244f
Opcode Fuzzy Hash: f079ec761da95b766b8b6afbeec7fda29d97571b2deafd3f5d4343d11bd09f0c
Instruction Fuzzy Hash: 01210721719A4045EE70EB29F8443EAA760EB88BD4F445362FE4D43BA5DF28C681E780

Function 000002733BE5664C Relevance: 3.1, APIs: 2, Instructions: 58synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 000002733BE1C8C0: CreateToolhelp32Snapshot.KERNEL32 ref: 000002733BE1C90A
Part of subcall function 000002733BE1C8C0: Process32FirstW.KERNEL32 ref: 000002733BE1C94C

Part of subcall function 000002733BE1ACC0: CredEnumerateA.ADVAPI32 ref: 000002733BE1AD22

Part of subcall function 000002733BE5E9F0: recv.WS2_32 ref: 000002733BE5EBCC

ReleaseMutex.KERNEL32 ref: 000002733BE566BB
CloseHandle.KERNEL32 ref: 000002733BE566C4

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: CloseCreateCredEnumerateFirstHandleMutexProcess32ReleaseSnapshotToolhelp32recv
String ID:
API String ID: 420082584-0
Opcode ID: 036243cc36745df91b13cbf9ecb1cefea124ab65504d4d2134417f0e20bc5439
Instruction ID: e3413b4c757585b9fc645d2a8d4b454f5db55423b92cd65a5f78b753e4726829
Opcode Fuzzy Hash: 036243cc36745df91b13cbf9ecb1cefea124ab65504d4d2134417f0e20bc5439
Instruction Fuzzy Hash: F321D31160D58046F931F7BCF40E3ED9290AF46791F645BD2E9AE012D7DE18C384B2D1

Function 000002733BE5667D Relevance: 3.0, APIs: 2, Instructions: 47synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 000002733BE5E9F0: recv.WS2_32 ref: 000002733BE5EBCC

ReleaseMutex.KERNEL32 ref: 000002733BE566BB
CloseHandle.KERNEL32 ref: 000002733BE566C4

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: CloseHandleMutexReleaserecv
String ID:
API String ID: 2659716615-0
Opcode ID: ab5b83b0048094fda44903b8d71eb9334083aa5015830e94b64139949424460e
Instruction ID: c74b5febc9eeff1ed7f95a801c60fe60dd1413f62768abedd1b510fcdc9c0902
Opcode Fuzzy Hash: ab5b83b0048094fda44903b8d71eb9334083aa5015830e94b64139949424460e
Instruction Fuzzy Hash: 9011E56160D68046FA70F73CF40E3ED6390AF86B91F545792EAAE016D7DE18C280B2D1

Function 000002733BE7DB60 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 000002733BE7DBAC
GetLastError.KERNEL32 ref: 000002733BE7DBB6

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7e9ab1c6d8c64915d6648e9c143c2363700413bfa3c055332623f50353a46816
Instruction ID: 8048d4386a17247794bc551298059128805d57c39ade6828489ba843ba6204f5
Opcode Fuzzy Hash: 7e9ab1c6d8c64915d6648e9c143c2363700413bfa3c055332623f50353a46816
Instruction Fuzzy Hash: 7E11C1A2208B8082DA20EB69F449299A761E785BF4F544351EE7D4B7E9CF78C6509780

Function 00007FF626BED750 Relevance: 3.0, APIs: 2, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF626BED768
GetProcAddress.KERNEL32 ref: 00007FF626BED789

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: bd71bcfb797b50c55a6df7201416778f22323b2fa91c79af38a8b0c2d0370c92
Instruction ID: 96d996fdb4c9a694cecdf18409d454247fae9a1c4b66e63850a3cc75269bb29e
Opcode Fuzzy Hash: bd71bcfb797b50c55a6df7201416778f22323b2fa91c79af38a8b0c2d0370c92
Instruction Fuzzy Hash: 5201697651CB8589DB60CB11F88032EB7B0F78A795F500575E6CE82BA8CFBDC1A48B01

Function 000002733BE8CB98 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE8CBC8

Part of subcall function 000002733BE8DBEC: std::bad_alloc::bad_alloc.LIBCMT ref: 000002733BE8DBF5

Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE8CBCE

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 267b89f17236609d1417f10d46edbd95984192d968a560c5371d581f7ac22313
Instruction ID: a08e4dc2b6889aeadb563fbfef690991fe6ef65dc7ce8d454381880de2a07580
Opcode Fuzzy Hash: 267b89f17236609d1417f10d46edbd95984192d968a560c5371d581f7ac22313
Instruction Fuzzy Hash: 07E0EC1161AD1545F938F7BE340E3E500845B1AB76E1C1FA1697D853E3A91486D571D0

Function 00007FF626C25810 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,00007FF626C25929,00007FF626C2ACD6,?,?,?,00007FF626C2B053,?,?,00000000,00007FF626C2B9B9,?,?,?,00007FF626C2B8EB), ref: 00007FF626C25826
GetLastError.KERNEL32(?,?,00007FF626C25929,00007FF626C2ACD6,?,?,?,00007FF626C2B053,?,?,00000000,00007FF626C2B9B9,?,?,?,00007FF626C2B8EB), ref: 00007FF626C25830

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: d1c0f4e6f877c9d6cfcd8a19c59eeb7a423ced942baaa3383c8ac58c4f15d072
Instruction ID: 11d0baeabf3d88acc86c14014fb6191f48ebbf9670c39f3059686cb8a7fae593
Opcode Fuzzy Hash: d1c0f4e6f877c9d6cfcd8a19c59eeb7a423ced942baaa3383c8ac58c4f15d072
Instruction Fuzzy Hash: 12E0C2A4F1820242FF08BBFA6CA503A13755F84751F846030CD0DC3692EEAEA8814312

Function 000002733BE7B550 Relevance: 2.5, APIs: 2, Instructions: 18memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 000002733BE7B566
GetLastError.KERNEL32 ref: 000002733BE7B570

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 47cbcda289b4926f8a5fa232dbc04e0ffd722977d505590b0caac84d58b1b127
Instruction ID: 049ac2c189f060bbe99f440df64661d176e4a30ece43168e6a25878f16349adb
Opcode Fuzzy Hash: 47cbcda289b4926f8a5fa232dbc04e0ffd722977d505590b0caac84d58b1b127
Instruction Fuzzy Hash: 5EE0C240B0E20183FF38F3FA786E3E812561F84740F0407A0AA1D82292EE38474073C0

Function 000002733BE6D450 Relevance: 1.7, APIs: 1, Instructions: 189COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE6D6A0

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 22961ef930a00238eb161d6b0356fad4b0c2afeaa7fa2e1538140c8a8bd2ea9f
Instruction ID: 3e2a3f4b04131304828afeca27d90011070f24eb282c55a9eecc4144cb423d90
Opcode Fuzzy Hash: 22961ef930a00238eb161d6b0356fad4b0c2afeaa7fa2e1538140c8a8bd2ea9f
Instruction Fuzzy Hash: B961BE62308A8084EB25EF5AE1583AC23A1E314F98F94C751CE6D5B7D5DE38CA85E380

Function 000002733BE0E150 Relevance: 1.7, APIs: 1, Instructions: 175COMMON

Download Yara Rule

APIs

__std_fs_directory_iterator_open.LIBCPMT ref: 000002733BE0E283

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: __std_fs_directory_iterator_open
String ID:
API String ID: 4007087469-0
Opcode ID: 4721e9ab553274334b1f156d9a7184a3bbbc1e1787f4ba01afe0aee770dfc53e
Instruction ID: b518c29691b894aa91a381cd43e13145637fe28f8e3897384e4d5067a1e67875
Opcode Fuzzy Hash: 4721e9ab553274334b1f156d9a7184a3bbbc1e1787f4ba01afe0aee770dfc53e
Instruction Fuzzy Hash: 7261F562F08B4585FB30EB6EE4983EC23A1E749794F004761EE1D577D5EA3CC685A380

Function 000002733BE25B00 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE25C95

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6819557343382872e52757baf74dd55a98ceffe11ae555dd88650f504de38fe3
Instruction ID: 036aac2e5c932dd56d6ce1104f8074c3c5ea965d34e45f7e914d90b5a58d0aa5
Opcode Fuzzy Hash: 6819557343382872e52757baf74dd55a98ceffe11ae555dd88650f504de38fe3
Instruction Fuzzy Hash: DE41BF76308B8485EA20FB1AB54C3DD6391B749BD4F540761EEAD0B795EF3CC641A384

Function 000002733BE4B010 Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE4B1B7

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: b203b9bf632efb5300e9700833c121eeda259d8c8cfb89c73224b3e6f1179f50
Instruction ID: 02139cdb039ebb32b2caceff73d8ad707628dc80baa3ea0371fa9ba100db7308
Opcode Fuzzy Hash: b203b9bf632efb5300e9700833c121eeda259d8c8cfb89c73224b3e6f1179f50
Instruction Fuzzy Hash: 1041B472218B8481DA34EB69F5583EEB3A0F749BD0F104755ABAD03B95DF38C281D380

Function 000002733BE25CB0 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE25E2C

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 1275d2820500e66303057adeeb9cafde1f00f1c59bed1405ecd51a4b825d8eb5
Instruction ID: ff4d222cb3466f8faf654e272bc85e45f42d663ebf917a6ce93042c3544e178c
Opcode Fuzzy Hash: 1275d2820500e66303057adeeb9cafde1f00f1c59bed1405ecd51a4b825d8eb5
Instruction Fuzzy Hash: DE419362309B4485EE30FB1AB60C3DAA391B745BD4F5447619EAD0F7D6DE38C641A380

Function 000002733BE215C0 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE21711

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 12228b42dbb7d06fb81c5e6fe8c0e4450f80b8911eb8c80816cdf8817a3beac7
Instruction ID: 9009be6ceb376eac94a94f146805e4ce28feb3c36c08bc9b22381042f0a2931f
Opcode Fuzzy Hash: 12228b42dbb7d06fb81c5e6fe8c0e4450f80b8911eb8c80816cdf8817a3beac7
Instruction Fuzzy Hash: 4E31F326709B4444FA35FB59F6083ED22819705FE4F5807619EAD0BBD5EA78C781A381

Function 000002733BE7BA50 Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002733BE7BA78

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 62a68b64f697a3323ce5c67975f603dd912b7630c4b3619a8df593f8b8e10b11
Instruction ID: cf7b9dff34a11283713eee6839951ba03623f27d15c38239b391fe36e5943618
Opcode Fuzzy Hash: 62a68b64f697a3323ce5c67975f603dd912b7630c4b3619a8df593f8b8e10b11
Instruction Fuzzy Hash: 7741E47221820487EA34FB2DF56A3E973A0E755B84F141341FB9E836D4CB28D602E7D1

Function 000002733BE60250 Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32 ref: 000002733BE602E0

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: fed4a2f5e55cb5badf149d3cddc4b61e7a545cc3d15ebc6aed106fdd84461df2
Instruction ID: 3ecc17e59d98b20b39d5d7f7e3d5a78e12b29e1df62fb6bbe1945a0c6cc3e3cc
Opcode Fuzzy Hash: fed4a2f5e55cb5badf149d3cddc4b61e7a545cc3d15ebc6aed106fdd84461df2
Instruction Fuzzy Hash: 66519032A18B9086E720DF68E8843DD77A0F799788F505352EB9C53A99DF78C684C780

Function 00007FF626BF7DC0 Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF626BFB970: _Byte_length.LIBCPMTD ref: 00007FF626BFB9F6

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF626BF7ED5

Part of subcall function 00007FF626BFBA40: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF626BFBA6A

Part of subcall function 00007FF626BFBAA0: _Byte_length.LIBCPMTD ref: 00007FF626BFBB26

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID: Byte_lengthConcurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_
String ID:
API String ID: 2675252387-0
Opcode ID: 8cf2c1331036d997b2d5cbdfd09f9a6dace60c7598b65e1a7ef6aa7a93a04358
Instruction ID: 45f15ec4d06303bda2410217fa68d0a94148e8658d28745d77acc0d39c56be76
Opcode Fuzzy Hash: 8cf2c1331036d997b2d5cbdfd09f9a6dace60c7598b65e1a7ef6aa7a93a04358
Instruction Fuzzy Hash: C4512A3661DA8591DE60EB14F8503DEB3A1FBC5780F904032EA8D87B69EE3DD559CB01

Function 00007FF626BEBA90 Relevance: 1.6, APIs: 1, Instructions: 95COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF626BEC520: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF626BEC53D
Part of subcall function 00007FF626BEC520: _Max_value.LIBCPMTD ref: 00007FF626BEC562
Part of subcall function 00007FF626BEC520: _Min_value.LIBCPMTD ref: 00007FF626BEC590

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF626BEBB3C

Part of subcall function 00007FF626BE4310: std::_Xinvalid_argument.LIBCPMT ref: 00007FF626BE431B

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$Max_valueMin_valueXinvalid_argumentstd::_
String ID:
API String ID: 142707115-0
Opcode ID: 60dc388cca3665f00380207ba0fc440bb0a5f3e9cb1ca1dbde5340a79cbc7bc9
Instruction ID: f184ec26afefa28dc75f13bad579e5a639ec547b8c3c8dc1c4c039c89a00effc
Opcode Fuzzy Hash: 60dc388cca3665f00380207ba0fc440bb0a5f3e9cb1ca1dbde5340a79cbc7bc9
Instruction Fuzzy Hash: B251A53661DB8581DA50DB56F89026EB7A4F7C9B80F501026FACE83B2ADF3DD450CB41

Function 000002733BE14E90 Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE14FAE

Part of subcall function 000002733BE0B7B0: __std_exception_copy.LIBVCRUNTIME ref: 000002733BE0B7F8

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy
String ID:
API String ID: 317858897-0
Opcode ID: f89fcabff5973c8990e8b9f3a96863f7433ed84f5928a5ba91d490a207ffa240
Instruction ID: e75e3396008712be89eb24fe651cc21f49cc5f065b72b257f9d529df187d59d8
Opcode Fuzzy Hash: f89fcabff5973c8990e8b9f3a96863f7433ed84f5928a5ba91d490a207ffa240
Instruction Fuzzy Hash: C931D663605B5081EE24EB19F0143ACA3A0A788FB4F3457619A7C07BD5EF78C6D2A380

Function 000002733BE1FE50 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE1FF58

Part of subcall function 000002733BE0B7B0: __std_exception_copy.LIBVCRUNTIME ref: 000002733BE0B7F8

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy
String ID:
API String ID: 317858897-0
Opcode ID: fb9bc674607e6dbb758638ef1881955e72912653ce32e17aa8df73ef9129921e
Instruction ID: 4c32d7ed83bf12243a35f1baa8436169e57a289e54f414c2034b1ce059d79e91
Opcode Fuzzy Hash: fb9bc674607e6dbb758638ef1881955e72912653ce32e17aa8df73ef9129921e
Instruction Fuzzy Hash: 9621D762609B4041EE29FB19F1443E96290A748BA4F2447619A7C47BD3EB79C6D2A3C0

Function 000002733BE7D4D0 Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002733BE7D556

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 90e282629e3327800b1a09ea2473f0e2941ce1167cc6a0942764be9094e0e12c
Instruction ID: 406859816eb36ecaa894a63df4eda2617a58b9fbe13da3322bb85d10f74628aa
Opcode Fuzzy Hash: 90e282629e3327800b1a09ea2473f0e2941ce1167cc6a0942764be9094e0e12c
Instruction Fuzzy Hash: 3831A4B261C610C3FB31FBADE84A3DC2660A784B98F414385BA6D473D2DB78C641A791

Function 00007FF626BEF580 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8832b93c38650351119958a3682aaab50e8cbc8b9dc0623d89af5356b64ee8a2
Instruction ID: 0f84b5e53d384b6e37d37569b4d915063e92dc218e80580a4c4b7b8947b7872c
Opcode Fuzzy Hash: 8832b93c38650351119958a3682aaab50e8cbc8b9dc0623d89af5356b64ee8a2
Instruction Fuzzy Hash: 63314B66A1CB8186DB509B56E89032FA7A4FBC67D1F400076FACD83B69CF6DD0108B41

Function 000002733BE831A1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002733BE831CF

Part of subcall function 000002733BE832C8: GetModuleHandleExW.KERNEL32 ref: 000002733BE832ED
Part of subcall function 000002733BE832C8: GetProcAddress.KERNEL32 ref: 000002733BE83303
Part of subcall function 000002733BE832C8: FreeLibrary.KERNEL32 ref: 000002733BE8332A

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 530d5f225501611c07fa3f753d7d8dc80cca454b0254b6cc05cb90d306267795
Instruction ID: 53292a646b06e9e8048cc889252e5e6cde4d5de418353f866d84683b4f4a74f8
Opcode Fuzzy Hash: 530d5f225501611c07fa3f753d7d8dc80cca454b0254b6cc05cb90d306267795
Instruction Fuzzy Hash: 23213D32A05A408AEB24EFACE4483EC37A0E744B19F544765E61D8BAD6EB34DA45D7C0

Function 000002733BE9E208 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002733BE9E22B

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c41a516aab5bbd5a0cb5ee3d8915c07e5e449c965519035ee3790c186b832703
Instruction ID: 4b5046754dac08ce90dc89d51ab7dc73a1f208074c9fd3755e7f2f20d414f3ee
Opcode Fuzzy Hash: c41a516aab5bbd5a0cb5ee3d8915c07e5e449c965519035ee3790c186b832703
Instruction Fuzzy Hash: 7F21C332208A4487EB71EF2CF4447A976A1F788B94F144364EB9D876D9DB3CCA089B40

Function 000002733BE9C510 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002733BE9C46D

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6080b6f5c7735027f4532a4154f17099be5a1c2b37b88469d38b788aa2f2ab04
Instruction ID: a18617847aac0fa1df2063ec1b0293f6c7118249fba990ab040662c886f3b500
Opcode Fuzzy Hash: 6080b6f5c7735027f4532a4154f17099be5a1c2b37b88469d38b788aa2f2ab04
Instruction Fuzzy Hash: 38119D2270C65082EA70FF59B4093F9B2A0F786B80F444691EACD47B86CB3DC645A7C1

Function 00007FF626BEE170 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 292d0802afc3662b8a44df9434c69ee7ab1bc2423aa3cf29da608adeab93335d
Instruction ID: dd9444025f3dcfaeb919c9811f3224f0e03aa56dd6c610effc26d84edfc7b14e
Opcode Fuzzy Hash: 292d0802afc3662b8a44df9434c69ee7ab1bc2423aa3cf29da608adeab93335d
Instruction Fuzzy Hash: AD217C2691CAC181EEB0DB10E8513AEA7A0FBD6385F805471F6CEC3A9ACF2DD1558B41

Function 00007FF626BFBBF0 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF626BFBC1C

Part of subcall function 00007FF626BFF7D0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF626BFF846
Part of subcall function 00007FF626BFF7D0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF626BFF855

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_$Concurrency::details::EmptyQueue::StructuredWork
String ID:
API String ID: 2595383736-0
Opcode ID: d187d2a0eb802e6f176a8c328b985804572825bb7962f1620d6111e602d056cd
Instruction ID: f19b9a5eebf8ae057d4b220506078364cc37e00ffd3935d3530188eb09c2c78b
Opcode Fuzzy Hash: d187d2a0eb802e6f176a8c328b985804572825bb7962f1620d6111e602d056cd
Instruction Fuzzy Hash: 8421E336618F8881DA10DB15F88026EB7A4FBD9B84F901126FACD83B69DF3DD160CB40

Function 00007FF626BF8750 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF626BF875E

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork
String ID:
API String ID: 1865873047-0
Opcode ID: 1ad8e3f512f94af4e84cc218fd812ce07013cec5e36aa4d374ac0a216bf662a5
Instruction ID: f506acd44fee946d426ab31da1c09d732d63cd83e03cd82367825b0547b55dc5
Opcode Fuzzy Hash: 1ad8e3f512f94af4e84cc218fd812ce07013cec5e36aa4d374ac0a216bf662a5
Instruction Fuzzy Hash: 14115236619F8881DB609B1AE89035EB7B1F7C9B94F505126EBCD87B69CF3DC5508B00

Function 00007FF626BFB970 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_Byte_length.LIBCPMTD ref: 00007FF626BFB9F6

Part of subcall function 00007FF626BFBBF0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF626BFBC1C

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID: Byte_lengthConcurrency::details::EmptyQueue::StructuredWork
String ID:
API String ID: 2180140624-0
Opcode ID: 3d721e314f6597f4f5539cc87ca23b51fab7460f1361a429639f5c59ef1ee461
Instruction ID: 5e4fbdcc0894039237dfced6cdda59558c2474b57812580e05ca10f95955940d
Opcode Fuzzy Hash: 3d721e314f6597f4f5539cc87ca23b51fab7460f1361a429639f5c59ef1ee461
Instruction Fuzzy Hash: 5C11F426518A8582DA50DB25F89119EB7A0FBC6780F901126FBCD83B6ADF3DD121CB40

Function 00007FF626BFBAA0 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF626BFBB70: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF626BFBB7E

_Byte_length.LIBCPMTD ref: 00007FF626BFBB26

Part of subcall function 00007FF626BFBBF0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF626BFBC1C

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID: Byte_lengthConcurrency::details::Concurrency::details::_CriticalEmptyLock::_Queue::ReentrantScoped_lockScoped_lock::~_StructuredWork
String ID:
API String ID: 3730899627-0
Opcode ID: 44c7796c75c25c5c7709d50e7aab81eaeec602659a9d168cd4e954b65d0e7a9e
Instruction ID: c9f6c50c48156af24194fbca227977f2abbb8fad5f1c1a6d79618912c4bcde73
Opcode Fuzzy Hash: 44c7796c75c25c5c7709d50e7aab81eaeec602659a9d168cd4e954b65d0e7a9e
Instruction Fuzzy Hash: 2311F426518A8582DA50DB25F89119EB7A0FBC6780FA01122FBCD83B6ADF3DD5218B40

Function 00007FF626BE7E40 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF626BE7E74

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork
String ID:
API String ID: 1865873047-0
Opcode ID: 30fd8099ffd4be0d4f69dd9a583985dde0d8b0850e5991a20b1c7c05a0df383f
Instruction ID: 0779bf6536f79ffaeb5f3ba3c379c5db21ac62f43032c1123d276d5b4eaa27a3
Opcode Fuzzy Hash: 30fd8099ffd4be0d4f69dd9a583985dde0d8b0850e5991a20b1c7c05a0df383f
Instruction Fuzzy Hash: DA117C66A18B4181DE20EB16E44036EA7A0FBC9BE8F440136EA8C87B69CF3DC154CB01

Function 000002733BE5ADC0 Relevance: 1.5, APIs: 1, Instructions: 38networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 000002733BE5AE08

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: af342f55a76444dc29af71e8fb4152a83f454f5b800a0383b076c9e997804f61
Instruction ID: d8f0fb811eedd9356c258f5d1edb8c8dfab08d2e6f3d226b188500ae3eb70904
Opcode Fuzzy Hash: af342f55a76444dc29af71e8fb4152a83f454f5b800a0383b076c9e997804f61
Instruction Fuzzy Hash: 2101D625719A8481DB60DF1AF944259A7A0F788FD4F48A275EF5D43B4CDF28C9918780

Function 00007FF626BEF6A0 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 00007FF626BEF721

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID: type_info::_name_internal_method
String ID:
API String ID: 3713626258-0
Opcode ID: 76e54cbdeb55244470ca4b8c1149c975881fede5f5229d85922bdbd701fbbbd6
Instruction ID: 28378cca5c87c73e039da788a1767962e735803cdf69517e4742f5e8893b0ed3
Opcode Fuzzy Hash: 76e54cbdeb55244470ca4b8c1149c975881fede5f5229d85922bdbd701fbbbd6
Instruction Fuzzy Hash: E4012A7662CB8681EB409B16E84022FA3A4FB96BC1F405071EACE87759CF3DD0208B41

Function 00007FF626BECD80 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF626BECDC2

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 5b003b8cca513f1d9bd291702dbd346b7f7ce6d2eb4d71e1a0a6965b61c62195
Instruction ID: e3db1f7b772bf09210fa7c6b77a2cfd73be0bb769386226dd66282437ffbbdd9
Opcode Fuzzy Hash: 5b003b8cca513f1d9bd291702dbd346b7f7ce6d2eb4d71e1a0a6965b61c62195
Instruction Fuzzy Hash: 95019266659F4181DE609B28E84071FA7A0FF89395F401230F69CC2BD5DF2DC0208701

Function 000002733BE158F3 Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 000002733BE15936

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: c09ff1b7f36846cd2f70e20038cef65db65028f9499b4e4cc306786389cb5efe
Instruction ID: 04ef76490035ad7a7363a8531cf0f2659a0151102e7791fbafe36c587174bde4
Opcode Fuzzy Hash: c09ff1b7f36846cd2f70e20038cef65db65028f9499b4e4cc306786389cb5efe
Instruction Fuzzy Hash: 2A014F2621CA8081EA70DB56F85839AA364F788B94F804162DE9D43B59DE38C986CB40

Function 00007FF626BFC9F0 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF626BFCA33

Part of subcall function 00007FF626BEA910: allocator.LIBCONCRTD ref: 00007FF626BEA92B

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWorkallocator
String ID:
API String ID: 1755220593-0
Opcode ID: 0be8727490954b9d9608c68c0c3e94e3c05ef35cc3da3c80f663008593293bb7
Instruction ID: 5f1fc35e5352a6628fa89165bc6a10494ff94fc14c5ff5ec8360657fa70025e9
Opcode Fuzzy Hash: 0be8727490954b9d9608c68c0c3e94e3c05ef35cc3da3c80f663008593293bb7
Instruction Fuzzy Hash: 09015E36619F8482CA60DB0AF89011EB7A4F7C9B94F504125FACD83B29DF3DD1608B00

Function 000002733BE6ED2C Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002733BE6ED4B

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8baf8acf487f5caa78a15ef12004ef049afcc069522c3c2ef46e844b516c0117
Instruction ID: 6d24227ea2afe2ffddcff32670a442bd9dc9770f4029a0fc538ea4e0ddb3248e
Opcode Fuzzy Hash: 8baf8acf487f5caa78a15ef12004ef049afcc069522c3c2ef46e844b516c0117
Instruction Fuzzy Hash: 2CE0D83121D64582EF35FBBDF14A3EC72649B147F0F144761B77C067C6DB2489506641

Function 00007FF626C35554 Relevance: 1.5, APIs: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF626C35584

Part of subcall function 00007FF626C364DC: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF626C364E5

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: eab2c86477353e2fdf37daf347e1d7af9a32534bc8376d8c7edc6a9f128f6aaa
Instruction ID: ad06cf292f84c72464603d1c5962e39cc80cef6f5c4a60051b8a8935f48c6f3f
Opcode Fuzzy Hash: eab2c86477353e2fdf37daf347e1d7af9a32534bc8376d8c7edc6a9f128f6aaa
Instruction Fuzzy Hash: AAE0EC40F4910B06FE2972AE5C251F911650F09770E6C2B30DD3EC96C7AD1EB4614712

Function 00007FF626BFBA40 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF626BFBA6A

Part of subcall function 00007FF626BF7FD0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF626BF80EF
Part of subcall function 00007FF626BF7FD0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF626BF8197

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_
String ID:
API String ID: 2443641946-0
Opcode ID: a00cf0b1ec4db13d273557ccddcb421bc2b4e8bce47aca48317bcbe3f147d040
Instruction ID: 396224714b8a4190fe83c19a76c0c42df09760bad7d12460af1e5c5e9f772e20
Opcode Fuzzy Hash: a00cf0b1ec4db13d273557ccddcb421bc2b4e8bce47aca48317bcbe3f147d040
Instruction Fuzzy Hash: D2F0DFB2518B8086CA60EB55F88111FB7A4FBC9794F001225FACD83B29DF7CC1208F44

Function 000002733BE997D0 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 000002733BE997D4

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 4177796e15072c585db232ab642f29accb6d05ea1f689265af403d42f2bb1474
Instruction ID: 717fd8699d57096374660320536d5769cf14e439064b1728802eab6b9aebf898
Opcode Fuzzy Hash: 4177796e15072c585db232ab642f29accb6d05ea1f689265af403d42f2bb1474
Instruction Fuzzy Hash: B8C04C15F1E505C1E664BBBA6C4A2861694BF54700F8042A0C20C84150D92C82965691

Function 00007FF626BEA910 Relevance: 1.5, APIs: 1, Instructions: 9COMMONLIBRARYCODE

Download Yara Rule

APIs

allocator.LIBCONCRTD ref: 00007FF626BEA92B

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID: allocator
String ID:
API String ID: 3447690668-0
Opcode ID: 69c9719d4dd52abe98a264028dc470e26ea7d52536d19f2f10ff87e1f9baad59
Instruction ID: 3df63913a5279f02becd880e8a4fd0994b3c731d0a6c4eaa1284c2b20c3f179b
Opcode Fuzzy Hash: 69c9719d4dd52abe98a264028dc470e26ea7d52536d19f2f10ff87e1f9baad59
Instruction Fuzzy Hash: E6C0C966A29B84C1CA04EB12F88100E7760F7C8BC1F809421EA9E43729DF28C0608B00

Function 000002733BE9B3C4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 000002733BE9B3CD

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 5d96549d17151685d9874b2efd5e6665c09aeaad6767ec6861ada1b691878f94
Instruction ID: eda5aba30bed3224d5181b29385bec63417c1bc2b45234399761854537b54a1a
Opcode Fuzzy Hash: 5d96549d17151685d9874b2efd5e6665c09aeaad6767ec6861ada1b691878f94
Instruction Fuzzy Hash: 14B09236A188C0C7C621FB08EC460497331FB94B0CFD00140E28D42A24CE2CCA2A8E40

Function 000002733BE7DEDC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 000002733BE7DF1A

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: ad1b43cdb7c3550550fd4afa13c905d117ea5c1f34bfd66f5f885cc22fb7391c
Instruction ID: 12633a23f204e74d528455e7c371e63feee2e3ece8e1b711927983196f74fd88
Opcode Fuzzy Hash: ad1b43cdb7c3550550fd4afa13c905d117ea5c1f34bfd66f5f885cc22fb7391c
Instruction Fuzzy Hash: 59F0A74131D24542FE78F7FA780E3E922905B44760F0897A07D7EC62C1DA2CC740B2D0

Function 00007FF626C264BC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000028,00007FF626C35573,?,?,?,00007FF626BE10A8), ref: 00007FF626C264FA

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 31f5e82480b86c694179d874989cf1b3d096565e770f3be7cb9178f83f4d8f72
Instruction ID: dcf7d6349862349369071f6c3afcb85a5389150d8145a8973178827ab9597781
Opcode Fuzzy Hash: 31f5e82480b86c694179d874989cf1b3d096565e770f3be7cb9178f83f4d8f72
Instruction Fuzzy Hash: F0F08250F0820746FE54777B9D1027921A05F487B0F186730DC6EC6ACADE1EE8408322

Function 00007FF626BE26C0 Relevance: 1.3, APIs: 1, Instructions: 17memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF626BE26F3

Memory Dump Source

Source File: 00000000.00000002.1929734759.00007FF626BE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF626BE0000, based on PE: true

Associated: 00000000.00000002.1929716093.00007FF626BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626C4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929780439.00007FF626EFD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929930984.00007FF626F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1929951695.00007FF626F0C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff626be0000_venomderek.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bb55d3c25760e0320b4c92f21841f287c01ac31988aa5e77e6438427710fe636
Instruction ID: 5621fc3fb768bfcaf1131298477aa18eab5d7d786d87de37454977692e0f370f
Opcode Fuzzy Hash: bb55d3c25760e0320b4c92f21841f287c01ac31988aa5e77e6438427710fe636
Instruction Fuzzy Hash: E0E0C976A18B8586DA20DB15E84031ABBB0F795785F600525EACD82B28CF7DC5648B40

Non-executed Functions

Function 000002733BE70D98 Relevance: 49.1, APIs: 25, Strings: 2, Instructions: 1888COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002733BE710CF
_invalid_parameter_noinfo.LIBCMT ref: 000002733BE71332
_invalid_parameter_noinfo.LIBCMT ref: 000002733BE715F5
_invalid_parameter_noinfo.LIBCMT ref: 000002733BE71895
memcpy_s.LIBCPMT ref: 000002733BE71AA2
memcpy_s.LIBCPMT ref: 000002733BE71B3E
memcpy_s.LIBCPMT ref: 000002733BE71FF6
memcpy_s.LIBCPMT ref: 000002733BE72031
memcpy_s.LIBCPMT ref: 000002733BE7215D
memcpy_s.LIBCPMT ref: 000002733BE72284
memcpy_s.LIBCPMT ref: 000002733BE7232F
memcpy_s.LIBCPMT ref: 000002733BE72377
memcpy_s.LIBCPMT ref: 000002733BE723A1
memcpy_s.LIBCPMT ref: 000002733BE72452
memcpy_s.LIBCPMT ref: 000002733BE72652
memcpy_s.LIBCPMT ref: 000002733BE72697
memcpy_s.LIBCPMT ref: 000002733BE7274E
memcpy_s.LIBCPMT ref: 000002733BE7287B
memcpy_s.LIBCPMT ref: 000002733BE71F46

Part of subcall function 000002733BE731E4: _invalid_parameter_noinfo.LIBCMT ref: 000002733BE73216

memcpy_s.LIBCPMT ref: 000002733BE71FC1
memcpy_s.LIBCPMT ref: 000002733BE72A35

Strings

, xrefs: 000002733BE727FB
, xrefs: 000002733BE72928

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: memcpy_s$_invalid_parameter_noinfo
String ID: $
API String ID: 2880407647-227171996
Opcode ID: df87294ae73204ead43c2230939cbb6a00851c436377c9d63da8146f7a05de15
Instruction ID: 73b54f69c65c17059b87955890657d8e1959155c8c50700f863093c3037acdd9
Opcode Fuzzy Hash: df87294ae73204ead43c2230939cbb6a00851c436377c9d63da8146f7a05de15
Instruction Fuzzy Hash: D403E1727182C08FE775DF29E9457EA37A1F745388F00525AEA0AA7B88D735DB00DB81

Function 000002733BE643F0 Relevance: 34.3, APIs: 18, Strings: 1, Instructions: 1015stringmemorynativeCOMMON

Download Yara Rule

APIs

RtlAcquirePebLock.NTDLL ref: 000002733BE64433
NtAllocateVirtualMemory.NTDLL ref: 000002733BE6446B
lstrcpyW.KERNEL32 ref: 000002733BE644CD
lstrcatW.KERNEL32 ref: 000002733BE64582
NtAllocateVirtualMemory.NTDLL ref: 000002733BE64609
lstrcpyW.KERNEL32 ref: 000002733BE646BC
RtlInitUnicodeString.NTDLL ref: 000002733BE646D1
RtlInitUnicodeString.NTDLL ref: 000002733BE646E6
LdrEnumerateLoadedModules.NTDLL ref: 000002733BE646F9
RtlReleasePebLock.NTDLL ref: 000002733BE646FF

Part of subcall function 000002733BE58E10: SHGetKnownFolderPath.SHELL32 ref: 000002733BE58E69
Part of subcall function 000002733BE58E10: CoTaskMemFree.OLE32 ref: 000002733BE58F2A

CoInitializeEx.OLE32 ref: 000002733BE647AA
lstrcpyW.KERNEL32 ref: 000002733BE64989
lstrcatW.KERNEL32 ref: 000002733BE64B8E
CoGetObject.OLE32 ref: 000002733BE64BAC
lstrcpyW.KERNEL32 ref: 000002733BE65229
lstrcatW.KERNEL32 ref: 000002733BE6544C
CoGetObject.OLE32 ref: 000002733BE6546A
CoUninitialize.OLE32 ref: 000002733BE65932

Strings

0, xrefs: 000002733BE6506A

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AllocateInitLockMemoryObjectStringUnicodeVirtual$AcquireEnumerateFolderFreeInitializeKnownLoadedModulesPathReleaseTaskUninitialize
String ID: 0
API String ID: 1424456515-4108050209
Opcode ID: 32f950ddc635add2d1699f42f6a400c0ae9954aa12fa602d547c74856b1e7a01
Instruction ID: f712de1dfeff121d014e077dea193f7b656c2b00e756b517ab621c21f9f509c6
Opcode Fuzzy Hash: 32f950ddc635add2d1699f42f6a400c0ae9954aa12fa602d547c74856b1e7a01
Instruction Fuzzy Hash: DAC2983662AF848AD790CF69E88169DB7B5F788B88F105219EECD57B18EF38C154C740

Function 000002733BDE6180 Relevance: 30.2, Strings: 24, Instructions: 238COMMON

Download Yara Rule

Strings

bootmgfw.efi, xrefs: 000002733BDE61F9
bootsect.bak, xrefs: 000002733BDE6246
ntuser.dat.log, xrefs: 000002733BDE632D
desktop.ini, xrefs: 000002733BDE626C
ntuser.ini, xrefs: 000002733BDE6359
bootmgr, xrefs: 000002733BDE655E
BOOTNXT, xrefs: 000002733BDE658D
bootstat.dat, xrefs: 000002733BDE6415
mib.bin, xrefs: 000002733BDE6444
winre.wim, xrefs: 000002733BDE6500
thumbs.db, xrefs: 000002733BDE6388
bootfont.bin, xrefs: 000002733BDE6220
winsipolicy.p7b, xrefs: 000002733BDE62B8
wpsettings.dat, xrefs: 000002733BDE64A2
boot.sdi, xrefs: 000002733BDE64D1
ntldr, xrefs: 000002733BDE6292
reagent.xml, xrefs: 000002733BDE652F
gdipfontcachev1.dat, xrefs: 000002733BDE63B7
iconcache.db, xrefs: 000002733BDE62DE
ntuser.dat, xrefs: 000002733BDE6304
autorun.inf, xrefs: 000002733BDE61A8
boot.ini, xrefs: 000002733BDE61D1
indexervolumeguid, xrefs: 000002733BDE6473
d3d9caps.dat, xrefs: 000002733BDE63E6

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: BOOTNXT$autorun.inf$boot.ini$boot.sdi$bootfont.bin$bootmgfw.efi$bootmgr$bootsect.bak$bootstat.dat$d3d9caps.dat$desktop.ini$gdipfontcachev1.dat$iconcache.db$indexervolumeguid$mib.bin$ntldr$ntuser.dat$ntuser.dat.log$ntuser.ini$reagent.xml$thumbs.db$winre.wim$winsipolicy.p7b$wpsettings.dat
API String ID: 118556049-850610325
Opcode ID: dea6d34053270f54165e7821960ee4cc20a6cc02140d0cf59d37aac2e2ba149c
Instruction ID: 8913f38113693468eff70c0a6833ff10f0091b9785a9efbe1aea1c40cc422234
Opcode Fuzzy Hash: dea6d34053270f54165e7821960ee4cc20a6cc02140d0cf59d37aac2e2ba149c
Instruction Fuzzy Hash: 06C16853E64FC984E731DB39EC913E95321FBEA384F616306A94C66856EB68D3C4C780

Function 000002733BDE5DB0 Relevance: 25.2, Strings: 20, Instructions: 202COMMON

Download Yara Rule

Strings

All users, xrefs: 000002733BDE6074
Program Files (x86), xrefs: 000002733BDE6101
bootmgr, xrefs: 000002733BDE60A3
Windows, xrefs: 000002733BDE5E01
$recycle.bin, xrefs: 000002733BDE5DD8
ProgramData, xrefs: 000002733BDE6045
Program Files, xrefs: 000002733BDE60D2
#recycle, xrefs: 000002733BDE5E29
ntldr, xrefs: 000002733BDE6016
AppData, xrefs: 000002733BDE5FE7
$windows.~bt, xrefs: 000002733BDE5F0E
$windows.~ws, xrefs: 000002733BDE5F89
$winreagent, xrefs: 000002733BDE5F5D
Windows.~bt, xrefs: 000002733BDE5FB8
Boot, xrefs: 000002733BDE5E50
Application Data, xrefs: 000002733BDE5E9C
PerfLogs, xrefs: 000002733BDE5F34
System Volume Information, xrefs: 000002733BDE5E76
Windows.old, xrefs: 000002733BDE5EE8
config.msi, xrefs: 000002733BDE5EC2

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: #recycle$$recycle.bin$$windows.~bt$$windows.~ws$$winreagent$All users$AppData$Application Data$Boot$PerfLogs$Program Files$Program Files (x86)$ProgramData$System Volume Information$Windows$Windows.old$Windows.~bt$bootmgr$config.msi$ntldr
API String ID: 118556049-2722463023
Opcode ID: b349f0743e28fad41dd0cf6d04c419ecc5bc303b8eb5692233894048f4044c83
Instruction ID: 2f46dc3a0e69354ec60483291bcb4e1918e2cb6e807402c62415f7e54a347e63
Opcode Fuzzy Hash: b349f0743e28fad41dd0cf6d04c419ecc5bc303b8eb5692233894048f4044c83
Instruction Fuzzy Hash: 34A16A53E64FC984E721DB39EC813E95321FBEA384F616306B58C66956EB68D3C4C780

Function 000002733BE2E320 Relevance: 24.1, APIs: 2, Strings: 11, Instructions: 1388COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE2FA31
Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE2FB06

Strings

#include, xrefs: 000002733BE2ED8A
#base, xrefs: 000002733BE2EDB6
unexpected key without object, xrefs: 000002733BE2FA0A
key declared, but no value, xrefs: 000002733BE2F97D, 000002733BE2F9A4, 000002733BE2FAB8
Unexpected eof, xrefs: 000002733BE2F902
No closed word, xrefs: 000002733BE2FA37, 000002733BE2FA5E
quote was opened but not closed., xrefs: 000002733BE2F956, 000002733BE2F9CB
word wasnt properly ended, xrefs: 000002733BE2FA85, 000002733BE2FB0C
unexpected '}', xrefs: 000002733BE2FB33
key opened, but never closed, xrefs: 000002733BE2FADF
object is not closed with '}', xrefs: 000002733BE2F92F

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: #base$#include$No closed word$Unexpected eof$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 118556049-1838291449
Opcode ID: 1eae8de794e03fd13853270179dbff7d78e1c17fe90ce638cf8561d323380b6d
Instruction ID: e231d4db12f75c105036c4ad04ee758a193e482ea5727d3e3bceb516b2ee8288
Opcode Fuzzy Hash: 1eae8de794e03fd13853270179dbff7d78e1c17fe90ce638cf8561d323380b6d
Instruction Fuzzy Hash: D9E28F62609BC485EB70EF29E8583DC23A1F749798F445252DA8D0FA99DF78C785E380

Function 000002733BE63CF0 Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 351nativelibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 000002733BE63D36
GetProcAddress.KERNEL32 ref: 000002733BE63D46
OpenProcess.KERNEL32 ref: 000002733BE63D78
NtQuerySystemInformation.NTDLL ref: 000002733BE63DA0
NtQuerySystemInformation.NTDLL ref: 000002733BE63DCE
GetCurrentProcess.KERNEL32 ref: 000002733BE63E93
NtQueryObject.NTDLL ref: 000002733BE63ED9
GetFinalPathNameByHandleA.KERNEL32 ref: 000002733BE63FCD
CloseHandle.KERNEL32 ref: 000002733BE640E8
CloseHandle.KERNEL32 ref: 000002733BE64178

Strings

NtDuplicateObject, xrefs: 000002733BE63D3F
File, xrefs: 000002733BE63F0A
ntdll.dll, xrefs: 000002733BE63D2F

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Handle$Query$CloseInformationProcessSystem$AddressCurrentFinalModuleNameObjectOpenPathProc
String ID: File$NtDuplicateObject$ntdll.dll
API String ID: 2729825427-3955674919
Opcode ID: e73f351450d56223bf4f72c0c3e8cb8fdb1fb8073cfcdec0185471134d98f972
Instruction ID: 2813ef3589df1f1c604ef8e476f376129fe75ae669d3b186a6f8f086e51656b9
Opcode Fuzzy Hash: e73f351450d56223bf4f72c0c3e8cb8fdb1fb8073cfcdec0185471134d98f972
Instruction Fuzzy Hash: 20E1C763B18B4489FB20EB69E4183ED37B1E785B98F008251DE5D57B99DF38C649E380

Function 000002733BE4F040 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 218COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32 ref: 000002733BE4F09F

Strings

@, xrefs: 000002733BE4F226

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Initialize
String ID: @
API String ID: 2538663250-2766056989
Opcode ID: 5d8e7ad81b0fcc374419499b8eac6586b7246bad0c5703c9b4cf51271faea9e0
Instruction ID: 137929aca04e7eee2f791de7256311ab89293bed0da08df450c5a5f855fc86c2
Opcode Fuzzy Hash: 5d8e7ad81b0fcc374419499b8eac6586b7246bad0c5703c9b4cf51271faea9e0
Instruction Fuzzy Hash: 75A16B32B08A408AE720EF69E4587ED77A1FB88B88F004755DE5E53A94DF38C294D3C4

Function 000002733BE551E0 Relevance: 21.5, APIs: 1, Strings: 11, Instructions: 465COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32 ref: 000002733BE55767

Strings

runas, xrefs: 000002733BE556E6
.exe, xrefs: 000002733BE55245
.vbs, xrefs: 000002733BE552D2
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;', xrefs: 000002733BE55374
.ps1, xrefs: 000002733BE55274
ios_base::badbit set, xrefs: 000002733BE5597A
ios_base::eofbit set, xrefs: 000002733BE5598C
ios_base::failbit set, xrefs: 000002733BE55985
.exe, xrefs: 000002733BE5532D
open, xrefs: 000002733BE556DD
.cmd, xrefs: 000002733BE552A3

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: .cmd$.exe$.exe$.ps1$.vbs$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;'$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$open$runas
API String ID: 587946157-4093014531
Opcode ID: d4e8431afe3376545c53f37e1320ae35648a1dab89cf9caa113fe4c0557abcf9
Instruction ID: 79742c3653cf858276c7b845fbca55420d12127b4cd099e01570d7242d9208ff
Opcode Fuzzy Hash: d4e8431afe3376545c53f37e1320ae35648a1dab89cf9caa113fe4c0557abcf9
Instruction Fuzzy Hash: B522B273A14B8085EB20EF28F8483DD37A1F785798F505356EA6D47AA9DF78C684D380

Function 000002733BE64740 Relevance: 16.6, APIs: 8, Strings: 1, Instructions: 839stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000002733BE643F0: RtlAcquirePebLock.NTDLL ref: 000002733BE64433
Part of subcall function 000002733BE643F0: NtAllocateVirtualMemory.NTDLL ref: 000002733BE6446B
Part of subcall function 000002733BE643F0: lstrcpyW.KERNEL32 ref: 000002733BE644CD
Part of subcall function 000002733BE643F0: lstrcatW.KERNEL32 ref: 000002733BE64582

CoInitializeEx.OLE32 ref: 000002733BE647AA
lstrcpyW.KERNEL32 ref: 000002733BE64989
lstrcatW.KERNEL32 ref: 000002733BE64B8E
CoGetObject.OLE32 ref: 000002733BE64BAC
lstrcpyW.KERNEL32 ref: 000002733BE65229
lstrcatW.KERNEL32 ref: 000002733BE6544C
CoGetObject.OLE32 ref: 000002733BE6546A
CoUninitialize.OLE32 ref: 000002733BE65932

Strings

0, xrefs: 000002733BE6506A

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: lstrcatlstrcpy$Object$AcquireAllocateInitializeLockMemoryUninitializeVirtual
String ID: 0
API String ID: 3636535045-4108050209
Opcode ID: 148f1cac526a25eedb59746f716de0c0cfa115320cfb54a3382c2084b1ee678e
Instruction ID: 1401ede1d51750529cdf60296b62f0c745b2bd654d817248219bbbcbc7eada97
Opcode Fuzzy Hash: 148f1cac526a25eedb59746f716de0c0cfa115320cfb54a3382c2084b1ee678e
Instruction Fuzzy Hash: 90B2963662AFC48AD7908F69F88165EB7B4F788B88B106215FECD57B18EB38C154C740

Function 000002733BE5AE50 Relevance: 13.2, APIs: 2, Strings: 4, Instructions: 2695COMMON

Download Yara Rule

Strings

cannot compare iterators of different containers, xrefs: 000002733BE5E43F, 000002733BE5E4EF, 000002733BE5E61F
value, xrefs: 000002733BE5B688
type must be string, but is , xrefs: 000002733BE5E3FD, 000002733BE5E4AD, 000002733BE5E571, 000002733BE5E5CB
cannot use push_back() with , xrefs: 000002733BE5E393

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: cannot compare iterators of different containers$cannot use push_back() with $type must be string, but is $value
API String ID: 118556049-2711811579
Opcode ID: bdac1862b3103ddd7eebdf4cf225da5ffd56aea09f18ced9723e213cf3d00643
Instruction ID: 11018bdc34b39522551c0b51a4e18341a209eb923dda8de6084a2dcfff8c6933
Opcode Fuzzy Hash: bdac1862b3103ddd7eebdf4cf225da5ffd56aea09f18ced9723e213cf3d00643
Instruction Fuzzy Hash: 43536872604BC489EB70EF28E8843DD33A5F745798F509652DA9D5BA9AEF34C384D380

Function 000002733BE86F14 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000002733BE781FC: GetLastError.KERNEL32 ref: 000002733BE7820B
Part of subcall function 000002733BE781FC: FlsGetValue.KERNEL32 ref: 000002733BE78220
Part of subcall function 000002733BE781FC: SetLastError.KERNEL32 ref: 000002733BE782AB

TranslateName.LIBCMT ref: 000002733BE86F7E
TranslateName.LIBCMT ref: 000002733BE86FB9
GetACP.KERNEL32 ref: 000002733BE87000
IsValidCodePage.KERNEL32 ref: 000002733BE87038
GetLocaleInfoW.KERNEL32 ref: 000002733BE871F5

Strings

utf8, xrefs: 000002733BE8711C

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: 4309449c26b629e9b6de698707476955217e9cbe9722d2e68f3c85218e94a805
Instruction ID: caddb817527bea916d2f0afaf9585ede10dc08bdca8307772d3b6a4739476ec3
Opcode Fuzzy Hash: 4309449c26b629e9b6de698707476955217e9cbe9722d2e68f3c85218e94a805
Instruction Fuzzy Hash: CB91AC32208B548AEB35FF69F8493D923A4EB44F81F4482A59E5D87B95DB38C651F3C0

Function 000002733BE8795C Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000002733BE781FC: GetLastError.KERNEL32 ref: 000002733BE7820B
Part of subcall function 000002733BE781FC: FlsGetValue.KERNEL32 ref: 000002733BE78220
Part of subcall function 000002733BE781FC: SetLastError.KERNEL32 ref: 000002733BE782AB

Part of subcall function 000002733BE781FC: FlsSetValue.KERNEL32 ref: 000002733BE78241

GetUserDefaultLCID.KERNEL32 ref: 000002733BE87ACC

Part of subcall function 000002733BE781FC: FlsSetValue.KERNEL32 ref: 000002733BE7826E
Part of subcall function 000002733BE781FC: FlsSetValue.KERNEL32 ref: 000002733BE7827F
Part of subcall function 000002733BE781FC: FlsSetValue.KERNEL32 ref: 000002733BE78290

EnumSystemLocalesW.KERNEL32 ref: 000002733BE87AB3
ProcessCodePage.LIBCMT ref: 000002733BE87AF6
IsValidCodePage.KERNEL32 ref: 000002733BE87B08
IsValidLocale.KERNEL32 ref: 000002733BE87B1E
GetLocaleInfoW.KERNEL32 ref: 000002733BE87B7A
GetLocaleInfoW.KERNEL32 ref: 000002733BE87B96

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 5eb0d27aa7dc3a9912447742f13a9ce850b1caaedf69b48f01ffc0c9247ee539
Instruction ID: 847f52b61a5241eeaa2636f3ecb27d894f9d3c564528bd539db89b9951277d01
Opcode Fuzzy Hash: 5eb0d27aa7dc3a9912447742f13a9ce850b1caaedf69b48f01ffc0c9247ee539
Instruction Fuzzy Hash: 2871AE22708A208AFB31FB68E8587EC37A1BB44B45F4446958E1D93795EB38CB45F3D0

Function 000002733BE44710 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 000002733BE448C4
__std_exception_destroy.LIBVCRUNTIME ref: 000002733BE448D2
__std_exception_destroy.LIBVCRUNTIME ref: 000002733BE44B55
__std_exception_destroy.LIBVCRUNTIME ref: 000002733BE44B63

Strings

value, xrefs: 000002733BE447EA, 000002733BE44A83

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: d8079469438c76c455d78d95ed1c5fb7a9ae88cd4ed4e617ee21c392c85c9ee3
Instruction ID: 9de941b250da5df071380d4dc1a56649f13a9837f6c3ff8f3c85f7a77f9fe18f
Opcode Fuzzy Hash: d8079469438c76c455d78d95ed1c5fb7a9ae88cd4ed4e617ee21c392c85c9ee3
Instruction Fuzzy Hash: 78028023618BC085EB20EB78E4883DD6761E7857A4F505345FAAD46AEADF78C285D380

Function 000002733BE6F920 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 000002733BE6F999
RtlLookupFunctionEntry.KERNEL32 ref: 000002733BE6F9B1
RtlVirtualUnwind.KERNEL32 ref: 000002733BE6F9EC
IsDebuggerPresent.KERNEL32 ref: 000002733BE6FA25
SetUnhandledExceptionFilter.KERNEL32 ref: 000002733BE6FA2F
UnhandledExceptionFilter.KERNEL32 ref: 000002733BE6FA3A

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: c7f70f128318b326f672a7b0d6647dc5eb587961ea58d1b4d09a7c2ba848fd84
Instruction ID: 69294fc8e5774aa94c573d751a352c2795c8d29c041eba812c19b1cfd2c18c52
Opcode Fuzzy Hash: c7f70f128318b326f672a7b0d6647dc5eb587961ea58d1b4d09a7c2ba848fd84
Instruction Fuzzy Hash: AB316D32208F8086DB60DF29F8543DE77A4F788758F500256EA9D83BA9DF38C255CB80

Function 000002733BE19090 Relevance: 8.4, Strings: 6, Instructions: 916COMMON

Download Yara Rule

Strings

directory_iterator::directory_iterator, xrefs: 000002733BE1A1D4
key, xrefs: 000002733BE195ED, 000002733BE197CD
files, xrefs: 000002733BE19EE5
filename, xrefs: 000002733BE19BE9
exists, xrefs: 000002733BE1A167, 000002733BE1A182
content, xrefs: 000002733BE19D62

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID: content$directory_iterator::directory_iterator$exists$filename$files$key
API String ID: 0-2980817763
Opcode ID: 833d3c7573def018ecc169852d0d824ba7ec02980bf308f9684f5db428169dd9
Instruction ID: a527d82c5cc210697095804116ea88d6f071e51f9775dc1390315a1335c51667
Opcode Fuzzy Hash: 833d3c7573def018ecc169852d0d824ba7ec02980bf308f9684f5db428169dd9
Instruction Fuzzy Hash: D5A23772615BC489DB30EF28E8883DD73A4F799758F505715EAAD0BA99EB74C380D380

Function 000002733BE17B8D Relevance: 7.4, Strings: 5, Instructions: 1142COMMON

Download Yara Rule

Strings

users, xrefs: 000002733BE18522
filename, xrefs: 000002733BE17E06, 000002733BE1818E, 000002733BE18A22
config, xrefs: 000002733BE17F9D
content, xrefs: 000002733BE17E5F, 000002733BE181E7, 000002733BE18B04
status, xrefs: 000002733BE19027

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID: config$content$filename$status$users
API String ID: 0-2677590375
Opcode ID: f539712530b03446ac0b0426c38f7a64498a735a0b888b08579129151238c1ba
Instruction ID: 67b2ad6baf973966f1d3123528061c01b98dbdd03de30ac712dccc525c90255f
Opcode Fuzzy Hash: f539712530b03446ac0b0426c38f7a64498a735a0b888b08579129151238c1ba
Instruction Fuzzy Hash: 2AC25F62614BC489DB30EF39E8483DD63A1F789798F505352DA9D4BA9AEF38C744D380

Function 000002733BE9BB14 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002733BE9BB75
IsDebuggerPresent.KERNEL32 ref: 000002733BE9BB8D
OutputDebugStringW.KERNEL32 ref: 000002733BE9BB9E

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 000002733BE9BB97

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: e8ffe009acab376759065dd43441e42d099b308a5e20a56206d0bc25ee25ae09
Instruction ID: 1d5d293278318b6a6540fcdfddbe4eb7fbf5da18cad944f0100dc9825650e4af
Opcode Fuzzy Hash: e8ffe009acab376759065dd43441e42d099b308a5e20a56206d0bc25ee25ae09
Instruction Fuzzy Hash: 67117032719B40A7F724EB2AF6983E933A4FB44344F404265C64D83A95EF38D6B8D790

Function 000002733BE102E0 Relevance: 7.0, Strings: 5, Instructions: 747COMMON

Download Yara Rule

Strings

directory_iterator::directory_iterator, xrefs: 000002733BE10F42, 000002733BE10F92
filename, xrefs: 000002733BE1088E
exists, xrefs: 000002733BE10F26
content, xrefs: 000002733BE10946
status, xrefs: 000002733BE10F58, 000002733BE10F6E

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: __std_fs_convert_wide_to_narrow$__std_fs_code_page
String ID: content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 3645842244-3429737954
Opcode ID: 2bd8e771037fae78b4a7704eae2c65f1f390640e78d4026f0107fdfd41d83f2b
Instruction ID: bb68f81b390c724ebc8213bc7e3dd4c3f5719db616c0cb6238491b596cb46515
Opcode Fuzzy Hash: 2bd8e771037fae78b4a7704eae2c65f1f390640e78d4026f0107fdfd41d83f2b
Instruction Fuzzy Hash: 38727F32605BC489EB71EF39E8843DD6360F789798F549311DA8D47AAAEF74C684D380

Function 000002733BE77348 Relevance: 6.1, APIs: 4, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 000002733BE7739F
GetSystemInfo.KERNEL32 ref: 000002733BE773B8
VirtualAlloc.KERNEL32 ref: 000002733BE77426
VirtualProtect.KERNEL32 ref: 000002733BE77441

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: 324fd5cd604fef47d1152131e1f7c01459585a6c12e9a2e3e67a5e0172bc20d3
Instruction ID: e27b04fcc33e3e72d434f0e10d1a4a3eb4dd99acd03f6a48c0b28c4b65471aec
Opcode Fuzzy Hash: 324fd5cd604fef47d1152131e1f7c01459585a6c12e9a2e3e67a5e0172bc20d3
Instruction Fuzzy Hash: E5316F32314A809EDB20DF35E8587D937A5F748B88F544125EE4D87B58DF38D645E780

Function 000002733BE8DC18 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000002733BE8DC44
GetCurrentThreadId.KERNEL32 ref: 000002733BE8DC52
GetCurrentProcessId.KERNEL32 ref: 000002733BE8DC5E
QueryPerformanceCounter.KERNEL32 ref: 000002733BE8DC6E

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: f06392d29159ea5021ae0933302a5494cfde722d0989828b5d6bd782ea4d1856
Instruction ID: acca0e27b4797934073b2dcd3129aa73f8c2150453125b2fe47418c44e8d476d
Opcode Fuzzy Hash: f06392d29159ea5021ae0933302a5494cfde722d0989828b5d6bd782ea4d1856
Instruction Fuzzy Hash: 64112A26B19F008AEB10EF64EC593E833A4F759758F441E25EE6D867A4DF78C2549380

Function 000002733BE48950 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 376COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002733BE48BAE

Strings

value, xrefs: 000002733BE498D3
parse_error, xrefs: 000002733BE489DE

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: __std_exception_copy
String ID: parse_error$value
API String ID: 592178966-1739288027
Opcode ID: 39d835905aa6b7c2ed12fb8f3e31f8b5b762354f030d9cb89747d84211925f6d
Instruction ID: 201e7753f1036f35c38e09899a510608003fd0b3aba7479aba881bec3ce5ac3d
Opcode Fuzzy Hash: 39d835905aa6b7c2ed12fb8f3e31f8b5b762354f030d9cb89747d84211925f6d
Instruction Fuzzy Hash: BEF12962B18A8085EB20EF78F8593DD2362F795798F505342EA5C53ADADF78C684D3C0

Function 000002733BE1A1F0 Relevance: 5.6, Strings: 4, Instructions: 609COMMON

Download Yara Rule

Strings

directory_iterator::directory_iterator, xrefs: 000002733BE1AC83
filename, xrefs: 000002733BE1A7A9
exists, xrefs: 000002733BE1AC67
content, xrefs: 000002733BE1A94F

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID: content$directory_iterator::directory_iterator$exists$filename
API String ID: 0-1400943384
Opcode ID: 4bd146e3f36fd3e06c7fbe5575cde876809c13f6274d8d983ab17c912c2d9fa6
Instruction ID: 2da8ce88ca9137b16870a2e2986112e6b7737bccdf9e32ce27add0a95c35935e
Opcode Fuzzy Hash: 4bd146e3f36fd3e06c7fbe5575cde876809c13f6274d8d983ab17c912c2d9fa6
Instruction Fuzzy Hash: 88527D72618BC489EB20EF29E8443ED73A1F789798F505311EA9D47B99EF78C644D380

Function 000002733BE6B68A Relevance: 5.6, Strings: 4, Instructions: 563COMMON

Download Yara Rule

Strings

object separator, xrefs: 000002733BE6BBD4, 000002733BE6BF1E
object, xrefs: 000002733BE6BE66
array, xrefs: 000002733BE6BDAE
object key, xrefs: 000002733BE6BC80, 000002733BE6BFD6

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: array$object$object key$object separator
API String ID: 2453523683-2277530871
Opcode ID: 43f70c2747cb064c93220a075d88978496723fb5864f4b085be8b831dc7a4b29
Instruction ID: c853c7a65ab766278d22aeeddd61f9bc580ec52499ec3d84b47622b4a0b230a7
Opcode Fuzzy Hash: 43f70c2747cb064c93220a075d88978496723fb5864f4b085be8b831dc7a4b29
Instruction Fuzzy Hash: C932F86262CA8496EB20FF38E4493ED6361F796784F802752EA4D4769AEF74C744D3C0

Function 000002733BE819B8 Relevance: 5.5, APIs: 3, Instructions: 1005COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002733BE81DEE
_get_daylight.LIBCMT ref: 000002733BE81E89
_get_daylight.LIBCMT ref: 000002733BE81EA2

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: 3362572290862af57679fdc4baef7ebaaf60df3fe4e64099d27ff34f0326e21c
Instruction ID: 8539e98f91f13f7aa30448969d1cf00512b1550f2354a0df5cc4c94123682a01
Opcode Fuzzy Hash: 3362572290862af57679fdc4baef7ebaaf60df3fe4e64099d27ff34f0326e21c
Instruction Fuzzy Hash: 2C92D337608A4086EB74EF28E5583E937A1F749F86F144295DB8D87B94DB39CA10E3C1

Function 000002733BE99480 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32 ref: 000002733BE994A6
FormatMessageA.KERNEL32 ref: 000002733BE994D9

Strings

!x-sys-default-locale, xrefs: 000002733BE99499

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: f19c835850623712fbca22d426e0c2013945c380ca8add72a55f3f09a2f97b50
Instruction ID: bcaa18581c9a2854d21d87e4d75ba3b12c44136e2215fb574a08edef1ffe3d48
Opcode Fuzzy Hash: f19c835850623712fbca22d426e0c2013945c380ca8add72a55f3f09a2f97b50
Instruction Fuzzy Hash: 64018072B0878082E731DB16F458BDA77A1F384784F444265DA8D46B94CB3CC644D780

Function 000002733BE72CD0 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 000002733BE72D36
memcpy_s.LIBCPMT ref: 000002733BE72D61

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: e899307af8ea146bffc4d3d3e4071cf966dfaa801a3502f7d3bb1face14528cf
Instruction ID: 95680927bad3c0742a88d3d8b918976a6526ed9092da4deaa095e6a3b749b1cc
Opcode Fuzzy Hash: e899307af8ea146bffc4d3d3e4071cf966dfaa801a3502f7d3bb1face14528cf
Instruction Fuzzy Hash: 87C1267271828587EB74DF19F049BAAB7A1F385B84F448325EB4E47744DB39DA01DB80

Function 000002733BE873D8 Relevance: 4.7, APIs: 3, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 000002733BE781FC: GetLastError.KERNEL32 ref: 000002733BE7820B
Part of subcall function 000002733BE781FC: FlsGetValue.KERNEL32 ref: 000002733BE78220
Part of subcall function 000002733BE781FC: SetLastError.KERNEL32 ref: 000002733BE782AB

Part of subcall function 000002733BE781FC: FlsSetValue.KERNEL32 ref: 000002733BE78241

GetLocaleInfoW.KERNEL32 ref: 000002733BE87444

Part of subcall function 000002733BE6DEA0: _invalid_parameter_noinfo.LIBCMT ref: 000002733BE6DEBD

GetLocaleInfoW.KERNEL32 ref: 000002733BE8748D

Part of subcall function 000002733BE6DEA0: _invalid_parameter_noinfo.LIBCMT ref: 000002733BE6DF16

GetLocaleInfoW.KERNEL32 ref: 000002733BE87555

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
String ID:
API String ID: 1791019856-0
Opcode ID: 90d945be40b20d5b5a3c3d7ca8cbaa30e5ffd7f5627642ea07c20393f480da84
Instruction ID: 9b454a990885861a22375fd91e8e5e0cd05888dd211e89eeee020f1aafabe6e7
Opcode Fuzzy Hash: 90d945be40b20d5b5a3c3d7ca8cbaa30e5ffd7f5627642ea07c20393f480da84
Instruction Fuzzy Hash: 2061C232208A518AEB34EF19F5443D973A1F794B42F448265CBAED36D1DB38CA51E7C0

Function 000002733BE506A6 Relevance: 4.4, Strings: 3, Instructions: 653COMMON

Download Yara Rule

Strings

2OWqJZldB3s=, xrefs: 000002733BE507D1
port, xrefs: 000002733BE5135F
rXwr2/Mp0kvTmn+hdCWeFmDWltFpcKXkn/UOvH+3cNE=, xrefs: 000002733BE50749

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID: 2OWqJZldB3s=$port$rXwr2/Mp0kvTmn+hdCWeFmDWltFpcKXkn/UOvH+3cNE=
API String ID: 0-1454942929
Opcode ID: ba2a10dd3913f3c332fd5c3c90ebe30a568b94afc7d9096fa0730c63614e1e9a
Instruction ID: 99b0add7a8d9843864a116a802740c3f2ac9809dc73857efc01a71428470e754
Opcode Fuzzy Hash: ba2a10dd3913f3c332fd5c3c90ebe30a568b94afc7d9096fa0730c63614e1e9a
Instruction Fuzzy Hash: B2724D62629BC485EA70DB29F4443DAB3A4F7D9784F506316EBCD13B59EB38C285CB40

Function 000002733BE7E6F8 Relevance: 3.9, Strings: 3, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 000002733BE7E882
-, xrefs: 000002733BE7E857
e+000, xrefs: 000002733BE7E805

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID: -$e+000$gfff
API String ID: 0-2620144452
Opcode ID: 98053ffb1976fa170abe9b1bb0e1772ad042855cb6c6921980abe163712f36bc
Instruction ID: 3ab80afbf6a4099c1a8ccefd64899ca63414a4a3a159ddbf10c09eabc9e8f716
Opcode Fuzzy Hash: 98053ffb1976fa170abe9b1bb0e1772ad042855cb6c6921980abe163712f36bc
Instruction Fuzzy Hash: 715158227186C847F734DF3DE80A7997B95E344B94F0883A1EBA84BAC5CB39C6459740

Function 000002733BE16130 Relevance: 3.9, Strings: 2, Instructions: 1357COMMON

Download Yara Rule

Strings

Software, xrefs: 000002733BE165AD, 000002733BE1677B
exists, xrefs: 000002733BE17701

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID: Software$exists
API String ID: 0-2364128853
Opcode ID: 761ced2a65119f44101c2f14138bdfa80631db8d7e5de70251e0e18ca2b171f4
Instruction ID: 9f9359f73af267f25e77d830ee5e42db3d0dc363184b12c5b8f7d08299f9b807
Opcode Fuzzy Hash: 761ced2a65119f44101c2f14138bdfa80631db8d7e5de70251e0e18ca2b171f4
Instruction Fuzzy Hash: 71D28F72A14BC48AEB20DF29E8443DD73A0F789B98F205311EA9D57B99DF74C681D380

Function 000002733BE286D0 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 311COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE28843

Strings

vector<bool> too long, xrefs: 000002733BE286D4

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: vector<bool> too long
API String ID: 118556049-842332957
Opcode ID: 5e5dad2012ea5acabc522e9de574ed675c6e8c918c03473d29ea86333b560bd6
Instruction ID: 3190f11d8a4555b21f2281523336b80b238949e59261f205e7902b6e0a2a57a9
Opcode Fuzzy Hash: 5e5dad2012ea5acabc522e9de574ed675c6e8c918c03473d29ea86333b560bd6
Instruction Fuzzy Hash: 4EC1E323A18B8489EB20EF29E8043ED7360F799798F145352EE9C17B99DF34D681D780

Function 000002733BE2E130 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 310COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE2E314

Strings

conditional not closed, xrefs: 000002733BE2E2CE, 000002733BE2E2F1

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: conditional not closed
API String ID: 118556049-2481790218
Opcode ID: a092b3c905e44d2a0e2adb6f822cad285ab4fe952a7320ad46965cb85d2a1130
Instruction ID: 916bcb9b3c61c36515f86776862cb19471b5985ea27409a91403674d2a735136
Opcode Fuzzy Hash: a092b3c905e44d2a0e2adb6f822cad285ab4fe952a7320ad46965cb85d2a1130
Instruction Fuzzy Hash: 6DD19032609B9884EB30EF28F8443ED77A4F759784F515352EA8D0BB99DB78C680D380

Function 000002733BE7C1A8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 000002733BE7C21C

Strings

GetLocaleInfoEx, xrefs: 000002733BE7C1C4, 000002733BE7C1D5

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 0fc81d44bec917c2802c26d4724ac6a513cb7d03bb6cf24fcfbb40603345bdc0
Instruction ID: bfe2e4e3b8e17e91ae01249697c9ebc0ac884ff071b54e4a4786397d5c6a94ca
Opcode Fuzzy Hash: 0fc81d44bec917c2802c26d4724ac6a513cb7d03bb6cf24fcfbb40603345bdc0
Instruction Fuzzy Hash: 2D01A72170CA9086EB10EB5EB4082CAA764EB84BD0F544266EF4D03B55CE3CC74197C0

Function 000002733BE56760 Relevance: 3.4, APIs: 2, Instructions: 391COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 000002733BE567C3
ShellExecuteW.SHELL32 ref: 000002733BE56E0A

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: ExecuteFileModuleNameShell
String ID:
API String ID: 1703432166-0
Opcode ID: 2b440cbbc29e2f737a28ae711106fe06bd577105ffad854fe73dfa4e0e149c9e
Instruction ID: 0dddbfb3c0adfb426a40b69ce312910a2dff84dda7fba5030e3e51ff5cda8ac3
Opcode Fuzzy Hash: 2b440cbbc29e2f737a28ae711106fe06bd577105ffad854fe73dfa4e0e149c9e
Instruction Fuzzy Hash: 71121A72629FC48AEB50CF29E88469EB3A4F788798F505215FEDD57B58EB38C250C740

Function 000002733BE7F7F4 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 000002733BE7FA43
RaiseException.KERNEL32 ref: 000002733BE7FA54

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 57a16f90b848e9bfce21c4af82cc5806e79d9fd20c8b8e6b755f3e4c735a4a33
Instruction ID: dbb7ca100a008a5bb214b79e82f562ebd642e44fc4c38d3cdb12bc09e1018345
Opcode Fuzzy Hash: 57a16f90b848e9bfce21c4af82cc5806e79d9fd20c8b8e6b755f3e4c735a4a33
Instruction Fuzzy Hash: B0B14E73604B848BEB25DF2DD44A39C7BA0F384B48F158A51EBAD877A8CB39C551D780

Function 000002733BE8A438 Relevance: 3.2, APIs: 2, Instructions: 208COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002733BE8A4DD
_invalid_parameter_noinfo.LIBCMT ref: 000002733BE8A69F

Part of subcall function 000002733BE7BBB8: HeapAlloc.KERNEL32 ref: 000002733BE7BC0D

Part of subcall function 000002733BE7B550: HeapFree.KERNEL32 ref: 000002733BE7B566
Part of subcall function 000002733BE7B550: GetLastError.KERNEL32 ref: 000002733BE7B570

Part of subcall function 000002733BE8BBA4: _invalid_parameter_noinfo.LIBCMT ref: 000002733BE8BBD7

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: ErrorHeapLast_invalid_parameter_noinfo$AllocFree
String ID:
API String ID: 749460637-0
Opcode ID: e4bbda4b5f8ad799fda78e60f613521156d14bb6a0c8542167753a01ce82eeb7
Instruction ID: e1a33de5570a956f1b2cc2bb6c78c17a02ddbf6f9f5df86051fff0cc59b36022
Opcode Fuzzy Hash: e4bbda4b5f8ad799fda78e60f613521156d14bb6a0c8542167753a01ce82eeb7
Instruction Fuzzy Hash: 65613B21309A4142F731EF2EB4197DE7391BB84FC1F44A665AE4D87B89EE38C641A7C0

Function 000002733BE60500 Relevance: 3.2, APIs: 2, Instructions: 187COMMON

Download Yara Rule

APIs

EnumDisplayDevicesW.USER32 ref: 000002733BE60617
EnumDisplayDevicesW.USER32 ref: 000002733BE606BB

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: DevicesDisplayEnum
String ID:
API String ID: 2211661463-0
Opcode ID: dae9a20b671f3fdb57962e76ab31133efb3a4fe43fd7e5f46b885fb615cc4ba8
Instruction ID: 3e6ca2dbc67744136fbba2a32f55985fafb1c4cd353bb7ac705d4ccce211ef55
Opcode Fuzzy Hash: dae9a20b671f3fdb57962e76ab31133efb3a4fe43fd7e5f46b885fb615cc4ba8
Instruction Fuzzy Hash: 5E81DD32618B8086E720DB29F8487DE77A4F388798F505315EE9C17B99DF78D680DB80

Function 000002733BE15EE0 Relevance: 3.1, APIs: 2, Instructions: 145encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 000002733BE15F6D
LocalFree.KERNEL32 ref: 000002733BE15FFF

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 60ba65b85ff1364b8bbb854b1ddae10ed61528731cf39e516168ca6a7b136fbf
Instruction ID: 61f2da1c2f7ca74215a7cec4705d7e1f40cd06b936717788eb23afc5f2743ad9
Opcode Fuzzy Hash: 60ba65b85ff1364b8bbb854b1ddae10ed61528731cf39e516168ca6a7b136fbf
Instruction Fuzzy Hash: 51618E32B18B808AF720EF78E4443DD73A5E75878CF108255EA8D16B89DB78C694E380

Function 000002733BE521C0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptProtectData.CRYPT32 ref: 000002733BE52218
LocalFree.KERNEL32 ref: 000002733BE522AA

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalProtect
String ID:
API String ID: 2714945720-0
Opcode ID: 6da8b2380d1e6afdbe15ad09ed0a82a6e20629f9e1f2d0947d1afcdde56a6e99
Instruction ID: bf459aeb90c002bf97cef2e0f92c107b35d81826b832a8753a89b68a1b04b37f
Opcode Fuzzy Hash: 6da8b2380d1e6afdbe15ad09ed0a82a6e20629f9e1f2d0947d1afcdde56a6e99
Instruction Fuzzy Hash: 32415A33618B80CAE320DF78E4443DD37A4F75978CF044269AA8C06E8ADB79C6A4D384

Function 000002733BE528C0 Relevance: 3.0, Strings: 2, Instructions: 529COMMON

Download Yara Rule

Strings

+, xrefs: 000002733BE52F3F
%, xrefs: 000002733BE52F24

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID: %$+
API String ID: 0-2626897407
Opcode ID: 47481408fe68075db2785b5e844cff1b171eed9e7e7d6e8885d4ee60d43f52b6
Instruction ID: 57e317a89b6fdf4d9cafe164719758b43e5e1ea345407f951b87f6a18348c70e
Opcode Fuzzy Hash: 47481408fe68075db2785b5e844cff1b171eed9e7e7d6e8885d4ee60d43f52b6
Instruction Fuzzy Hash: 55224723B18A848AFB31DB68F4543ED67A1E755788F044352DE4D17BD9DB38C685E380

Function 000002733BE829F4 Relevance: 2.9, Strings: 2, Instructions: 358COMMONLIBRARYCODE

Download Yara Rule

Strings

am/pm, xrefs: 000002733BE82CA3
a/p, xrefs: 000002733BE82D0E

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID: a/p$am/pm
API String ID: 0-3206640213
Opcode ID: 84aeccd4d3097aa3e4106772785546d072a9ec9c45404e341c4189bc1fea45af
Instruction ID: 300b56a40df95a61ea0fc6fac965a1ed4ad795b1e95948e12e4d2123641893c5
Opcode Fuzzy Hash: 84aeccd4d3097aa3e4106772785546d072a9ec9c45404e341c4189bc1fea45af
Instruction Fuzzy Hash: 1BE1B122A08A4085E779EF5CE51C7F923A1F750B86F554386EA0E87AD4DB38CB41E3C4

Function 000002733BE0FEE0 Relevance: 2.7, Strings: 2, Instructions: 226COMMON

Download Yara Rule

Strings

dumps, xrefs: 000002733BE0FF28
emoji, xrefs: 000002733BE0FF50

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID: dumps$emoji
API String ID: 0-2873254224
Opcode ID: f7c1d0fb9677e435d25e24cad687abe55fd77fc57aacf0daad7dd5b9b370ae1b
Instruction ID: dd3564d6a2bfe05f66a18c405d0274a3bebb0f59512bb8945f6d0b65a252a2a2
Opcode Fuzzy Hash: f7c1d0fb9677e435d25e24cad687abe55fd77fc57aacf0daad7dd5b9b370ae1b
Instruction Fuzzy Hash: 9FB12D22928FC486D761CB29F88069AB7A4F799784F546315FECD13B59DB38C290CB40

Function 000002733BE355B0 Relevance: 2.0, APIs: 1, Instructions: 455COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE3562B

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4b36fa1ee17c00e8d4283eaa3040d7c0ce3822ad195cc72d12b51e8c60e25bb5
Instruction ID: 2e64d3b3ff68ebb4bb8cb2b5b7fc49ade7a4847151477c0ad324d7a7088fa635
Opcode Fuzzy Hash: 4b36fa1ee17c00e8d4283eaa3040d7c0ce3822ad195cc72d12b51e8c60e25bb5
Instruction Fuzzy Hash: 9F02EF62705B8485EB21EF6AE0483DE73B1E348B98F449652DFAC17795EF38C685C380

Function 000002733BE84D78 Relevance: 1.9, APIs: 1, Instructions: 373COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 000002733BE84EC0

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: ebd1e3fd5c9ef18ab74b8e9e539302d76e319a11c17bfe9c3af0665a03d7a06d
Instruction ID: 413b8cfc2eb3371be8ddebe18b5f8fe2695ce607456e4d48fcb8f010e8b16c28
Opcode Fuzzy Hash: ebd1e3fd5c9ef18ab74b8e9e539302d76e319a11c17bfe9c3af0665a03d7a06d
Instruction Fuzzy Hash: 0612BC22A08BC486E761DF3CA4193ED73A4F758B49F459355EB9C82692EF74D281D380

Function 000002733BE854E8 Relevance: 1.8, APIs: 1, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1d4f562fad0ae8194edac45898e7cb718dfe290c275f32723fdee9f334670f5
Instruction ID: 66270191529e3a108c226870d833ed6a25d3e2a2d73955d53dbd12dcf6c27330
Opcode Fuzzy Hash: a1d4f562fad0ae8194edac45898e7cb718dfe290c275f32723fdee9f334670f5
Instruction Fuzzy Hash: F3E18032608F8486EB20EB65F4456EE77A4F794B88F4046229F9D93B56EF38C345D380

Function 000002733BE4CF70 Relevance: 1.7, APIs: 1, Instructions: 232COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE4D28B

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: c06b593c725dc07872aa154df743db2783a7f6756c4fde3946b93bd7402ecb75
Instruction ID: 12bda1af36134e47ad14cfb15d0730a9ee59037588e1b90986b38dfb4a4dd2e1
Opcode Fuzzy Hash: c06b593c725dc07872aa154df743db2783a7f6756c4fde3946b93bd7402ecb75
Instruction Fuzzy Hash: 91A1BA22709B9889FB10DBA9E4843EC37B0F359B48F548656DF8E53B59DB38C691D380

Function 000002733BE4CC50 Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE4CF64

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 50a55a3ba420cf9c46d51042fa6837dcd9d920783ad03091e359f59e14185712
Instruction ID: a312aeda0cd9b90d5edbe121f20cf5f5704ce1e33f35727b1c159429979d808a
Opcode Fuzzy Hash: 50a55a3ba420cf9c46d51042fa6837dcd9d920783ad03091e359f59e14185712
Instruction Fuzzy Hash: DFA1CB22709BA889FB20CB69E4843EC37B0F359B48F548656DF8D53B59DB38C291D380

Function 000002733BE4C930 Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE4CC44

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: f00762eceee1fdbe069b05ad4d53d399861816b59c8adad253d3f5e0714af0d5
Instruction ID: e409957f09791bdad4dd12fbc907dd4813c4e023c4b633e4d9b855dc9d9344fa
Opcode Fuzzy Hash: f00762eceee1fdbe069b05ad4d53d399861816b59c8adad253d3f5e0714af0d5
Instruction Fuzzy Hash: A0A1AC22709BA889EB20DB6AE4843EC7770F358B48F548656CF8D57B55DB38C291D390

Function 000002733BE4C600 Relevance: 1.7, APIs: 1, Instructions: 220COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE4C929

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: f77224b4a8fa35b9d78d45c826c3399db25f702fe04158d418ed51350959cbf1
Instruction ID: 62aed1805406f837477f9c76e9bfd07f025da98c4222cab81d586d4ca926c0e4
Opcode Fuzzy Hash: f77224b4a8fa35b9d78d45c826c3399db25f702fe04158d418ed51350959cbf1
Instruction Fuzzy Hash: 7DA1A922B19BA889EB10CBBAE4843EC37B0F359B48F548256DF8D57B55DB38D191D380

Function 000002733BE4C300 Relevance: 1.7, APIs: 1, Instructions: 214COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE4C5F8

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 2fa0959a887917298f33a60bd5e688b3df7c74c0dc06e6495990c16b151b7d2a
Instruction ID: d65cff17f9ddd8240a2c0af90046de7a39278af16567f5f6a7ad82cb97062ba1
Opcode Fuzzy Hash: 2fa0959a887917298f33a60bd5e688b3df7c74c0dc06e6495990c16b151b7d2a
Instruction Fuzzy Hash: 3BA1BC22709BA889EB20DB69E4843EC37B0F319B48F548656CF8D57B95DB38C290D390

Function 000002733BE4D2A0 Relevance: 1.7, APIs: 1, Instructions: 210COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE4D598

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 7b2aa9d5b68e4baef185b3c85445150f1967f249de06819966022115a2a2ec44
Instruction ID: 56fab9f8205fc3355c45f243e0c4e1c741b0711c24540b21a1ec79d3ff3c9863
Opcode Fuzzy Hash: 7b2aa9d5b68e4baef185b3c85445150f1967f249de06819966022115a2a2ec44
Instruction Fuzzy Hash: B2A18822609B9889EB20DBA9E4883EC37B0F359B48F548556CF8D57B95DF38C690D380

Function 000002733BE87620 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 000002733BE781FC: GetLastError.KERNEL32 ref: 000002733BE7820B
Part of subcall function 000002733BE781FC: FlsGetValue.KERNEL32 ref: 000002733BE78220
Part of subcall function 000002733BE781FC: SetLastError.KERNEL32 ref: 000002733BE782AB

Part of subcall function 000002733BE781FC: FlsSetValue.KERNEL32 ref: 000002733BE78241

GetLocaleInfoW.KERNEL32 ref: 000002733BE87688

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: 1d8e405bb44b78bdea7029598407ccfb6a808eb35fd889ed9364ebfb982fc4a2
Instruction ID: 19deb41378311e072664618be0171635381e3f838b2370b1e71f921ff766faab
Opcode Fuzzy Hash: 1d8e405bb44b78bdea7029598407ccfb6a808eb35fd889ed9364ebfb982fc4a2
Instruction Fuzzy Hash: F431C332608B8186EB34EB2EF4453DA73A1F794B82F4482659A4DC3295DF38CA41F7C0

Function 000002733BE87270 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000002733BE781FC: GetLastError.KERNEL32 ref: 000002733BE7820B
Part of subcall function 000002733BE781FC: FlsGetValue.KERNEL32 ref: 000002733BE78220
Part of subcall function 000002733BE781FC: SetLastError.KERNEL32 ref: 000002733BE782AB

EnumSystemLocalesW.KERNEL32 ref: 000002733BE8730E

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 58800bb6c4d0d9c609f2f6f306793987a7a581936cd52f064e9451565f60872b
Instruction ID: ef7df8d3cbeb7eca5575777d8de7cae7f38d6c2a73aaca540f38d1c7f29ba555
Opcode Fuzzy Hash: 58800bb6c4d0d9c609f2f6f306793987a7a581936cd52f064e9451565f60872b
Instruction Fuzzy Hash: 5D11E7A3A18A548AEB35EF2AE0847D97BA0F750FE1F444215D659873D4CA34C6D1E7C0

Function 000002733BE39A10 Relevance: 1.6, Strings: 1, Instructions: 304COMMON

Download Yara Rule

Strings

., xrefs: 000002733BE39D10

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: c186bb128fa46274ed6aa0f5693762bd7565d34954179943d2f20e1eed1b66ee
Instruction ID: ca4c619adeda6a2915ec48f1eb3d7914c80152e119f4741158204717e9d224e1
Opcode Fuzzy Hash: c186bb128fa46274ed6aa0f5693762bd7565d34954179943d2f20e1eed1b66ee
Instruction Fuzzy Hash: 86C1813A208B8486EB70EF2EE4483E963E1F748794F945351EA9E43794DF78CA41D390

Function 000002733BE87340 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000002733BE781FC: GetLastError.KERNEL32 ref: 000002733BE7820B
Part of subcall function 000002733BE781FC: FlsGetValue.KERNEL32 ref: 000002733BE78220
Part of subcall function 000002733BE781FC: SetLastError.KERNEL32 ref: 000002733BE782AB

EnumSystemLocalesW.KERNEL32 ref: 000002733BE873BE

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: fd6ab9fb082eedb8b2c8f5dae22463227a7604b7e6560a2cecb061507bc0ecca
Instruction ID: 9f36327fadea799f341c5848f1f9b4645c53c7daee92f5fd776af2bb4eee8f34
Opcode Fuzzy Hash: fd6ab9fb082eedb8b2c8f5dae22463227a7604b7e6560a2cecb061507bc0ecca
Instruction Fuzzy Hash: 0701B56271CA9086E720AF19F4487DDB6A1E740FA6F458361DA69872C4C7748681B7C1

Function 000002733BE4F1B5 Relevance: 1.5, APIs: 1, Instructions: 34comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 000002733BE4F1FD
CoSetProxyBlanket.OLE32 ref: 000002733BE4F252

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: BlanketCreateInstanceProxy
String ID:
API String ID: 1899829610-0
Opcode ID: a787f5c70b0da52dd39980db2e05650dfd34504bfd18cc3456a54f99b4034af6
Instruction ID: 4b33712bd5ba2510e6a88238081c5c9cc6998e9e2df8075dbeb495a1784ecc99
Opcode Fuzzy Hash: a787f5c70b0da52dd39980db2e05650dfd34504bfd18cc3456a54f99b4034af6
Instruction Fuzzy Hash: 64018623709A5086FB31EB69F4053ED67B1AB49B58F4007968E4D43A55DF38C285D3C4

Function 000002733BE7BC68 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32 ref: 000002733BE7BCB7

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: f8325550294e071d185dd7c07cc84b153cedbfbab89d167ada8b5b9da10e3d51
Instruction ID: 035d04043bde9c3cd5eb5c0ca02d314ff38aff0527425ca62f1b94c967945668
Opcode Fuzzy Hash: f8325550294e071d185dd7c07cc84b153cedbfbab89d167ada8b5b9da10e3d51
Instruction Fuzzy Hash: C5F03C76708A4483E724EB29F8992D97762F798B80F54A165EA4D83365CE3CC651A380

Function 000002733BE87F00 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002733BE87F04

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 2bd217787b85c097b3ccba094d4d30ef76119dd789487d52041f712bc5b72eb7
Instruction ID: bfc61d9dcf92a3e81373103895cf3d8a8f4eb1c705334fe9970d08547e58498b
Opcode Fuzzy Hash: 2bd217787b85c097b3ccba094d4d30ef76119dd789487d52041f712bc5b72eb7
Instruction Fuzzy Hash: 20B09220E0BA55D6EA18BB156C8A34423A4BB48B10F884598800C41720DB2C02A56790

Function 000002733BE083D0 Relevance: .8, Instructions: 795COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9b8fdb5bbf29e83ba46770476c642bc1a2f153b56793c0f77b40a01b05bd800
Instruction ID: 1839750d269ec533bafdcd57dc459f085ea9d8d54178d37e3a31c303c37acf12
Opcode Fuzzy Hash: b9b8fdb5bbf29e83ba46770476c642bc1a2f153b56793c0f77b40a01b05bd800
Instruction Fuzzy Hash: 70A2A436615FC88AD7508FAAEC8119D73BAF749BA8B101629EFCC57F18EBB4C1548740

Function 000002733BE05520 Relevance: .8, Instructions: 792COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61b138e2f8be8669eaa3fa70493c75768e0123efac51ff36daff019644dff011
Instruction ID: 6a706c478a65cb4b605d73c19d2bf6e5b9b37cc52143f67b9ae0a256dd3f7792
Opcode Fuzzy Hash: 61b138e2f8be8669eaa3fa70493c75768e0123efac51ff36daff019644dff011
Instruction Fuzzy Hash: 2C92C732919BC88AD771CF29E8812DAB7A8F79D788F505315EACC16B19EB38C354C744

Function 000002733BE366A0 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff8ff783da37649173626c7f7158936b22345755ff077d27462f74136c1878ba
Instruction ID: b8de9ac856d706471075d377053e8e7bce974b474f6a916fe7015a538d244fc6
Opcode Fuzzy Hash: ff8ff783da37649173626c7f7158936b22345755ff077d27462f74136c1878ba
Instruction Fuzzy Hash: 04C15A737286A48BE766CF6AE9486A9B762F7D4BD0F45D220DF4D07B48D638C902C740

Function 000002733BDE6610 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6be2e4abd64f590320afb9fc3fe649fed7ec12c2b8de295ccc4015a354be2fd
Instruction ID: 03ade9c7931f251ca4c551f6ea1fb076e2e6243f3ea631aac8afd53fa55482dc
Opcode Fuzzy Hash: a6be2e4abd64f590320afb9fc3fe649fed7ec12c2b8de295ccc4015a354be2fd
Instruction Fuzzy Hash: 0812B532619FC88AE771CF29E84139AB3A4F789788F505315EACC57B59EB38C254CB44

Function 000002733BE4FDB0 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34fb1097c6f2363caac24c1e5b45ae24c1a6ca50cb597d280e611698873f3a91
Instruction ID: f85299e06373ff15ecc294381ad579eeba4482b77edfb66f9139e699e69b31e4
Opcode Fuzzy Hash: 34fb1097c6f2363caac24c1e5b45ae24c1a6ca50cb597d280e611698873f3a91
Instruction Fuzzy Hash: A4C1C3B3A146948BE355CF2DD40195D7BA0F398B84F40A629EF5AC3B01E778D9A5CF80

Function 000002733BE06510 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58385eaf4bb05c4dd650fe9c3293d5d132ea8d53e59e9018c70652c9bfdaf018
Instruction ID: c03d1e8c510d3345fd111aabb7df8c7f92b16bbf46065a3f9508866b145f0482
Opcode Fuzzy Hash: 58385eaf4bb05c4dd650fe9c3293d5d132ea8d53e59e9018c70652c9bfdaf018
Instruction Fuzzy Hash: C702D532A15FC489D7228F79E8813D977A4F7AD798F105315EACC2AB19EBB4C294C740

Function 000002733BE78C34 Relevance: .3, Instructions: 309COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: f39b52ed8424437b231758bdb93ffc4f840ea96165d05f634ae1d9fa5926c97e
Instruction ID: 81c66e87c2d885179c67d70b563c4e4b8c3d01710b6c7f7b1b7ea2d13c2a2ac4
Opcode Fuzzy Hash: f39b52ed8424437b231758bdb93ffc4f840ea96165d05f634ae1d9fa5926c97e
Instruction Fuzzy Hash: 06C10A2630868486FB74EB2AA8157EE27A5F7A4B88F404255FE4D877D4DB38C745E380

Function 000002733BE86984 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: ErrorLast$Value_invalid_parameter_noinfo
String ID:
API String ID: 1500699246-0
Opcode ID: 8359977cf5bdbaae4c5aab83856ae08c3cfc9e43f61b49509031a229a49b9122
Instruction ID: 8c51cd44fe4b9db984bb4caf65ff3d5c63576b22cbb866dfd0008ecaa52cf683
Opcode Fuzzy Hash: 8359977cf5bdbaae4c5aab83856ae08c3cfc9e43f61b49509031a229a49b9122
Instruction Fuzzy Hash: AEB1D232618A888AEB74FF69E5197D933A1F354F89F408361DA59C36D9DB38C641E3C0

Function 000002733BE75044 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 961d3e7eb4dbe1c42d41fae25b585760f3c2351026af9e0dc6bb8535c2ebc898
Instruction ID: 1457b4b3b163226642b72b4abe1913f8f65fc70d515e67eebd9effc32e561549
Opcode Fuzzy Hash: 961d3e7eb4dbe1c42d41fae25b585760f3c2351026af9e0dc6bb8535c2ebc898
Instruction Fuzzy Hash: 15B17F72118B8487E774DF2DA05A3AC3BF4E349B48F240296EB5E47399DB75C641E780

Function 000002733BE77060 Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 785bb13fe01c7cf8ebae0a68e8c88eb6843a3380ff6b94b7bcfacfe4a0d1ed08
Instruction ID: f46e9dd798303e24874e15a75894cfc6f047e1d626f587eeaaddfa735fc3068c
Opcode Fuzzy Hash: 785bb13fe01c7cf8ebae0a68e8c88eb6843a3380ff6b94b7bcfacfe4a0d1ed08
Instruction Fuzzy Hash: D081C372204A5086EB30EF29E49A3AD2360F744BE8F144756FE2E87785DF34C641E380

Function 000002733BDE6D20 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e8cb9989ebccae2b4934454dacc3e473b3a3bc5e9d1377eb956669a5a9cd281
Instruction ID: 03562924539fa1ee90ea2b7ccc6cad53143be483cd6e605e6a0cb5f9357bbfed
Opcode Fuzzy Hash: 4e8cb9989ebccae2b4934454dacc3e473b3a3bc5e9d1377eb956669a5a9cd281
Instruction Fuzzy Hash: FDB1F432A19FC88AD710CFA9E840299B7B5F7997A8F145315EACC23F68EB74C254C740

Function 000002733BE9E2CC Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0101b5bfc7e861b0726451e18251d4484926b191a0e7c85200f779e0e00e1385
Instruction ID: 6b68e4062e41e1e9b1af4b8d94c21b22352eb69ebb8b24eee02b6fe39fd002b7
Opcode Fuzzy Hash: 0101b5bfc7e861b0726451e18251d4484926b191a0e7c85200f779e0e00e1385
Instruction Fuzzy Hash: BA61F42270C29486F778EB2CA44CBFD7681A740760F1847A9EB9D477C5E67DCA4CA780

Function 000002733BE501F0 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8564914535ee6488183395aa034df85c3b96b43cc627a35cfc23d0d483c1855f
Instruction ID: ffd4806f47d477737c1172686c35d7610ea256f7dd794da53e994d28eb0005fc
Opcode Fuzzy Hash: 8564914535ee6488183395aa034df85c3b96b43cc627a35cfc23d0d483c1855f
Instruction Fuzzy Hash: DF61EF2321E2C48FD31EDF7C589106D7F61D3A7908388469DEAC5EBB4BC504C95ACBA6

Function 000002733BE7EE06 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8361dc49c257ca5c58a7e22c82553e287cd3153b8e2e7dc21ca7117d7e5b9edd
Instruction ID: 21adedd25129bb9793e46884ee83b523653d7eddaf150dd6ae77266e207a1e39
Opcode Fuzzy Hash: 8361dc49c257ca5c58a7e22c82553e287cd3153b8e2e7dc21ca7117d7e5b9edd
Instruction Fuzzy Hash: 7F51047220C68447EB74DB1DB44A3A96A91F3467D4F004365EA9E43F99DB3DC200AB80

Function 000002733BE58230 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08e682c8f50e6a31ebca66eccf7bc014078cfb37ed238d168109819e35b8cd79
Instruction ID: 284a9a253deb29079ded95e804d562f90332864d436b5d157f4be0c2a5d8d4bb
Opcode Fuzzy Hash: 08e682c8f50e6a31ebca66eccf7bc014078cfb37ed238d168109819e35b8cd79
Instruction Fuzzy Hash: 465104A3B0568443DB248B49FC42796F7A5FBD87C5F00A126EE8D57B68EB3CD5808700

Function 000002733BE747FC Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction ID: 47e3a1d62b280b2a3b6ccc9de618579b561724a1c2a69eaf845882e82f50f468
Opcode Fuzzy Hash: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction Fuzzy Hash: 9F51733761869487F735DB2DE05A3A837B0E385B58F244291EACD177A4C736CA53E780

Function 000002733BE745F8 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction ID: 9c06a589db50658ccaa51ae4f2595cfe0abc8984538edc1d09229cf8f3764be6
Opcode Fuzzy Hash: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction Fuzzy Hash: 37518E37218A5087E735DB2DE0497A827B0E385B58F244251EE8D077A4C736DE52E7C0

Function 000002733BE74A00 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction ID: 892d198839677baff66968eb6eb02fd8373a2e992af3434661ea0efe729a723f
Opcode Fuzzy Hash: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction Fuzzy Hash: 6251813721865087E735DB2EE04A3A937B0E3D4B58F244251EE8D177A8E736DE52E780

Function 000002733BE89EA0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 8fbae818eea1d914da60437b7a5c964747a04bdd4ff824fbc22ee65c1649dd6a
Instruction ID: 2b3759f3b788ad4afc27b4cb5d0605bbe39620f4f6ccb3ee163e31c04a8026b5
Opcode Fuzzy Hash: 8fbae818eea1d914da60437b7a5c964747a04bdd4ff824fbc22ee65c1649dd6a
Instruction Fuzzy Hash: 28411C36314E5482EF14DF6AE9182A97391F748FD4F49A122EE0D87B64DF3DC5429380

Function 000002733BEB2008 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65fcb47a17adf94f373ff647ddafb07328eb1c747429ddd71517b78256354565
Instruction ID: 1aaf2256a03966f1b2866756c7a7ea71547e364976815647f16115be7f6cc13b
Opcode Fuzzy Hash: 65fcb47a17adf94f373ff647ddafb07328eb1c747429ddd71517b78256354565
Instruction Fuzzy Hash: 24F0C747E1E7D45AF772EB281C7D3C41F919B92922F4D41CA9A45475D394460E06F3C1

Function 000002733BEB22D8 Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d53a79903260b7a4f0e6c71e7ffc168a0f2adb2b336afcda935cdf6e025e0c2f
Instruction ID: 68b6616308b9af48c007f373e9c6d33a9f578202f089094cf3be5ac5cfacc976
Opcode Fuzzy Hash: d53a79903260b7a4f0e6c71e7ffc168a0f2adb2b336afcda935cdf6e025e0c2f
Instruction Fuzzy Hash: B2F0F997E5FED006F3B2F7281D3E28C2FD29BB2506F1D428A8B4807183A4051D0472D1

Function 000002733BEB2398 Relevance: .0, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91d01cb9ed2bd3d2d45766b86e1c76849cdc335525e86e8d4b249a2a0640e502
Instruction ID: 3f382ff6142f054e2d9956863fa903f88a46091d0893e6256db0ec105e48ce6d
Opcode Fuzzy Hash: 91d01cb9ed2bd3d2d45766b86e1c76849cdc335525e86e8d4b249a2a0640e502
Instruction Fuzzy Hash: 71E04F87E4EAC119F326D3681C3F64C5FD15B73A12B4D81DF8748036D3B44A2D00A391

Function 000002733BEB22C8 Relevance: .0, Instructions: 5COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edd3a2eeda825b6b20b33a8d4304bb014d0de21dbcdcdd6f5120fd93b8e00f70
Instruction ID: 3e52525d39e57bbbd7167a3d2a5026f39e520ea7036a62e7442895414421d68b
Opcode Fuzzy Hash: edd3a2eeda825b6b20b33a8d4304bb014d0de21dbcdcdd6f5120fd93b8e00f70
Instruction Fuzzy Hash: 7DA002DBE99384ABCB1609700CE14E91F1679B2900395505EE351D33D3BC8D0A0B9522

Function 000002733BEB26E0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a42a01495bc10c92585e70db87d9dd7e84e2cd6d90333ee8a624f4433841b9f2
Instruction ID: dd821fc456802a82e214712cdc142db2467fbba7cfc259e82cbb70f11fd0d425
Opcode Fuzzy Hash: a42a01495bc10c92585e70db87d9dd7e84e2cd6d90333ee8a624f4433841b9f2
Instruction Fuzzy Hash: F8A0125370D090C6F1175B14140D1842B50DB52500B888080850002407C019040D9A80

Function 000002733BEB2090 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01a4154ba30de378ee8f3a0bf3b2dfb59d47392f9fc814d815bb3a6ccc76d7c
Instruction ID: ea494100ae4b06ccfc3813b00a83396d41290cc99dde8ead6981ca79b0f3276f
Opcode Fuzzy Hash: f01a4154ba30de378ee8f3a0bf3b2dfb59d47392f9fc814d815bb3a6ccc76d7c
Instruction Fuzzy Hash:

Function 000002733BE4ED30 Relevance: 28.7, APIs: 19, Instructions: 177processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000002733BE4ED86
Process32FirstW.KERNEL32 ref: 000002733BE4EDCA
Process32NextW.KERNEL32 ref: 000002733BE4EDDF
OpenProcess.KERNEL32 ref: 000002733BE4EE1B
OpenProcessToken.ADVAPI32 ref: 000002733BE4EE42
GetTokenInformation.ADVAPI32 ref: 000002733BE4EE6E
GetLastError.KERNEL32 ref: 000002733BE4EE7C
GetTokenInformation.ADVAPI32 ref: 000002733BE4EEBC
ConvertSidToStringSidA.ADVAPI32 ref: 000002733BE4EED3
CloseHandle.KERNEL32 ref: 000002733BE4EF46
CloseHandle.KERNEL32 ref: 000002733BE4EF51
CloseHandle.KERNEL32 ref: 000002733BE4EFB6
Process32NextW.KERNEL32 ref: 000002733BE4EFC3
CloseHandle.KERNEL32 ref: 000002733BE4EFE9
CloseHandle.KERNEL32 ref: 000002733BE4EFF2
CloseHandle.KERNEL32 ref: 000002733BE4F007

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: CloseHandle$Process32Token$InformationNextOpenProcess$ConvertCreateErrorFirstLastSnapshotStringToolhelp32
String ID:
API String ID: 3925315391-0
Opcode ID: 9cfa9a338c49679a1929b549c81fccef5f16dbb46e3a6c3e399b60bd0c466e0c
Instruction ID: 26aa0a667c38c0c81f807c8e9e728bb127d1c37675373475f6c38edafca840ec
Opcode Fuzzy Hash: 9cfa9a338c49679a1929b549c81fccef5f16dbb46e3a6c3e399b60bd0c466e0c
Instruction Fuzzy Hash: 9981A53161DB8082E724EF19F84839EB7A5FB88B94F404255EE4D53B94DF78C645E780

Function 000002733BE6FDCC Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 407COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002733BE6FDFB
_invalid_parameter_noinfo.LIBCMT ref: 000002733BE6FECB

Strings

0, xrefs: 000002733BE6FF07
0, xrefs: 000002733BE6FE9D
0, xrefs: 000002733BE6FEF5

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$0$0
API String ID: 3215553584-3137946472
Opcode ID: c13ea352d321776aceeea9581779599aef3778c14aa0c6b54d648fb53a65a266
Instruction ID: 8209ea528b4f2fba46ffc547b8499e59e9dbdd71cab447cf5ea36fb52bb74e47
Opcode Fuzzy Hash: c13ea352d321776aceeea9581779599aef3778c14aa0c6b54d648fb53a65a266
Instruction Fuzzy Hash: F6E1053210D6858AF771EF2CA0A93ED3B919712785F549282E78D47787C635CA5AF3C0

Function 000002733BE54C60 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 159COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002733BE54CDD
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000002733BE54D25
Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE54EA1
Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE54EB4
Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE54EBA

Strings

false, xrefs: 000002733BE54DAD
bad locale name, xrefs: 000002733BE54EA7
true, xrefs: 000002733BE54DDC

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: 3c642f864733e41381d771a2a077dfc74cd5084416de59f9f5d8b3af538e5cc1
Instruction ID: 890e424658136e1706ffe8e6189279f00c761b979cb3de11f8cd0182d0144946
Opcode Fuzzy Hash: 3c642f864733e41381d771a2a077dfc74cd5084416de59f9f5d8b3af538e5cc1
Instruction Fuzzy Hash: 8D716F2270AB408AFB25EFB9E4543EC33B5EB84748F0442699E4C67B99DF34C655E384

Function 000002733BE7BCE4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000002733BE7BE60
GetProcAddress.KERNEL32 ref: 000002733BE7BE6C

Strings

ext-ms-, xrefs: 000002733BE7BDBD
api-ms-, xrefs: 000002733BE7BDAA

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: c6120ce6c378417c8061f2daa80316ce8b84504fe2d3d9dfde353b277e126bba
Instruction ID: f4ddac008046772f3149250bfe055760f374d6214c27900ce4143406fc00b252
Opcode Fuzzy Hash: c6120ce6c378417c8061f2daa80316ce8b84504fe2d3d9dfde353b277e126bba
Instruction Fuzzy Hash: 8141272231AA0082FA35EB2ABC5C7D52795FB45BE0F094765EE1D87794DF3CC605A380

Function 000002733BE55090 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 000002733BE550FB
InternetOpenUrlA.WININET ref: 000002733BE55130
InternetReadFile.WININET ref: 000002733BE55151
InternetReadFile.WININET ref: 000002733BE5518F
InternetCloseHandle.WININET ref: 000002733BE5519C
InternetCloseHandle.WININET ref: 000002733BE551A5

Strings

File Downloader, xrefs: 000002733BE550F4

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandleOpenRead
String ID: File Downloader
API String ID: 4038090926-3631955488
Opcode ID: d760029ad861ea7f7ea2ffc299629ee0db5f3c755485599aed123bc73a668a15
Instruction ID: 33482b48a03623471f43a9beb23a4656a5878cac86e54fa5badde5050eb66f25
Opcode Fuzzy Hash: d760029ad861ea7f7ea2ffc299629ee0db5f3c755485599aed123bc73a668a15
Instruction Fuzzy Hash: C6318332619B8086E720EF59F9647DAB7A0FB89BC4F444116EE4D43B58DF78C6419B80

Function 000002733BE732AC Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002733BE732EF
_invalid_parameter_noinfo.LIBCMT ref: 000002733BE736DC
_invalid_parameter_noinfo.LIBCMT ref: 000002733BE73978

Strings

f, xrefs: 000002733BE73411
p, xrefs: 000002733BE73419
p, xrefs: 000002733BE733A1

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: da133f4d1d1d50a9f8077a7ed93c78c5851a9c9ee1111e96f3e2a2a160aeb47c
Instruction ID: 47ff621639653b96b737114e3696d3936d8e0710cc1f59bbf106807c4b067c78
Opcode Fuzzy Hash: da133f4d1d1d50a9f8077a7ed93c78c5851a9c9ee1111e96f3e2a2a160aeb47c
Instruction Fuzzy Hash: F512A26260C24187FBB4FB5DF01E7EA76A1F380754F944395F69A466C8D738C782AB80

Function 000002733BE781FC Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002733BE7820B
FlsGetValue.KERNEL32 ref: 000002733BE78220
FlsSetValue.KERNEL32 ref: 000002733BE78241
FlsSetValue.KERNEL32 ref: 000002733BE7826E
FlsSetValue.KERNEL32 ref: 000002733BE7827F
FlsSetValue.KERNEL32 ref: 000002733BE78290
SetLastError.KERNEL32 ref: 000002733BE782AB

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: a64517f74db65a597346d350dde432297d840979f255a46bef08400084ad21a5
Instruction ID: 85cf5b5f101f857aca7d45ab27251426835e0f7abe23fee583ad8ede0ed056dd
Opcode Fuzzy Hash: a64517f74db65a597346d350dde432297d840979f255a46bef08400084ad21a5
Instruction Fuzzy Hash: F3215E2020D64083FA78F77A7A6E3E952525F557F0F145794B93E46BD6EE28860173C0

Function 000002733BE8ABDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002733BE8AC0D
GetLastError.KERNEL32 ref: 000002733BE8AC19
CloseHandle.KERNEL32 ref: 000002733BE8AC31
CreateFileW.KERNEL32 ref: 000002733BE8AC5C
WriteConsoleW.KERNEL32 ref: 000002733BE8AC7B

Strings

CONOUT$, xrefs: 000002733BE8AC3D

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 97ef1f90b5d1e549fd4d93c948d975b58c02b300c1de8e440893a5efab19f807
Instruction ID: 621836a845d779820751c74c10ae25e10686a560ba0d54c175b405391d9450e9
Opcode Fuzzy Hash: 97ef1f90b5d1e549fd4d93c948d975b58c02b300c1de8e440893a5efab19f807
Instruction Fuzzy Hash: 61116035719A4086E760EB5AF85839A67A0FB88FE4F045354EE5D877A4CF7CCA4487C0

Function 000002733BE9B73C Relevance: 9.2, APIs: 6, Instructions: 239COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 000002733BE9B7E9
MultiByteToWideChar.KERNEL32 ref: 000002733BE9B885
MultiByteToWideChar.KERNEL32 ref: 000002733BE9B92E
MultiByteToWideChar.KERNEL32 ref: 000002733BE9B958
MultiByteToWideChar.KERNEL32 ref: 000002733BE9BA00
CompareStringEx.KERNEL32 ref: 000002733BE9BA4D

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: ab7e75f2883cad40e90fab743296f144bd79ee85a7c99ab5de0f741cdd8f7a66
Instruction ID: 3cd2eb1cc0ed5a01ad78169d9cfa2ba695a8cba0556acadc02d75bfaf16c6cd1
Opcode Fuzzy Hash: ab7e75f2883cad40e90fab743296f144bd79ee85a7c99ab5de0f741cdd8f7a66
Instruction Fuzzy Hash: F7A1B0726087808AFB35EB39B4583E97691F744BA8F444791DA9C07BD5DB7CCA48A3C0

Function 000002733BE9B3DC Relevance: 9.2, APIs: 6, Instructions: 206COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 000002733BE9B44C
MultiByteToWideChar.KERNEL32 ref: 000002733BE9B4EA
LCMapStringEx.KERNEL32 ref: 000002733BE9B553
LCMapStringEx.KERNEL32 ref: 000002733BE9B5A5
LCMapStringEx.KERNEL32 ref: 000002733BE9B64A
WideCharToMultiByte.KERNEL32 ref: 000002733BE9B6A4

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: a17d41df7d4fcd83c170866fb1b58b26a6ae7521d63a390143938d7d4d5e554f
Instruction ID: 6d3e2658b38da7860dea000a20cbda3ba97060d41971ee2707bce65fd8919677
Opcode Fuzzy Hash: a17d41df7d4fcd83c170866fb1b58b26a6ae7521d63a390143938d7d4d5e554f
Instruction Fuzzy Hash: A381B17220978086EB30EF29F44839977E5FB44BA8F144761EA9D47BD9DB3CC6049780

Function 000002733BE703B8 Relevance: 9.2, APIs: 6, Instructions: 157COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002733BE7042A
_invalid_parameter_noinfo.LIBCMT ref: 000002733BE7045B
_invalid_parameter_noinfo.LIBCMT ref: 000002733BE7049B
_invalid_parameter_noinfo.LIBCMT ref: 000002733BE704DD
_invalid_parameter_noinfo.LIBCMT ref: 000002733BE70512
_invalid_parameter_noinfo.LIBCMT ref: 000002733BE7058F

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ca3f80eaf004f362beb8f5b3b26ae04cc2cf7c865ac26bc256f85fe2d54e20e3
Instruction ID: 32df09234e7e328bebce271edb12b085d6b1ededd309091447872870e9caab76
Opcode Fuzzy Hash: ca3f80eaf004f362beb8f5b3b26ae04cc2cf7c865ac26bc256f85fe2d54e20e3
Instruction Fuzzy Hash: E051846610C68487E772EF28F06A3ED3BA1A745B45F548191E7CC47387DA29CA46E382

Function 000002733BE78374 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002733BE78383
FlsSetValue.KERNEL32(?,?,-2891666E48DAA7FF,000002733BE740D5,?,?,?,?,000002733BE7B584), ref: 000002733BE783B9
FlsSetValue.KERNEL32(?,?,-2891666E48DAA7FF,000002733BE740D5,?,?,?,?,000002733BE7B584), ref: 000002733BE783E6
FlsSetValue.KERNEL32(?,?,-2891666E48DAA7FF,000002733BE740D5,?,?,?,?,000002733BE7B584), ref: 000002733BE783F7
FlsSetValue.KERNEL32(?,?,-2891666E48DAA7FF,000002733BE740D5,?,?,?,?,000002733BE7B584), ref: 000002733BE78408
SetLastError.KERNEL32 ref: 000002733BE78423

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 47747b4fce285073a0e2fe22e01b95934fc6c31783b87f6b8fd0ce1873d4bd80
Instruction ID: 2d47c47e2a0e24cb36d2236559737d15176d37dad3a5b37902ade8b1e7c5cd47
Opcode Fuzzy Hash: 47747b4fce285073a0e2fe22e01b95934fc6c31783b87f6b8fd0ce1873d4bd80
Instruction Fuzzy Hash: 8C11592020D25043FA78F73E7A6E3AE62566F547F0F5457A4B93E467D6EE289600B3C0

Function 000002733BE0DB90 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 281COMMON

Download Yara Rule

APIs

__std_fs_code_page.LIBCPMT ref: 000002733BE0DBEF

Part of subcall function 000002733BE99570: AreFileApisANSI.KERNEL32 ref: 000002733BE99582

__std_exception_destroy.LIBVCRUNTIME ref: 000002733BE0DE97
__std_exception_destroy.LIBVCRUNTIME ref: 000002733BE0DF51

Strings

: ", xrefs: 000002733BE0DCAA
", ", xrefs: 000002733BE0DCDD

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy$ApisFile__std_fs_code_page
String ID: ", "$: "
API String ID: 741338541-747220369
Opcode ID: e5b5310406cebe98878b3f25866df8b0674e324702342a29c6964b498bd6ede7
Instruction ID: 686bc833025599cc86497e5cd0e3329d6b65b3a1fbc595cfbc4278da14f444a9
Opcode Fuzzy Hash: e5b5310406cebe98878b3f25866df8b0674e324702342a29c6964b498bd6ede7
Instruction Fuzzy Hash: 3BB1C172709B4086EB20EF69F4483EC23A1E749B88F408661DE5D57B9ADF38C695D3C0

Function 000002733BE832C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002733BE832ED
GetProcAddress.KERNEL32 ref: 000002733BE83303
FreeLibrary.KERNEL32 ref: 000002733BE8332A

Strings

CorExitProcess, xrefs: 000002733BE832FC
mscoree.dll, xrefs: 000002733BE832E4

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: db481cee700add6652efbd16517b6fad29b9a19914f0d4d044d41ba2919793f2
Instruction ID: 89cef42610c8f6a291b72e3a6a6965e20c6b9e2845b4a31489e4e284dc96f69c
Opcode Fuzzy Hash: db481cee700add6652efbd16517b6fad29b9a19914f0d4d044d41ba2919793f2
Instruction Fuzzy Hash: 59F04F2160EB0081EA34EB28B45D3995760EB48B63F541795967E462F4CF28C389A7C0

Function 000002733BE7F4D8 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002733BE7F517
_set_statfp.LIBCMT ref: 000002733BE7F535
_set_statfp.LIBCMT ref: 000002733BE7F55E
_set_statfp.LIBCMT ref: 000002733BE7F79A

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 5459f65f4676636fdc901623b58b7eba5cdeda63d87ce883b5aed9902fe8fe9f
Instruction ID: aad92ffe2f289345e44da174d161e74394ebbb4503ebdd91d211dddfa7b67c17
Opcode Fuzzy Hash: 5459f65f4676636fdc901623b58b7eba5cdeda63d87ce883b5aed9902fe8fe9f
Instruction Fuzzy Hash: 1C81141212CAC487F672EF3CB44A3EE62A0FB55394F144381FA6E265E5D734CB81A6C0

Function 000002733BE7843C Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000002733BE6F8AF,?,?,00000000,000002733BE6FB4A,?,?,?,?,-2891666E48DAA7FF,000002733BE6FAD6), ref: 000002733BE7845B
FlsSetValue.KERNEL32(?,?,?,000002733BE6F8AF,?,?,00000000,000002733BE6FB4A,?,?,?,?,-2891666E48DAA7FF,000002733BE6FAD6), ref: 000002733BE7847A
FlsSetValue.KERNEL32(?,?,?,000002733BE6F8AF,?,?,00000000,000002733BE6FB4A,?,?,?,?,-2891666E48DAA7FF,000002733BE6FAD6), ref: 000002733BE784A2
FlsSetValue.KERNEL32(?,?,?,000002733BE6F8AF,?,?,00000000,000002733BE6FB4A,?,?,?,?,-2891666E48DAA7FF,000002733BE6FAD6), ref: 000002733BE784B3
FlsSetValue.KERNEL32(?,?,?,000002733BE6F8AF,?,?,00000000,000002733BE6FB4A,?,?,?,?,-2891666E48DAA7FF,000002733BE6FAD6), ref: 000002733BE784C4

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 64b21c8772d4c2280a2575dd52794ef6fbd465c186315b0bb9d8ae0d08d06aa7
Instruction ID: 2cc91ef7ace1fe262df87106a6baf685f949416c403532c7fca6af3b61f11a5a
Opcode Fuzzy Hash: 64b21c8772d4c2280a2575dd52794ef6fbd465c186315b0bb9d8ae0d08d06aa7
Instruction Fuzzy Hash: 6911812030D20043FA78F33A7A6B3E912466B543F4F6853A4B97E467D6EE68D601B3C0

Function 000002733BE782D0 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 000002733BE782E1
FlsSetValue.KERNEL32 ref: 000002733BE78300
FlsSetValue.KERNEL32 ref: 000002733BE78328
FlsSetValue.KERNEL32 ref: 000002733BE78339
FlsSetValue.KERNEL32 ref: 000002733BE7834A

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: e27ca31b50e2d5aa569de687d9ca52c361e113afdb0e2059800f2a58b2f57a54
Instruction ID: 44d8c414f7127e07d7255562d45a91d5cfc89f6e0f47ecf1567e0461327bd15a
Opcode Fuzzy Hash: e27ca31b50e2d5aa569de687d9ca52c361e113afdb0e2059800f2a58b2f57a54
Instruction Fuzzy Hash: CB11F72020D20507F978F33E786B3EA12825B557B5F585BE4793E4A3D6EE299A41B2C0

Function 000002733BE26510 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002733BE26580
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000002733BE265C8
_Getcoll.LIBCPMT ref: 000002733BE265FC

Strings

bad locale name, xrefs: 000002733BE26701

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: std::_$GetcollLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1287851536-1405518554
Opcode ID: 415de4996ee4135b614fdbd6a511a1b442f80551b934d1b3caf70d8bd98b81a6
Instruction ID: 25387be2ddb57f9091538d7c0dd358d3aa55bdfe48bf1cb8a666c097795c2c16
Opcode Fuzzy Hash: 415de4996ee4135b614fdbd6a511a1b442f80551b934d1b3caf70d8bd98b81a6
Instruction Fuzzy Hash: A7919F32B05B808AFB24EFB9F4543DC3361EB45B88F044765DA8D1BB99DE38C655A380

Function 000002733BE9D3EC Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002733BE9D6CB

Part of subcall function 000002733BE8A7BC: _invalid_parameter_noinfo.LIBCMT ref: 000002733BE8A7D9

Strings

UTF-16LEUNICODE, xrefs: 000002733BE9D669
ccs, xrefs: 000002733BE9D606
UTF-8, xrefs: 000002733BE9D64A

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: c93d0c80d14289c47e4e012ab7823fd63e1d2ef69c6c82be7162492af36b69b4
Instruction ID: d62488f948edcc99fa73d2eb4467b70963681ec19b110d1a79aef0cbaee4e34a
Opcode Fuzzy Hash: c93d0c80d14289c47e4e012ab7823fd63e1d2ef69c6c82be7162492af36b69b4
Instruction Fuzzy Hash: 6A81AF7260C220C5FB75EFADA2583F836A0E311B48F55C285DA8E97295D72DCA09B7C1

Function 000002733BE39E10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 000002733BE39FF0
__std_exception_destroy.LIBVCRUNTIME ref: 000002733BE39FFD

Strings

, column , xrefs: 000002733BE39EC8
at line , xrefs: 000002733BE39E9A

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: at line $, column
API String ID: 2453523683-191570568
Opcode ID: 2b99ca083d44147745e0950aefd117bb8e481d61a4d231a850388cb78075ca51
Instruction ID: 80318dc5518fd29dd52646136bea2756839cf05623fabb124cee752990d7e27b
Opcode Fuzzy Hash: 2b99ca083d44147745e0950aefd117bb8e481d61a4d231a850388cb78075ca51
Instruction Fuzzy Hash: 0351B262608B4081EA20EB1AF5883AE6761F785BD0F505351EBAD47B96DF39C681D380

Function 000002733BE0C910 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002733BE0C97F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000002733BE0C9C7
_Getctype.LIBCPMT ref: 000002733BE0CA05

Strings

bad locale name, xrefs: 000002733BE0CABE

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: std::_$GetctypeLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1612978173-1405518554
Opcode ID: 6daa0c317871165e2d2245588267f06fb10382b189967dd0ac8f71b9f87e0640
Instruction ID: ccbfb8de0d358148401bb88e708d754b089caecde9f3a2a7f758ceb60fbc9fbe
Opcode Fuzzy Hash: 6daa0c317871165e2d2245588267f06fb10382b189967dd0ac8f71b9f87e0640
Instruction Fuzzy Hash: AC515B3270AB408AFB20EF79E4543EC3375EB44748F444669DE8E26A95DB38C655E384

Function 000002733BE60F00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000002733BE60F8B

Strings

?, xrefs: 000002733BE60F40

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Open
String ID: ?
API String ID: 71445658-1684325040
Opcode ID: 3d0ddc66878d42595fa9f6f8c949674767b934469400fd24a4eeae24022c089c
Instruction ID: 6feb58d85d0992ce97f5fe28f1d5973a9b011dd640592e368e4c051975adc3e4
Opcode Fuzzy Hash: 3d0ddc66878d42595fa9f6f8c949674767b934469400fd24a4eeae24022c089c
Instruction Fuzzy Hash: 2D41A432A1CB8081EB60DB29F4843AAB7A0F7897D4F105315FA9D42A99DF7CC194DB80

Function 000002733BE99520 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002733BE99536
GetProcAddress.KERNEL32 ref: 000002733BE99546

Strings

kernel32.dll, xrefs: 000002733BE9952F
GetTempPath2W, xrefs: 000002733BE9953C

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetTempPath2W$kernel32.dll
API String ID: 1646373207-1846531799
Opcode ID: 54cfff917e61736e637f3daaf4ede8ca0052c6a8694a4254edfc7bf5cdf1c370
Instruction ID: 6c96aef7ece5d072e770e9cad764fed84ecdfc7a052970e72dda3a4239423250
Opcode Fuzzy Hash: 54cfff917e61736e637f3daaf4ede8ca0052c6a8694a4254edfc7bf5cdf1c370
Instruction Fuzzy Hash: 0DE09222B0DB4481EE18EB19F98C1A82321FF88B81F4851A5C91E07334DE3CC644A780

Function 000002733BE4F480 Relevance: 6.5, APIs: 4, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 000002733BE4ED30: CreateToolhelp32Snapshot.KERNEL32 ref: 000002733BE4ED86
Part of subcall function 000002733BE4ED30: Process32FirstW.KERNEL32 ref: 000002733BE4EDCA
Part of subcall function 000002733BE4ED30: Process32NextW.KERNEL32 ref: 000002733BE4EDDF
Part of subcall function 000002733BE4ED30: OpenProcess.KERNEL32 ref: 000002733BE4EE1B
Part of subcall function 000002733BE4ED30: OpenProcessToken.ADVAPI32 ref: 000002733BE4EE42
Part of subcall function 000002733BE4ED30: CloseHandle.KERNEL32 ref: 000002733BE4EFB6
Part of subcall function 000002733BE4ED30: Process32NextW.KERNEL32 ref: 000002733BE4EFC3
Part of subcall function 000002733BE4ED30: CloseHandle.KERNEL32 ref: 000002733BE4F007

ImpersonateLoggedOnUser.ADVAPI32 ref: 000002733BE4F4DD
ImpersonateLoggedOnUser.ADVAPI32 ref: 000002733BE4F9C8
RevertToSelf.ADVAPI32 ref: 000002733BE4F9E6

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Process32$CloseHandleImpersonateLoggedNextOpenProcessUser$CreateFirstRevertSelfSnapshotTokenToolhelp32
String ID:
API String ID: 1562318730-0
Opcode ID: 1b04c40f53ec55e2de12909e53904fdcd84ebb9b237009adbed41d140147577b
Instruction ID: 48cdcffafa11a7d7638b118e5ae22af0210015b98561600c3c162943f918d88e
Opcode Fuzzy Hash: 1b04c40f53ec55e2de12909e53904fdcd84ebb9b237009adbed41d140147577b
Instruction Fuzzy Hash: 2522C262B18B8445FB20EB7CF4583ED2761E781BA4F505741EA6D06AEADF78C5C4E380

Function 000002733BE7B248 Relevance: 6.2, APIs: 4, Instructions: 218COMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000002733BE7B364
GetLastError.KERNEL32 ref: 000002733BE7B3EF

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 051a95757f3cd31bcbf302130b81a7499006cb3b8c40f8426fd2f443c90a72fc
Instruction ID: 0904800dddc672ae936a490fa6b322d4fdf9fe187031db0649f8b1de3b1c3f69
Opcode Fuzzy Hash: 051a95757f3cd31bcbf302130b81a7499006cb3b8c40f8426fd2f443c90a72fc
Instruction Fuzzy Hash: AE91F83271865087F770EF7DA4993ED2BA0F744B88F644289EE0E57684DB34C682E780

Function 000002733BE64220 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 000002733BE64240
FreeEnvironmentStringsW.KERNEL32 ref: 000002733BE6433B
RtlInitUnicodeString.NTDLL ref: 000002733BE643AE
RtlInitUnicodeString.NTDLL ref: 000002733BE643BB

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: EnvironmentInitStringStringsUnicode$Free
String ID:
API String ID: 2488768755-0
Opcode ID: d5bee1dafb1d95a018c503b2449085841ff83489c5dfb9d12ed58605717af246
Instruction ID: c8448f5919914153222c6405eb174d77cc0f95d34ca9a7744842e1bc0b35008b
Opcode Fuzzy Hash: d5bee1dafb1d95a018c503b2449085841ff83489c5dfb9d12ed58605717af246
Instruction Fuzzy Hash: 10519A22A08B8082EB20EF19F44439D7770F798B94F549245EB9D03B95DF78D2E1D380

Function 000002733BE20120 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 000002733BE9A8FC: std::_Lockit::_Lockit.LIBCPMT ref: 000002733BE9A919
Part of subcall function 000002733BE9A8FC: std::locale::_Setgloballocale.LIBCPMT ref: 000002733BE9A93C

std::_Lockit::_Lockit.LIBCPMT ref: 000002733BE20161
std::_Lockit::_Lockit.LIBCPMT ref: 000002733BE20186
std::_Facet_Register.LIBCPMT ref: 000002733BE20232
Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE20294

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_RegisterSetgloballocalestd::locale::_
String ID:
API String ID: 3698853521-0
Opcode ID: 7fc3597cd9704a6304594a27bb2dfeeca3e59ce2e728f14c12add50f8541c22a
Instruction ID: 0434264b74049ee76d3579144ae7df12ca41a4465cbb1c5668c17be2b98f4345
Opcode Fuzzy Hash: 7fc3597cd9704a6304594a27bb2dfeeca3e59ce2e728f14c12add50f8541c22a
Instruction Fuzzy Hash: A3418E32219B4081EA35FB19F8483D973A4FB88B90F5456A2EE9D077A6DF38C645D780

Function 000002733BE70274 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002733BE702ED
_invalid_parameter_noinfo.LIBCMT ref: 000002733BE70349
_invalid_parameter_noinfo.LIBCMT ref: 000002733BE70384
_invalid_parameter_noinfo.LIBCMT ref: 000002733BE703A9

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f47f5365830de18e31c9f66efcfcebced3ed900e80df05c2fe820f8996efde49
Instruction ID: 3b4aee9f23452e85c4a8d760acac2694214c23854d245112e3fdab597ed68895
Opcode Fuzzy Hash: f47f5365830de18e31c9f66efcfcebced3ed900e80df05c2fe820f8996efde49
Instruction Fuzzy Hash: 8D416563108A84D7E772EF28E4263EC3FA4E745F45F098281E68D47387DA39C645D396

Function 000002733BE21DD0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002733BE21DFB
std::_Lockit::_Lockit.LIBCPMT ref: 000002733BE21E20
std::_Facet_Register.LIBCPMT ref: 000002733BE21ECB
Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE21F16

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: deae80201b058b93dee9511eb23f4883bce05ec3d16f28b31309998fe1f492bf
Instruction ID: bf85da4fff92dc0bed40fef84739be803d11da42fbf2e6355458fdc19ce625d6
Opcode Fuzzy Hash: deae80201b058b93dee9511eb23f4883bce05ec3d16f28b31309998fe1f492bf
Instruction Fuzzy Hash: 0A41802620DA4090EA34FB19F8483D97760F788BA4F581661EA8D4B7A5DF3CC742A780

Function 000002733BE540C0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002733BE540EB
std::_Lockit::_Lockit.LIBCPMT ref: 000002733BE54110
std::_Facet_Register.LIBCPMT ref: 000002733BE541BB
Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE54206

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: f751cf97cbdb91efc437d10692cdb5900781dee89e6afe037389110580d2090b
Instruction ID: b24b0a29fbf1bc534a62d17fc757d1be2c680b0ca5d7f3d7f5b18bcada1ff44e
Opcode Fuzzy Hash: f751cf97cbdb91efc437d10692cdb5900781dee89e6afe037389110580d2090b
Instruction Fuzzy Hash: 60419322219A4080EA35FB1AF9493D97370FBD8B94F181662DA8D477A9DF3CC641D780

Function 000002733BE339F0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002733BE33A1B
std::_Lockit::_Lockit.LIBCPMT ref: 000002733BE33A40
std::_Facet_Register.LIBCPMT ref: 000002733BE33AEB
Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE33B36

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 268a738e79390acd07def2dc4d1be91678e0d7bbd421806bae9408622498fc9b
Instruction ID: 1353b9ffafdc8d0256837b46d24327ceba53e7877841c63d012110c4bae55824
Opcode Fuzzy Hash: 268a738e79390acd07def2dc4d1be91678e0d7bbd421806bae9408622498fc9b
Instruction Fuzzy Hash: 2E419122209B4080EA34FB1AF8483D97760F788B94F1827A1EA8D477A5DF3CC745D790

Function 000002733BE54940 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002733BE5496B
std::_Lockit::_Lockit.LIBCPMT ref: 000002733BE54990
std::_Facet_Register.LIBCPMT ref: 000002733BE54A3B
Concurrency::cancel_current_task.LIBCPMT ref: 000002733BE54A86

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 225fe1b72370eebaf99dac6ca4c61f0c7a8ae1283e1f422937767657019483ac
Instruction ID: d1d39656028ba4e0e106b716a64509ef7ed6de5e0ef3933c1b463ad05c463145
Opcode Fuzzy Hash: 225fe1b72370eebaf99dac6ca4c61f0c7a8ae1283e1f422937767657019483ac
Instruction Fuzzy Hash: 8C41A222219A4081FA35EB1AF4483D97370F7C8B94F181662EA9D077A9DF3CC645D784

Function 000002733BE99704 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 000002733BE9974D
GetLastError.KERNEL32 ref: 000002733BE9975B
WideCharToMultiByte.KERNEL32 ref: 000002733BE99790
GetLastError.KERNEL32 ref: 000002733BE9979E

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 885017ec562e008ced87b7a088d7b161d23e12804f5abb955417809e776ebcf4
Instruction ID: 464702cc817b599558e201473b8da5fb1b94f2ec1e680cf2eaf63fda2a34f359
Opcode Fuzzy Hash: 885017ec562e008ced87b7a088d7b161d23e12804f5abb955417809e776ebcf4
Instruction Fuzzy Hash: 82216D76618B8487E320DF25F44834EBBB4F789F90F640268EB8897B54DF39C5058B80

Function 000002733BE99BF0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 000002733BE99520: GetModuleHandleW.KERNEL32 ref: 000002733BE99536
Part of subcall function 000002733BE99520: GetProcAddress.KERNEL32 ref: 000002733BE99546

GetLastError.KERNEL32 ref: 000002733BE99C14

Part of subcall function 000002733BE77BC4: IsProcessorFeaturePresent.KERNEL32 ref: 000002733BE77BEA

GetFileAttributesW.KERNEL32 ref: 000002733BE99C23
__std_fs_open_handle.LIBCPMT ref: 000002733BE99C4C
CloseHandle.KERNEL32 ref: 000002733BE99C5E

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: Handle$AddressAttributesCloseErrorFeatureFileLastModulePresentProcProcessor__std_fs_open_handle
String ID:
API String ID: 156590933-0
Opcode ID: ab22cb6cb8c17ed70bd3674071cc7aa31663a6931c8f4e60418ec3b925b4023f
Instruction ID: e4163b0e6b85d46b0d7ed9644028604d29b2ed118534c5082c215d9e0bca5b8d
Opcode Fuzzy Hash: ab22cb6cb8c17ed70bd3674071cc7aa31663a6931c8f4e60418ec3b925b4023f
Instruction Fuzzy Hash: 3611A72561C64045FB74E72DB88C3AA7791E7847F0F141750BAFF46AE5DA3CC648AB80

Function 000002733BE0EAA0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

[json.exception., xrefs: 000002733BE0EBDB

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID:
String ID: [json.exception.
API String ID: 0-791563284
Opcode ID: 8890b59e8ca75e1c14b035967b45d934b423924ca889e0edc636b58881abacd2
Instruction ID: b1a09ed93cf149bea3a4f7501e3f072ca64a2d208a3843eea2de8ab78bb4d080
Opcode Fuzzy Hash: 8890b59e8ca75e1c14b035967b45d934b423924ca889e0edc636b58881abacd2
Instruction Fuzzy Hash: 88713162F04B8085F720EB7EE8443DD27A1E795B94F504366EE9D17B8ACB78C281D380

Function 000002733BE54EC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002733BE54F2F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000002733BE54F77

Strings

bad locale name, xrefs: 000002733BE5504C

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 3e63ed91c755b58efa84700b8259247b457ca690d7009b472c2e321bcce58a50
Instruction ID: 60d37d0580ca2605cae9130b5a25a06bd184dcc210a9cd92beccbee956ef8956
Opcode Fuzzy Hash: 3e63ed91c755b58efa84700b8259247b457ca690d7009b472c2e321bcce58a50
Instruction Fuzzy Hash: C0518D33309A448AFB20EF79E4543EC33B4EB84748F441265EE4D27A99CE34C625E394

Function 000002733BE34780 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002733BE347EF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000002733BE34837

Strings

bad locale name, xrefs: 000002733BE34916

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 33cebd67afb6c9d3521887092eb66b60fea1dbd9b11489f81ba7abd99a6a0c28
Instruction ID: 44bf8c8c7dd582079a5b30182af8a746d7064b4a8e1a3fabff4af5fbc411ae90
Opcode Fuzzy Hash: 33cebd67afb6c9d3521887092eb66b60fea1dbd9b11489f81ba7abd99a6a0c28
Instruction Fuzzy Hash: 32515D33309B408AFB20EF78E4943EC33B4EB94748F045665EA8D67A95DE34C655E394

Function 000002733BE81068 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000002733BE86448: _invalid_parameter_noinfo.LIBCMT ref: 000002733BE8647B

_get_daylight.LIBCMT ref: 000002733BE81180
_get_daylight.LIBCMT ref: 000002733BE81191

Strings

?, xrefs: 000002733BE81111

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: cc61daf68fc51e1744773e59e44ac92936385923c50019f164254ef25fcaf87b
Instruction ID: f5c14b0d2b5fa4d41f3b79ea1702200190df080983cf4dadc372a5b1a57bec71
Opcode Fuzzy Hash: cc61daf68fc51e1744773e59e44ac92936385923c50019f164254ef25fcaf87b
Instruction Fuzzy Hash: FC41582630CBC046FB71EB29F40A3EA6690E784FA5F104365EE5D86BD5DA38C68197C1

Function 000002733BE7AF20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002733BE7B037
GetLastError.KERNEL32 ref: 000002733BE7B059

Strings

U, xrefs: 000002733BE7AFE3

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 95c1b5a9b453dd21b53d1d3abd175e481a437f6821d85bbfa209bab1ceee3d57
Instruction ID: b18c14bcb6393b98208c8e4285c762d30b9b223dca78f03ac571a2d20a8ee3be
Opcode Fuzzy Hash: 95c1b5a9b453dd21b53d1d3abd175e481a437f6821d85bbfa209bab1ceee3d57
Instruction Fuzzy Hash: 6541B572719A4086DB20EF69F8593EA67A1F798B84F404121EE4E87794DF3CC541E780

Function 000002733BE8F198 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 000002733BE8F1E8
RaiseException.KERNEL32 ref: 000002733BE8F229

Strings

csm, xrefs: 000002733BE8F216

Memory Dump Source

Source File: 00000000.00000002.1929384521.000002733BDE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002733BDE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2733bde0000_venomderek.jbxd

Yara matches

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4d2c4101b9d2858735cfea5a09a2e9289d44dfdbc7b24173af3d04f9105eea82
Instruction ID: af6bc6dbf7369faa2bbd273397b48530394f9b5510f1aade7e1b8ace9b78073a
Opcode Fuzzy Hash: 4d2c4101b9d2858735cfea5a09a2e9289d44dfdbc7b24173af3d04f9105eea82
Instruction Fuzzy Hash: 7A115B32609B8482EB61DB19F44429977E0FB88B84F184761DECD47B69DF38C651CB80

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report venomderek.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
venomderek.exe

Function 000002733BE5FB30 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 225
windowCOMMON

Function 000002733BE998C0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Function 000002733BE1B820 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 862
libraryloaderCOMMON

Function 000002733BE56480 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173
synchronizationCOMMON

Function 000002733BE8114C Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Function 000002733BE5F200 Relevance: 13.9, APIs: 9, Instructions: 408
networkfileCOMMON

Function 000002733BE9E968 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Function 000002733BE58F60 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 451
fileCOMMON

Function 000002733BE813C8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMONLIBRARYCODE

Function 000002733BE7749C Relevance: 9.2, APIs: 6, Instructions: 227
COMMON

Function 000002733BE68B70 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410
COMMON

Function 000002733BE58B30 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 194
windowCOMMON

Function 000002733BE59BE0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 250
networkCOMMON

Function 000002733BE63B30 Relevance: 13.6, APIs: 9, Instructions: 117
COMMON

Function 000002733BE7D5F0 Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre