Edit tour

Windows Analysis Report
ruppert.exe

Overview

General Information

Sample name:	ruppert.exe
Analysis ID:	1578539
MD5:	c3242cab034e773dad42d6fbff0b4ecf
SHA1:	c4b7daa973a191f9dcd6e6f637602b5683899571
SHA256:	fbe49c90e24fb5b6be83157db5a5415411b410c6b13fdb9ef12740a157f60481
Tags:	exeuser-aachum
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Suricata IDS alerts with low severity for network traffic

Terminates after testing mutex exists (may check infected machine status)

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

ruppert.exe (PID: 7156 cmdline: "C:\Users\user\Desktop\ruppert.exe" MD5: C3242CAB034E773DAD42D6FBFF0B4ECF)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "45.130.145.152", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite", "build_name": "Work", "links": "", "port": 15666}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1959053950.00000259C0E0B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: ruppert.exe PID: 7156	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: ruppert.exe PID: 7156	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.ruppert.exe.259c2a20000.0.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.ruppert.exe.259c2a20000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T21:35:12.510376+0100	2049441	1	A Network Trojan was detected	192.168.2.4	49730	45.130.145.152	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T21:35:12.510376+0100	2050806	1	A Network Trojan was detected	192.168.2.4	49730	45.130.145.152	15666	TCP
2024-12-19T21:35:12.630643+0100	2050806	1	A Network Trojan was detected	192.168.2.4	49730	45.130.145.152	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T21:35:12.510376+0100	2050807	1	A Network Trojan was detected	192.168.2.4	49730	45.130.145.152	15666	TCP
2024-12-19T21:35:12.630643+0100	2050807	1	A Network Trojan was detected	192.168.2.4	49730	45.130.145.152	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.ruppert.exe.259c2a20000.0.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "45.130.145.152", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite", "build_name": "Work", "links": "", "port": 15666}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A91EA0 CryptUnprotectData,LocalFree,	0_2_00000259C2A91EA0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A55EE0 CryptUnprotectData,LocalFree,	0_2_00000259C2A55EE0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A921C0 CryptProtectData,LocalFree,	0_2_00000259C2A921C0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AF2090 CryptUnprotectData,	0_2_00000259C2AF2090

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: ruppert.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AD9810 FindClose,FindFirstFileExW,GetLastError,		0_2_00000259C2AD9810
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AD98C0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		0_2_00000259C2AD98C0

Source: C:\Users\user\Desktop\ruppert.exe

Code function: 0_2_00000259C2AA13B0 GetLogicalDriveStringsW,

0_2_00000259C2AA13B0

Source: C:\Users\user\Desktop\ruppert.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.4:49730 -> 45.130.145.152:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.4:49730 -> 45.130.145.152:15666

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 45.130.145.152:15666

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 45.130.145.152 45.130.145.152

Source: Joe Sandbox View

ASN Name: ASBAXETNRU ASBAXETNRU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.4:49730 -> 45.130.145.152:15666

Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152

Source: C:\Users\user\Desktop\ruppert.exe

Code function: 0_2_00000259C2A9E9F0 recv,recv,closesocket,WSACleanup,

0_2_00000259C2A9E9F0

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: ruppert.exe, 00000000.00000002.1959053950.00000259C0E5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: ruppert.exe, 00000000.00000002.1959053950.00000259C0E0B000.00000004.00000020.00020000.00000000.sdmp, ruppert.exe, 00000000.00000002.1959053950.00000259C0E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Users\user\Desktop\ruppert.exe

Code function: 0_2_00000259C2A9FB30 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,EnterCriticalSection,LeaveCriticalSection,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

0_2_00000259C2A9FB30

Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AA3CF0 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,	0_2_00000259C2AA3CF0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AF26E0 NtAllocateVirtualMemory,	0_2_00000259C2AF26E0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AA43F0 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,	0_2_00000259C2AA43F0

Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2ADE968	0_2_00000259C2ADE968
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A9FB30	0_2_00000259C2A9FB30
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A5B820	0_2_00000259C2A5B820
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AA0820	0_2_00000259C2AA0820
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A5C8C0	0_2_00000259C2A5C8C0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AD98C0	0_2_00000259C2AD98C0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A4F8B0	0_2_00000259C2A4F8B0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AA8B70	0_2_00000259C2AA8B70
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A5ACC0	0_2_00000259C2A5ACC0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A4F1C0	0_2_00000259C2A4F1C0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A9F200	0_2_00000259C2A9F200
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AC114C	0_2_00000259C2AC114C
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A622D0	0_2_00000259C2A622D0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AA1FF0	0_2_00000259C2AA1FF0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A5CF60	0_2_00000259C2A5CF60
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A98F60	0_2_00000259C2A98F60
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AA70B0	0_2_00000259C2AA70B0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AA662B	0_2_00000259C2AA662B
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AAC55A	0_2_00000259C2AAC55A
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AA1660	0_2_00000259C2AA1660
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A81340	0_2_00000259C2A81340
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AB749C	0_2_00000259C2AB749C
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AC29F4	0_2_00000259C2AC29F4
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AB4A00	0_2_00000259C2AB4A00
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A79A10	0_2_00000259C2A79A10
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A88950	0_2_00000259C2A88950
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AC19B8	0_2_00000259C2AC19B8
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2ABF7F4	0_2_00000259C2ABF7F4
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A6C820	0_2_00000259C2A6C820
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AB47FC	0_2_00000259C2AB47FC
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A96760	0_2_00000259C2A96760
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AA4740	0_2_00000259C2AA4740
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A928C0	0_2_00000259C2A928C0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AB58D0	0_2_00000259C2AB58D0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A8C930	0_2_00000259C2A8C930
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AB088C	0_2_00000259C2AB088C
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A25DB0	0_2_00000259C2A25DB0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A8FDB0	0_2_00000259C2A8FDB0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AB0D98	0_2_00000259C2AB0D98
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A4FEE0	0_2_00000259C2A4FEE0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A9AE50	0_2_00000259C2A9AE50
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AC9EA0	0_2_00000259C2AC9EA0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AB8C34	0_2_00000259C2AB8C34
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A57B8D	0_2_00000259C2A57B8D
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AB2CD0	0_2_00000259C2AB2CD0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A26D20	0_2_00000259C2A26D20
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A8CC50	0_2_00000259C2A8CC50
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A951E0	0_2_00000259C2A951E0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A5A1F0	0_2_00000259C2A5A1F0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A901F0	0_2_00000259C2A901F0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A98230	0_2_00000259C2A98230
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A26180	0_2_00000259C2A26180
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A502E0	0_2_00000259C2A502E0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2ADE2CC	0_2_00000259C2ADE2CC
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A6E320	0_2_00000259C2A6E320
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A8C300	0_2_00000259C2A8C300
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A8D2A0	0_2_00000259C2A8D2A0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A8CF70	0_2_00000259C2A8CF70
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A6E130	0_2_00000259C2A6E130
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A56130	0_2_00000259C2A56130
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AB7060	0_2_00000259C2AB7060
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AB5044	0_2_00000259C2AB5044
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A8F040	0_2_00000259C2A8F040
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A59090	0_2_00000259C2A59090
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AB45F8	0_2_00000259C2AB45F8
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A8C600	0_2_00000259C2A8C600
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A26610	0_2_00000259C2A26610
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A755B0	0_2_00000259C2A755B0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A686D0	0_2_00000259C2A686D0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A84710	0_2_00000259C2A84710
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A766A0	0_2_00000259C2A766A0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A906A6	0_2_00000259C2A906A6
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AAB68A	0_2_00000259C2AAB68A
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AA43F0	0_2_00000259C2AA43F0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AC13C8	0_2_00000259C2AC13C8
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A483D0	0_2_00000259C2A483D0
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A45520	0_2_00000259C2A45520
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AA0500	0_2_00000259C2AA0500
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A46510	0_2_00000259C2A46510

Source: C:\Users\user\Desktop\ruppert.exe	Code function: String function: 00000259C2A4B930 appears 32 times
Source: C:\Users\user\Desktop\ruppert.exe	Code function: String function: 00000259C2A65330 appears 70 times
Source: C:\Users\user\Desktop\ruppert.exe	Code function: String function: 00000259C2A54C00 appears 41 times

Source: classification engine

Classification label: mal92.troj.spyw.winEXE@1/0@1/2

Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AA5970 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,		0_2_00000259C2AA5970
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AF2008 AdjustTokenPrivileges,CredEnumerateA,		0_2_00000259C2AF2008

Source: C:\Users\user\Desktop\ruppert.exe

Code function: 0_2_00000259C2A5C8C0 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00000259C2A5C8C0

Source: C:\Users\user\Desktop\ruppert.exe

Code function: 0_2_00000259C2A8F1C7 CoCreateInstance,

0_2_00000259C2A8F1C7

Source: C:\Users\user\Desktop\ruppert.exe

Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E69638D28E841

Source: ruppert.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ruppert.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\ruppert.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\ruppert.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: ruppert.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: ruppert.exe

Static file information: File size 2749952 > 1048576

Source: ruppert.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x24bc00

Source: ruppert.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ruppert.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ruppert.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ruppert.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ruppert.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ruppert.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: ruppert.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: ruppert.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: ruppert.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: ruppert.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: ruppert.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: ruppert.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: ruppert.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\ruppert.exe

Code function: 0_2_00000259C2A5B820 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_00000259C2A5B820

Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A9E874 push rbx; iretd		0_2_00000259C2A9E875
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2A9E89C push rbx; iretd		0_2_00000259C2A9E89D

Source: C:\Users\user\Desktop\ruppert.exe

Code function: 0_2_00000259C2A96480 ExitProcess,OpenMutexA,ExitProcess,CreateMutexA,CreateMutexExA,ExitProcess,ReleaseMutex,CloseHandle,

0_2_00000259C2A96480

Source: C:\Users\user\Desktop\ruppert.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AD9810 FindClose,FindFirstFileExW,GetLastError,		0_2_00000259C2AD9810
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AD98C0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		0_2_00000259C2AD98C0

Source: C:\Users\user\Desktop\ruppert.exe

Code function: 0_2_00000259C2AA13B0 GetLogicalDriveStringsW,

0_2_00000259C2AA13B0

Source: C:\Users\user\Desktop\ruppert.exe

Code function: 0_2_00000259C2AB7348 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

0_2_00000259C2AB7348

Source: C:\Users\user\Desktop\ruppert.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: ruppert.exe, 00000000.00000002.1959053950.00000259C0E71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: ruppert.exe, 00000000.00000002.1959053950.00000259C0E0B000.00000004.00000020.00020000.00000000.sdmp, ruppert.exe, 00000000.00000002.1959053950.00000259C0E71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\ruppert.exe	API call chain: ExitProcess graph end node			graph_0-65161
Source: C:\Users\user\Desktop\ruppert.exe	API call chain: ExitProcess graph end node			graph_0-65166

Source: C:\Users\user\Desktop\ruppert.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\ruppert.exe

Code function: 0_2_00000259C2AA43F0 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,

0_2_00000259C2AA43F0

Source: C:\Users\user\Desktop\ruppert.exe

Code function: 0_2_00000259C2ADBB14 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00000259C2ADBB14

Source: C:\Users\user\Desktop\ruppert.exe

Code function: 0_2_00000259C2ADBB14 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00000259C2ADBB14

Source: C:\Users\user\Desktop\ruppert.exe

Code function: 0_2_00000259C2A5B820 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_00000259C2A5B820

Source: C:\Users\user\Desktop\ruppert.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AAF920 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00000259C2AAF920
Source: C:\Users\user\Desktop\ruppert.exe	Code function: 0_2_00000259C2AF22D8 SetUnhandledExceptionFilter,		0_2_00000259C2AF22D8

Source: C:\Users\user\Desktop\ruppert.exe

Code function: 0_2_00000259C2A951E0 ShellExecuteW,

0_2_00000259C2A951E0

Source: C:\Users\user\Desktop\ruppert.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00000259C2AC795C
Source: C:\Users\user\Desktop\ruppert.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00000259C2AC7778
Source: C:\Users\user\Desktop\ruppert.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00000259C2AC6F14
Source: C:\Users\user\Desktop\ruppert.exe	Code function: EnumSystemLocalesW,	0_2_00000259C2ABBC68
Source: C:\Users\user\Desktop\ruppert.exe	Code function: GetLocaleInfoW,	0_2_00000259C2ABC1A8
Source: C:\Users\user\Desktop\ruppert.exe	Code function: EnumSystemLocalesW,	0_2_00000259C2AC7270
Source: C:\Users\user\Desktop\ruppert.exe	Code function: EnumSystemLocalesW,	0_2_00000259C2AC7340
Source: C:\Users\user\Desktop\ruppert.exe	Code function: GetLocaleInfoW,	0_2_00000259C2AF2398
Source: C:\Users\user\Desktop\ruppert.exe	Code function: GetLocaleInfoEx,FormatMessageA,	0_2_00000259C2AD9480

Source: C:\Users\user\Desktop\ruppert.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\ruppert.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\Desktop\ruppert.exe

Code function: 0_2_00000259C2ACDC18 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00000259C2ACDC18

Source: C:\Users\user\Desktop\ruppert.exe

Code function: 0_2_00000259C2AA0110 GetUserNameW,

0_2_00000259C2AA0110

Source: C:\Users\user\Desktop\ruppert.exe

Code function: 0_2_00000259C2AC114C _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00000259C2AC114C

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: ruppert.exe PID: 7156, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.ruppert.exe.259c2a20000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ruppert.exe.259c2a20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1959053950.00000259C0E0B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ruppert.exe PID: 7156, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: ruppert.exe, 00000000.00000002.1959053950.00000259C0E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum-LTC\config
Source: ruppert.exe, 00000000.00000002.1959053950.00000259C0E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\wallets
Source: ruppert.exe, 00000000.00000002.1959053950.00000259C0E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: ruppert.exe, 00000000.00000002.1959053950.00000259C0E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: ruppert.exe, 00000000.00000002.1959053950.00000259C0E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: ruppert.exe, 00000000.00000002.1959053950.00000259C0E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\ruppert.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\ruppert.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\ruppert.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\ruppert.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: ruppert.exe PID: 7156, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.ruppert.exe.259c2a20000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ruppert.exe.259c2a20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1959053950.00000259C0E0B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ruppert.exe PID: 7156, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Access Token Manipulation	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Query Registry	Remote Desktop Protocol	1 Email Collection	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	2 Obfuscated Files or Information	Security Account Manager	21 Security Software Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	2 Process Discovery	Distributed Component Object Model	2 Data from Local System	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Account Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	3 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	24 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.13.205	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	ruppert.exe, 00000000.00000002.1959053950.00000259C0E5C000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
45.130.145.152	unknown	Russian Federation		49392	ASBAXETNRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578539
Start date and time:	2024-12-19 21:34:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ruppert.exe
Detection:	MAL
Classification:	mal92.troj.spyw.winEXE@1/0@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 71 Number of non-executed functions: 115
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: ruppert.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.13.205	BiXS3FRoLe.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	lEUy79aLAW.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	Simple1.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
45.130.145.152	apilibx64.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	venomderek.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	siveria.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	unique.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	siveria.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	chelentano.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	bv2DbIiZeK.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	DHL_231437894819.bat.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	4089137200.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	iviewers.dll	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	script.ps1	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	script.hta	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	WdlA0C4PkO.exe	Get hash	malicious	Go Stealer, Skuld Stealer	Browse	104.26.12.205
	cali.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Awb 4586109146.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	PO 0309494059506060609696007.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	Harrisassoc_Updated_Workplace_Policies_and_Compliance_Guidelines.pdf.pdf	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://supercrete.lk/m/ms_doc.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Employee_Letter.PDFuJPefyDW1j.url	Get hash	malicious	Unknown	Browse	172.67.134.25
	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, LummaC Stealer	Browse	104.26.0.231
	bad.txt	Get hash	malicious	AsyncRAT	Browse	104.21.84.67
	wp-cent.exe	Get hash	malicious	Python BackDoor	Browse	104.20.22.46
	wp-cent.exe	Get hash	malicious	Python BackDoor	Browse	104.20.22.46
	(Lhambright)VWAV.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://usps.com-dscd.top/mum	Get hash	malicious	Unknown	Browse	172.67.202.68
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.67.146
	https://ap1s.net/Dm7jH	Get hash	malicious	Unknown	Browse	172.67.73.44
ASBAXETNRU	SwJD3kiOwV.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	194.87.47.113
	8dw8GAvqmM.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	194.87.47.113
	UYJ0oreVew.exe	Get hash	malicious	Unknown	Browse	194.87.47.113
	L1SrJoDQvG.exe	Get hash	malicious	Unknown	Browse	194.87.47.113
	Ry6ot1YULB.exe	Get hash	malicious	Unknown	Browse	194.87.47.113
	Cc8zEnIDB2.exe	Get hash	malicious	Unknown	Browse	194.87.47.113
	wlEp68Few5.exe	Get hash	malicious	Unknown	Browse	194.87.47.113
	rJvOqHxkuI.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	194.87.47.113
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	194.87.47.113
	NWKk493xTy.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	194.87.47.113

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	104.26.13.205
	2JSGOlbNym.dll	Get hash	malicious	Unknown	Browse	104.26.13.205
	4hSuRTwnWJ.dll	Get hash	malicious	Unknown	Browse	104.26.13.205
	QCTYoyX422.dll	Get hash	malicious	Unknown	Browse	104.26.13.205
	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.13.205
	PAYMENT ADVICE 750013-1012449943-81347-pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.13.205
	INVOICE-0098.pdf ... .lnk.lnk.d.lnk	Get hash	malicious	Unknown	Browse	104.26.13.205
	YinLHGpoX4.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	104.26.13.205
	F8HYX5HOgA.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	104.26.13.205
	0iTxQouy7k.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	104.26.13.205

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	3.8982634434194434
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ruppert.exe
File size:	2'749'952 bytes
MD5:	c3242cab034e773dad42d6fbff0b4ecf
SHA1:	c4b7daa973a191f9dcd6e6f637602b5683899571
SHA256:	fbe49c90e24fb5b6be83157db5a5415411b410c6b13fdb9ef12740a157f60481
SHA512:	e74a8e474f4385531387e0f51cff631a8e7c0eacb5d23021f0ac4701f356f869889472814cc5856aef776fefa8703a94578af4feec8e037d89cbe95a409027c3
SSDEEP:	24576:V9L8hJZ4uB+Ch0lhSMXl84BqdrZdJAxl21KPETU6D5Q:PL8hD4au/qdrZdyw1KP91
TLSH:	58D5F186B3A804F9E1BB9278C8D60A46E777781503519BCF03A486B22F376D35E3E751
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\7...V...V...V.......V.......V.......V......yV..S....V..S....V..S....V.. ....V..P...<V..S....V...V...V..S....V..S.a..V..S....V.

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14003e230
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6762C4F4 [Wed Dec 18 12:49:56 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	259e8414ffd4b8ab603913db518e276c

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FB300C2FB4Ch
dec eax
add esp, 28h
jmp 00007FB300C2EFBFh
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007FB300C2F152h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007FB300C2F155h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007FB300C2F14Dh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007FB300C2EB86h
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0000FE37h]
dec eax
mov ecx, ebx
call dword ptr [0000FE26h]
call dword ptr [0000FD90h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [0000FE1Ch]
dec eax
mov dword ptr [esp+00h], ecx

Rich Headers

Programming Language:

[IMP] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x298c04	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2a3000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x29e000	0x4038	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2a4000	0xad0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x290d80	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x290c40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4e000	0x438	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4cdc0	0x4ce00	f0c0ea36bf296498c8b89c1a1671ba6c	False	0.5267625762195122	data	6.539312086987541	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x4e000	0x24ba3a	0x24bc00	7fa4e16ad0e9ae511ee69b6e0f726de7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x29a000	0x330c	0x1800	d1ebd331d3cf6c8adbb31602bd239ee4	False	0.1865234375	data	3.2382802275840623	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x29e000	0x4038	0x4200	8411825e2467307cedb8b6c4f15d3cdf	False	0.47123579545454547	data	5.575992239724539	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x2a3000	0x1e0	0x200	fd7f3c77b3b8152760b71a549e0deae5	False	0.52734375	data	4.7113407225994175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2a4000	0xad0	0xc00	49c311309af6d41eb0a329b47e6c6fcc	False	0.4716796875	data	5.228340394510781	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x2a3060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
ntdll.dll	RtlImageDirectoryEntryToData, RtlLeaveCriticalSection, RtlEnterCriticalSection, RtlCompareMemory, NtProtectVirtualMemory, RtlImageNtHeader, NtQueryVirtualMemory, RtlGetNtVersionNumbers
KERNEL32.dll	FreeEnvironmentStringsW, GetEnvironmentStringsW, VirtualFree, VirtualAlloc, GetModuleHandleW, LoadLibraryA, ReadFile, WriteFile, CreateFileW, CloseHandle, GetProcAddress, GetCurrentProcess, FlushInstructionCache, VirtualQuery, WriteProcessMemory, EnterCriticalSection, GetModuleFileNameW, LeaveCriticalSection, GetModuleHandleA, MultiByteToWideChar, GetWindowsDirectoryW, ExitProcess, WideCharToMultiByte, GetLastError, SetLastError, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, CreateThread, ExitThread, FreeLibrary, FreeLibraryAndExitThread, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, GetCurrentThreadId, DeleteCriticalSection, GetStdHandle, GetFileType, GetStartupInfoW, RaiseException, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, InitializeCriticalSectionAndSpinCount, GetSystemTimeAsFileTime, LoadLibraryExW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, HeapReAlloc, HeapSize, GetProcessHeap, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetStringTypeW, GetFileSizeEx, SetFilePointerEx, SetStdHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadConsoleW, WriteConsoleW, GetCurrentProcessId, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, RtlUnwind, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, WakeAllConditionVariable, QueryPerformanceCounter, LCMapStringEx, DecodePointer, InitializeCriticalSectionEx, GetFileInformationByHandleEx, FormatMessageA, QueryPerformanceFrequency, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, Sleep, WaitForSingleObjectEx, GetExitCodeThread, LocalFree, GetLocaleInfoEx, FindClose, FindFirstFileW, FindFirstFileExW, FindNextFileW, GetFileAttributesExW, AreFileApisANSI
USER32.dll	LoadAcceleratorsW, LoadAcceleratorsA
ADVAPI32.dll	GetTokenInformation, OpenProcessToken
OLEAUT32.dll	SysAllocString, SafeArrayPutElement, SafeArrayUnaccessData, SafeArrayCreate, SafeArrayCreateVector, SafeArrayAccessData, SysFreeString, SafeArrayDestroy
mscoree.dll	CLRCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T21:35:12.510376+0100	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.4	49730	45.130.145.152	15666	TCP
2024-12-19T21:35:12.510376+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	49730	45.130.145.152	15666	TCP
2024-12-19T21:35:12.510376+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49730	45.130.145.152	15666	TCP
2024-12-19T21:35:12.630643+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	49730	45.130.145.152	15666	TCP
2024-12-19T21:35:12.630643+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49730	45.130.145.152	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 21:35:09.687438011 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:09.807188988 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:09.807409048 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:10.001025915 CET	49731	443	192.168.2.4	104.26.13.205
Dec 19, 2024 21:35:10.001091003 CET	443	49731	104.26.13.205	192.168.2.4
Dec 19, 2024 21:35:10.001178980 CET	49731	443	192.168.2.4	104.26.13.205
Dec 19, 2024 21:35:10.005861044 CET	49731	443	192.168.2.4	104.26.13.205
Dec 19, 2024 21:35:10.005884886 CET	443	49731	104.26.13.205	192.168.2.4
Dec 19, 2024 21:35:11.230437040 CET	443	49731	104.26.13.205	192.168.2.4
Dec 19, 2024 21:35:11.230510950 CET	49731	443	192.168.2.4	104.26.13.205
Dec 19, 2024 21:35:11.422660112 CET	49731	443	192.168.2.4	104.26.13.205
Dec 19, 2024 21:35:11.422708035 CET	443	49731	104.26.13.205	192.168.2.4
Dec 19, 2024 21:35:11.423352957 CET	443	49731	104.26.13.205	192.168.2.4
Dec 19, 2024 21:35:11.423412085 CET	49731	443	192.168.2.4	104.26.13.205
Dec 19, 2024 21:35:11.424673080 CET	49731	443	192.168.2.4	104.26.13.205
Dec 19, 2024 21:35:11.471338034 CET	443	49731	104.26.13.205	192.168.2.4
Dec 19, 2024 21:35:11.757958889 CET	443	49731	104.26.13.205	192.168.2.4
Dec 19, 2024 21:35:11.758028030 CET	443	49731	104.26.13.205	192.168.2.4
Dec 19, 2024 21:35:11.758033991 CET	49731	443	192.168.2.4	104.26.13.205
Dec 19, 2024 21:35:11.758068085 CET	49731	443	192.168.2.4	104.26.13.205
Dec 19, 2024 21:35:11.758421898 CET	49731	443	192.168.2.4	104.26.13.205
Dec 19, 2024 21:35:11.758445024 CET	443	49731	104.26.13.205	192.168.2.4
Dec 19, 2024 21:35:12.510375977 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.630338907 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.630353928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.630362988 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.630366087 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.630372047 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.630383968 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.630431890 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.630443096 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.630564928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.630574942 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.630642891 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.750436068 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.750456095 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.750551939 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.750564098 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.750581980 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.750610113 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.750624895 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.750654936 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.750684977 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.750694036 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.750746965 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.750765085 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.750814915 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.794576883 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.794631958 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.869528055 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.869538069 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.869668007 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.870477915 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.870486975 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.870526075 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.870543003 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.870553970 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.870584965 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.870595932 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.870635986 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.870707035 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.870764017 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.870779037 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.870824099 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.870837927 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.870893002 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.989120960 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.989248037 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.989293098 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.989358902 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.989401102 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.989413977 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.989425898 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.989448071 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.989470959 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.989499092 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.989516020 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.989541054 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.989552975 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.989557981 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.989608049 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.989628077 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.989655018 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.989696026 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.989712954 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.989743948 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.989765882 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.989778996 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.989809036 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.989820957 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.989840031 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.989851952 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.989870071 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.989881992 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.989914894 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.989952087 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.989999056 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.990156889 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.990206957 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.990520000 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.990550995 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.990561962 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.990577936 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.990592003 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.990614891 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.990628004 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.990643024 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.990660906 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.990680933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.990695000 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.990710020 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.990720987 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.990744114 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.990756035 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.990786076 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.990799904 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.990812063 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.990825891 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.990847111 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.990863085 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.990875959 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.990889072 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.990909100 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.990919113 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.990941048 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.990966082 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.990986109 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.991003036 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.991043091 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.991060972 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.991072893 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.991102934 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.991125107 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.991154909 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.991169930 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.991199970 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.991213083 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.991230011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.991241932 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.991272926 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.991283894 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.991295099 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.991309881 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.991329908 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.991353989 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.991367102 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.991379976 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.991408110 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.991421938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.991434097 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.991451979 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:12.991471052 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:12.991496086 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.109011889 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.109066010 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.109080076 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.109102011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.109122992 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.109158993 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.109265089 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.109277964 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.109292030 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.109307051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.109323025 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.109354973 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.109389067 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.109410048 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.109424114 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.109474897 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.109491110 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.109532118 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.109544992 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.109592915 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.109606028 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.109628916 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.109652042 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.109673977 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.109714031 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.109739065 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.109761000 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.109786987 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.109822989 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.109836102 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.109850883 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.109879971 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.109894991 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.109930992 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.109946012 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.109960079 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.109976053 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.110008955 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.110019922 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.110032082 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.110063076 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.110086918 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.110162973 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.110199928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.110212088 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.110245943 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.110258102 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.110279083 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.110295057 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.110326052 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.110374928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.110393047 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.110423088 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.110444069 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.110460043 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.110471964 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.110512018 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.110522032 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.110547066 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.110563993 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.110594034 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.110660076 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.110691071 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.110712051 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.110735893 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.110769987 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.110799074 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.110821962 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.110840082 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.110905886 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.110930920 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.110955000 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.110975027 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.111020088 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.111083031 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.112178087 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.112190962 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.112235069 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.112287998 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.112299919 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.112349987 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.112369061 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.112381935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.112396955 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.112411022 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.112426996 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.112447023 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.112462044 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.112502098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.112535954 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.112582922 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.112709999 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.112724066 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.112771988 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.112824917 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.112848043 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.112864017 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.112878084 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.112895012 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.112916946 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.112947941 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.112962008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.112976074 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.112994909 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.113028049 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.113044977 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.113058090 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.113096952 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.113128901 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.113142967 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.113154888 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.113178015 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.113195896 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.113207102 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.113224030 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.113236904 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.113260984 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.113275051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.113289118 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.113302946 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.113334894 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.113352060 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.113368034 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.113415956 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.113444090 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.113456011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.113467932 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.113486052 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.113501072 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.113521099 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.113534927 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.113545895 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.113574028 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.113584995 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.113626957 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.113662958 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.113713026 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.113724947 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.113773108 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.113782883 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.113796949 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.113814116 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.113827944 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.113842964 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.113864899 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.113873959 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.113912106 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.113961935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.113976002 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.114012957 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.114028931 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.114097118 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.114109039 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.114137888 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.114156961 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.114175081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.114187002 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.114221096 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.114244938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.114270926 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.114303112 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.114315033 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.114329100 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.114341021 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.114357948 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.114379883 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.114397049 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.114414930 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.114448071 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.114486933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.114500046 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.114533901 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.114552975 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.228779078 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.228816032 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.228857040 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.228888035 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.228914976 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.228926897 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.228940964 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.228976011 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.228991032 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.229018927 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.229032040 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.229078054 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.229154110 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.229166985 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.229213953 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.229259968 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.229273081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.229295969 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.229309082 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.229324102 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.229346037 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.229357958 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.229378939 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.229403973 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.229414940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.229427099 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.229468107 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.229491949 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.229507923 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.229547024 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.229573011 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.229587078 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.229625940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.229636908 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.229650974 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.229675055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.229700089 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.229718924 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.229731083 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.229764938 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.229789019 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.229800940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.229849100 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.229875088 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.229898930 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.229912043 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.229935884 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.229949951 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.229964018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.229979992 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.230000973 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.230011940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.230031013 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.230051041 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.230058908 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.230091095 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.230108023 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.230138063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.230154991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.230175018 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.230200052 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.230215073 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.230222940 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.230247974 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.230259895 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.230279922 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.230292082 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.230307102 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.230335951 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.230346918 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.230365992 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.230413914 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.230444908 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.230496883 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.230518103 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.230530977 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.230576992 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.230601072 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.230628967 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.230642080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.230678082 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.230691910 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.230701923 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.230739117 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.230750084 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.230799913 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.230822086 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.230834007 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.230874062 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.230895996 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.230933905 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.230946064 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.230969906 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.230983019 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.230999947 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.231014013 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.231025934 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.231062889 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.231074095 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.231100082 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.231112003 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.231127024 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.231138945 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.231149912 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.231168985 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.231188059 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.231201887 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.231215000 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.231237888 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.231251001 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.231292009 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.231307983 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.231344938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.231357098 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.231396914 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.231409073 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.231427908 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.231445074 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.231479883 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.231487989 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.231502056 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.231534958 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.231548071 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.231564999 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.231578112 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.231618881 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.231672049 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.231683969 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.231719971 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.231755018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.231807947 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.231821060 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.231862068 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.231892109 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.231914043 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.231941938 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.231973886 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.231991053 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.232029915 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.232042074 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.232074976 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.232085943 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.232103109 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.232131004 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.232147932 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.232155085 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.232181072 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.232198000 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.232230902 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.232248068 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.232279062 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.232295036 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.232342958 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.233481884 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.233536959 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.233566046 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.233578920 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.233616114 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.233632088 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.233660936 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.233675957 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.233710051 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.233726025 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.233747005 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.233760118 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.233809948 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.233833075 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.233848095 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.233896971 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.233939886 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.233952045 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.233967066 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.233988047 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.234002113 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.234016895 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.234049082 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.234070063 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.234083891 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.234126091 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.234146118 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.234163046 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.234189034 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.234210014 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.234236002 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.234282970 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.234303951 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.234329939 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.234354019 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.234452009 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.234463930 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.234476089 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.234488010 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.234498978 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.234534025 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.234635115 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.234647989 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.234659910 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.234673023 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.234702110 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.234723091 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.234735966 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.234751940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.234771013 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.234814882 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.234826088 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.234838963 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.234850883 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.234863043 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.234880924 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.234894991 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.234916925 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.234930038 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.234954119 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.234970093 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.234987020 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.234999895 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235011101 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235023022 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235034943 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.235049963 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235064983 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.235084057 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.235100031 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235107899 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.235121965 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235146999 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.235167980 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.235186100 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235197067 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235208988 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235220909 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235234022 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235255003 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.235270977 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.235285044 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.235297918 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235327959 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235348940 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.235361099 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235375881 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.235409975 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.235452890 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235466003 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235536098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.235557079 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235569000 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235613108 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.235649109 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235661983 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235686064 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235704899 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235714912 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.235734940 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.235760927 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.235804081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235846043 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235857964 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.235872030 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235898972 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.235919952 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.235934973 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235946894 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235985994 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.235995054 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.236017942 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.236033916 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.236063004 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.236080885 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.236093998 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.236135960 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.236174107 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.236195087 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.236223936 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.236253023 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.236265898 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.236279011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.236313105 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.236330986 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.236368895 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.236381054 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.236419916 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.236444950 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.236464024 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.236476898 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.236511946 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.236531973 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.236550093 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.236561060 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.236612082 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.236627102 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.236639977 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.236654043 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.236675978 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.236716032 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.236736059 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.236747980 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.236758947 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.236788988 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.236804962 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.236860037 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.236872911 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.236907959 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.236929893 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.236953974 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.236965895 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.237004995 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.237014055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.237031937 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.237056971 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.237071991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.237082958 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.237099886 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.237118959 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.237143993 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.237159014 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.237171888 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.237217903 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.237227917 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.237246037 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.237258911 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.237274885 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.237296104 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.237308979 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.237323046 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.237349987 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.237360954 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.237396002 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.237407923 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.237421036 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.237452984 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.237473965 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.237551928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.237564087 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.237576008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.237588882 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.237601995 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.237617016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.237642050 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.237663984 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.237677097 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.237693071 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.237704992 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.237720013 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.237740993 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.237756968 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.348593950 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.348613024 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.348685980 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.348743916 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.348757982 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.348797083 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.348809958 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.348877907 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.348912001 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.348925114 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.348973036 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.349024057 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.349037886 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.349075079 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.349093914 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.349297047 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.349349022 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.349369049 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.349420071 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.349558115 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.349572897 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.349673033 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.349713087 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.349725008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.349755049 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.349775076 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.349797010 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.349836111 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.349849939 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.349900961 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.349909067 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.349926949 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.349942923 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.349966049 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.350017071 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.350052118 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.350065947 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.350095987 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.350142002 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.350156069 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.350193024 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.350214005 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.350264072 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.350302935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.350318909 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.350336075 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.350347042 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.350382090 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.350435972 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.350457907 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.350481987 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.350498915 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.350574017 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.350600004 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.350631952 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.350649118 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.350697994 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.350709915 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.350749969 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.350776911 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.350790977 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.350824118 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.350843906 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.350856066 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.350884914 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.350898027 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.350936890 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.350986958 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.351007938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.351032972 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.351052999 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.351064920 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.351095915 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.351106882 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.351139069 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.351279974 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.351293087 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.351305008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.351326942 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.351341009 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.351356030 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.351372004 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.351389885 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.351418018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.351433039 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.351469040 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.351484060 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.351497889 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.351517916 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.351538897 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.351558924 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.351577997 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.351603985 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.351629019 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.351730108 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.351753950 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.351778030 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.351799965 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.351839066 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.351850986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.351898909 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.351938009 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.351949930 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.351982117 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.352005005 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.352034092 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.352050066 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.352082968 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.352097988 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.352138042 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.352155924 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.352178097 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.352190971 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.352202892 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.352247000 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.352272034 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.352300882 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.352322102 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.352343082 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.352358103 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.352408886 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.352430105 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.352442980 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.352457047 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.352475882 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.352489948 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.352505922 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.352518082 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.352530003 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.352557898 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.352569103 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.352586985 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.352602959 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.352663994 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.352679014 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.352690935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.352722883 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.352750063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.352781057 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.352829933 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.352874041 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.352886915 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.352899075 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.352929115 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.352955103 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.352968931 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.352981091 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.353010893 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.353035927 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.353064060 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.353076935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.353099108 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.353116035 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.353130102 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.353143930 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.353157997 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.353202105 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.353219032 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.353250980 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.353262901 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.353293896 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.353363037 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.353404045 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.353421926 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.353432894 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.353462934 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.353485107 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.353497028 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.353528976 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.353598118 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.353624105 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.353637934 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.353653908 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.353665113 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.353696108 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.353730917 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.353743076 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.353775024 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.353790045 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.353812933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.353825092 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.353851080 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.353873014 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.353985071 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354008913 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354028940 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354048014 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354062080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354074955 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354089022 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354100943 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354120970 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354129076 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354140043 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354160070 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354176044 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354187965 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354218006 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354240894 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354250908 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354264021 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354301929 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354315042 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354334116 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354353905 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354377031 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354389906 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354403973 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354417086 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354428053 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354458094 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354485989 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354497910 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354526043 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354552984 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354569912 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354600906 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354617119 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354640007 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354651928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354665995 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354681015 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354695082 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354707003 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354732990 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354749918 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354783058 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354794025 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354810953 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354823112 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354849100 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354901075 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354916096 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354942083 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354965925 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.354983091 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.354995966 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.355012894 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.355026007 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.355045080 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.355065107 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.355081081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.355096102 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.355108976 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.355123997 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.355144024 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.355163097 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.355180025 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.355223894 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.355329990 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.355364084 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.355384111 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.355402946 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.355415106 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.355443001 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.355521917 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.355568886 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.355700970 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.355715036 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.355753899 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.355777979 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.355807066 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.355822086 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.355851889 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.355869055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.356004000 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.356054068 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.356112003 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.356164932 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.356221914 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.356270075 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.356489897 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.356539965 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.356595039 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.356626987 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.356640100 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.356674910 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.356817961 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.356868982 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.356985092 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.357033968 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.357124090 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.357172012 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.357199907 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.357261896 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.358464003 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.358513117 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.358545065 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.358586073 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.358629942 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.358644009 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.358674049 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.358719110 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.358747005 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.358768940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.358783960 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.358802080 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.358820915 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.358836889 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.358869076 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.358892918 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.358906984 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.358922005 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.358947992 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.358967066 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.358985901 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.359021902 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.359056950 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.359070063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.359110117 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.359122038 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.359164000 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.359193087 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.359239101 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.359260082 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.359307051 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.359354019 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.359415054 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.359446049 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.359491110 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.359513044 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.359540939 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.359647989 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.359661102 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.359705925 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.359786987 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.359811068 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.359824896 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.359838963 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.359853983 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.359878063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.359930992 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.359944105 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.359973907 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.359994888 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.360022068 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.360068083 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.360084057 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.360111952 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.360131979 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.360157967 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.360187054 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.360239983 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.360256910 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.360299110 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.360354900 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.360383987 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.360404015 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.360430002 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.360450029 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.360501051 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.360528946 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.360577106 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.360621929 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.360634089 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.360656977 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.360670090 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.360687017 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.360718966 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.360779047 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.360793114 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.360826015 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.360846043 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.360929966 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.360941887 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.360965014 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.360980034 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.361004114 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.361021996 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.361089945 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.361102104 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.361139059 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.361159086 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.361181021 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.361221075 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.361238003 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.361258030 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.361270905 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.361299038 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.361315966 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.361330032 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.361356974 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.361378908 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.361421108 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.361466885 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.361547947 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.361592054 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.361629009 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.361646891 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.361679077 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.361701965 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.361726999 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.361762047 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.361778975 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.361815929 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.361826897 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.361850023 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.361880064 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.361896992 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.361918926 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.361933947 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.361949921 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.361980915 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.362009048 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.362051010 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.362145901 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.362159014 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.362206936 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.362273932 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.362286091 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.362298012 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.362309933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.362334013 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.362375021 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.362402916 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.362415075 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.362459898 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.362492085 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.362504005 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.362531900 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.362561941 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.362587929 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.362622023 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.362665892 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.362680912 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.362726927 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.362760067 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.362807989 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.362824917 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.362869024 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.362885952 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.362931013 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.362970114 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.363018036 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.364154100 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.364295006 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.364356041 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.468491077 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.468561888 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.468600988 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.468616009 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.468637943 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.468666077 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.468684912 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.468736887 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.468761921 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.468806982 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.468868017 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.468893051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.468913078 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.468936920 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.469084024 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.469106913 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.469132900 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.469161034 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.469181061 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.469234943 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.469350100 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.469402075 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.469552994 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.469598055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.469613075 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.469672918 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.469701052 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.469713926 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.469743967 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.469768047 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.469779015 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.469811916 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.469919920 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.469965935 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.470004082 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.470055103 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.470076084 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.470118999 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.470144033 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.470160007 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.470189095 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.470212936 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.470237017 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.470283031 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.470313072 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.470343113 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.470355034 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.470376015 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.470388889 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.470417976 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.470477104 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.470489979 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.470501900 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.470514059 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.470532894 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.470549107 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.470561981 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.470606089 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.470623970 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.470638037 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.470664024 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.470679045 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.470700026 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.470711946 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.470726967 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.470738888 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.470748901 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.470766068 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.470782042 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.470808983 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.470822096 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.470856905 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.470870972 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.470887899 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.470901012 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.470930099 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.470940113 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.470961094 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.470978975 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.470999002 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.471028090 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.471055031 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.471067905 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.471081972 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.471093893 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.471110106 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.471120119 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.471132994 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.471160889 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.471180916 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.471193075 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.471218109 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.471240044 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.471263885 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.471295118 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.471307039 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.471339941 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.471396923 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.471409082 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.471436024 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.471450090 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.471488953 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.471502066 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.471524954 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.471551895 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.471565008 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.471580982 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.471620083 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.471647024 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.471659899 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.471690893 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.471704006 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.471728086 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.471743107 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.471755981 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.471769094 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.471782923 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.471801996 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.471810102 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.471838951 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.471863985 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.471894979 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.471910954 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.471934080 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.471955061 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.471996069 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.472014904 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.472055912 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.472064018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.472078085 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.472095013 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.472111940 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.472136021 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.472148895 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.472188950 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.472210884 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.472223043 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.472238064 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.472253084 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.472265959 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.472281933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.472290993 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.472305059 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.472322941 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.472335100 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.472346067 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.472369909 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.472383022 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.472394943 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.472407103 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.472424984 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.472434998 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.472453117 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.472466946 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.472493887 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.472520113 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.472534895 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.472559929 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.472579002 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.472656012 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.472667933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.472713947 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.472738981 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.472753048 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.472774982 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.472793102 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.472811937 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.472824097 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.472851038 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.472871065 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.472892046 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.472929955 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.472969055 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.473006010 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.473036051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.473047972 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.473074913 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.473090887 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.473139048 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.473151922 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.473182917 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.473200083 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.473368883 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.473392010 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.473408937 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.473428965 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.473437071 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.473470926 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.473603010 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.473617077 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.473644018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.473661900 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.473680973 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.473721981 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.473757029 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.473800898 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.473820925 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.473865986 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.473884106 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.473903894 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.473933935 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.473946095 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.474041939 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.474095106 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.474116087 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.474128962 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.474148035 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.474160910 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.474174023 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.474190950 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.474262953 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.474277973 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.474314928 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.474330902 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.474349022 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.474369049 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.474399090 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.474412918 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.474493027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.474534035 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.474541903 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.474575043 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.474597931 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.474610090 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.474634886 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.474649906 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.474679947 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.474694014 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.474720001 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.474733114 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.474817991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.474864006 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.474884033 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.474926949 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.474945068 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.474988937 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.475014925 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.475064039 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.475112915 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.475125074 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.475156069 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.475172997 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.475207090 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.475219965 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.475248098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.475265026 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.475394011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.475439072 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.475477934 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.475522041 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.475539923 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.475552082 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.475584030 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.475600004 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.475617886 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.475667953 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.475687027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.475729942 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.475811958 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.475831032 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.475853920 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.475871086 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.475888968 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.475912094 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.475929022 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.475953102 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.476028919 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.476041079 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.476079941 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.476105928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.476141930 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.476197004 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.476222038 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.476238966 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.476269007 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.476280928 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.476330042 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.476381063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.476412058 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.476439953 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.476450920 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.476480007 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.476588964 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.476603031 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.476614952 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.476628065 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.476646900 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.476660013 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.476671934 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.476701021 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.476717949 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.476732969 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.476756096 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.476773024 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.476893902 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.476943016 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.477030039 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.477044106 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.477067947 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.477082968 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.477096081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.477111101 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.477134943 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.477153063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.477179050 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.477191925 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.477216959 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.477231026 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.477310896 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.477345943 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.477358103 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.477402925 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.477423906 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.477467060 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.477488041 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.477500916 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.477526903 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.477540970 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.477555037 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.477592945 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.477610111 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.477622986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.477650881 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.477663040 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.477770090 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.477782011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.477813959 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.477828979 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.477848053 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.477860928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.477885962 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.477900028 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.477981091 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.477993011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.478038073 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.478064060 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.478080988 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.478106976 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.478121996 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.478152037 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.478188992 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.478214025 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.478225946 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.478244066 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.478255987 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.478272915 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.478290081 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.478329897 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.478379011 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.478398085 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.478439093 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.478461027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.478498936 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.478527069 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.478557110 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.478573084 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.478595972 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.478610039 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.478650093 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.478662968 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.478677034 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.478705883 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.478722095 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.478739977 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.478785038 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.478815079 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.478832960 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.478854895 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.478873968 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.478887081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.478900909 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.478929043 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.478944063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.478965998 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.478986025 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.479007006 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.479022980 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.479044914 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.479084015 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.479109049 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.479145050 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.479154110 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.479180098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.479192019 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.479217052 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.479231119 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.479254007 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.479296923 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.479337931 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.479366064 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.479378939 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.479398966 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.479420900 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.479449034 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.479475975 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.479515076 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.479552984 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.479564905 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.479577065 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.479589939 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.479614019 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.479624987 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.479639053 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.479655027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.479681969 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.479693890 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.479724884 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.479737997 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.479752064 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.479765892 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.479779959 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.479803085 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.479816914 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.479831934 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.479860067 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.479876995 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.479887009 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.479909897 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.479923964 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.479945898 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.479965925 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.480009079 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.480036974 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.480048895 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.480062008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.480076075 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.480092049 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.480107069 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.480132103 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.480171919 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.480185986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.480197906 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.480222940 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.480238914 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.480339050 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.480351925 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.480371952 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.480384111 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.480401039 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.480420113 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.480438948 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.480459929 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.480473042 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.480484962 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.480509996 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.480521917 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.480540037 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.480551958 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.480565071 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.480581045 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.480598927 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.480618000 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.480642080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.480654955 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.480688095 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.480699062 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.480740070 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.480770111 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.480781078 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.480818033 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.480930090 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.480942965 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.480982065 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.481053114 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.481096029 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.481117010 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.481165886 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.481442928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.481455088 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.481467009 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.481482983 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.481499910 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.481517076 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.481534004 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.481559992 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.481574059 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.481604099 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.481617928 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.481730938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.481745005 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.481756926 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.481769085 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.481781960 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.481797934 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.481815100 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.481827021 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.481839895 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.481856108 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.481864929 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.481883049 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.481890917 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.481904030 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.481919050 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.481930971 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.481944084 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.481969118 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.481981039 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.481995106 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482007027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482017994 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482036114 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482044935 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.482065916 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.482079983 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.482093096 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482105970 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482117891 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482140064 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.482157946 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.482171059 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482183933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482194901 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482207060 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482219934 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.482232094 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.482258081 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.482270956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482284069 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482295036 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482312918 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482321024 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.482333899 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.482353926 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.482376099 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482388020 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482402086 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482415915 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.482439995 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.482451916 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.482465029 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482477903 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482491016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482511997 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.482522964 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.482537985 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.482562065 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482590914 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482604980 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.482616901 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482634068 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.482654095 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.482682943 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482695103 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482737064 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.482805014 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482816935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482846975 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.482865095 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.482888937 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482902050 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482932091 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.482945919 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.482985973 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.482997894 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.483030081 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.483042002 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.483072042 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.483113050 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.483138084 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.483180046 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.483192921 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.483213902 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.483237028 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.483253956 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.483283043 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.483294964 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.483330965 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.483340979 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.483375072 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.483387947 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.483407974 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.483433962 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.483449936 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.483498096 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.483514071 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.483526945 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.483539104 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.483556986 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.483573914 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.483582020 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.483620882 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.483629942 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.483647108 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.483671904 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.483695984 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.483728886 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.483776093 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.483788013 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.483817101 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.483829975 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.483856916 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.483899117 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.485964060 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.485977888 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.486011982 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.486035109 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.486057043 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.486069918 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.486124992 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.486217976 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.486229897 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.486243963 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.486257076 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.486270905 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.486285925 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.486308098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.486329079 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.486372948 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.486392975 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.486406088 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.486426115 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.486437082 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.486454010 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.486476898 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.486488104 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.486505985 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.486519098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.486573935 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.486588955 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.486605883 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.486644983 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.486661911 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.486690044 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.486702919 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.486749887 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.486762047 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.486773968 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.486785889 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.486843109 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.486876965 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.486888885 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.486920118 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.486932993 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487137079 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487149954 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487160921 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487178087 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487185955 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487200975 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487217903 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487229109 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487253904 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487272978 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487284899 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487297058 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487324953 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487343073 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487361908 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487375021 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487386942 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487406969 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487422943 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487447977 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487462044 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487484932 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487498045 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487509012 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487523079 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487534046 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487546921 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487565041 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487574100 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487587929 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487601995 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487618923 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487629890 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487641096 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487653017 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487670898 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487679005 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487704039 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487719059 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487735033 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487746954 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487761974 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487776041 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487788916 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487803936 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487814903 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487829924 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487852097 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487864017 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487876892 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487898111 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487912893 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487921953 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487937927 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487955093 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487967968 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.487977982 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.487993002 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.488015890 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.488029957 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.488042116 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.488055944 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.488078117 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.488094091 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.488106012 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.488118887 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.488149881 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.488162994 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.513323069 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.513344049 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.513355970 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.513370037 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.513396025 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.513438940 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.513458014 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.513504028 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.588613033 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.588637114 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.588649035 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.588665962 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.588767052 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.588851929 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.588865995 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.588915110 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.588946104 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.588958979 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.589006901 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.589050055 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.589062929 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.589117050 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.589191914 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.589205027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.589241028 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.589265108 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.589287996 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.589301109 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.589330912 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.589351892 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.589380980 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.589394093 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.589426994 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.589447021 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.589492083 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.589538097 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.589560986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.589587927 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.589610100 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.589620113 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.589631081 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.589648962 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.589662075 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.589675903 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.589709044 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.589735985 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.589751005 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.589766979 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.589795113 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.589812994 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.589868069 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.589920998 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.589946032 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.589957952 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.589993000 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.590009928 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.590028048 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.590040922 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.590054989 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.590070963 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.590094090 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.590224028 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.590238094 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.590286970 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.590322018 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.590372086 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.590390921 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.590404034 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.590434074 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.590450048 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.590460062 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.590507984 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.590559006 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.590573072 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.590600967 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.590617895 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.590626001 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.590667963 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.590687990 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.590734959 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.590743065 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.590785980 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.590873957 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.590920925 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.590931892 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.590981007 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.591000080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.591051102 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.591125011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.591137886 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.591170073 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.591185093 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.591213942 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.591228008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.591240883 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.591258049 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.591276884 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.591289043 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.591309071 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.591356993 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.591375113 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.591387987 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.591419935 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.591438055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.591460943 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.591510057 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.591535091 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.591547966 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.591579914 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.591594934 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.591694117 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.591706991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.591720104 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.591737986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.591754913 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.591785908 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.591805935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.591819048 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.591830969 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.591844082 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.591856003 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.591871023 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.591886044 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.591900110 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.591917038 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.591929913 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.591943979 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.591968060 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.591979027 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.592197895 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.592211962 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.592225075 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.592242956 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.592256069 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.592266083 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.592277050 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.592293978 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.592312098 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.592319965 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.592333078 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.592354059 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.592361927 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.592376947 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.592400074 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.592417955 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.592628956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.592643023 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.592654943 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.592667103 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.592679024 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.592694044 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.592709064 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.592721939 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.592736006 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.592747927 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.592760086 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.592772961 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.592788935 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.592812061 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.592896938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.592909098 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.592921019 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.592933893 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.592947006 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.592964888 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.592977047 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.592988968 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.593003035 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.593014956 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.593031883 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.593044043 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.593054056 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.593075991 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.593094110 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.593166113 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.593178988 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.593190908 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.593203068 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.593216896 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.593230963 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.593249083 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.593262911 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.593276024 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.593301058 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.593313932 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.593334913 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.593355894 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.593389034 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.593436956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.593450069 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.593461990 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.593487024 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.593518972 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.593554974 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.593569040 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.593580008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.593592882 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.593606949 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.593628883 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.593647003 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.593741894 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.593755007 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.593766928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.593786955 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.593803883 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.593811989 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.593823910 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.593837976 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.593861103 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.593883991 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.593903065 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.593945980 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.594111919 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.594125032 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.594136953 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.594156027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.594165087 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.594182014 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.594196081 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.594224930 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.594237089 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.594278097 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.594306946 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.594351053 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.594423056 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.594435930 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.594448090 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.594468117 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.594476938 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.594490051 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.594513893 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.594533920 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.594547033 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.594558954 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.594577074 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.594585896 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.594607115 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.594625950 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.594638109 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.594682932 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.594711065 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.594724894 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.594753027 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.594769001 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.594820023 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.594832897 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.594865084 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.594878912 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.594985962 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.594999075 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.595010996 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.595031023 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.595040083 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.595061064 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.595081091 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.595094919 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.595138073 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.595201969 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.595215082 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.595227003 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.595246077 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.595259905 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.595276117 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.595294952 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.595304012 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.595343113 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.595355034 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.595380068 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.595398903 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.595407963 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.595428944 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.595447063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.595463991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.595478058 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.595508099 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.595523119 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.595550060 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.595562935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.595592976 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.595606089 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.595634937 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.595669985 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.595681906 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.595706940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.595725060 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.595752001 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.595760107 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.595794916 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.595877886 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.595922947 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.596036911 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.596084118 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.596338987 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.596352100 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.596385956 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.596400023 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.596548080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.596560001 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.596600056 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.596615076 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.596626997 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.596657038 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.596676111 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.596735954 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.596744061 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.596791983 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.596848011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.596894979 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.596944094 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.596988916 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.597004890 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.597052097 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.597131968 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.597172976 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.597186089 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.597194910 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.597244978 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.597443104 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.597453117 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.597495079 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.597512007 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.597521067 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.597563982 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.597583055 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.597592115 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.597635984 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.597687006 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.597728968 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.597742081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.597786903 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.597882032 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.597927094 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.597954988 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.598004103 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.598120928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.598130941 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.598172903 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.598294973 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.598342896 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.598361969 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.598407984 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.598689079 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.598737955 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.598783970 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.598835945 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.599009991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.599039078 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.599057913 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.599085093 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.599522114 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.599570036 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.599666119 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.599673986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.599718094 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.599759102 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.599766970 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.599807024 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.599826097 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.599834919 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.599878073 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.600002050 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.600011110 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.600018978 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.600028038 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.600052118 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.600070000 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.600125074 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.600133896 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.600136995 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.600169897 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.600186110 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.600332022 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.600341082 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.600348949 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.600357056 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.600364923 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.600382090 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.600397110 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.600408077 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.600418091 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.600426912 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.600450993 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.600470066 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.600482941 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.600492001 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.600500107 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.600533009 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.600544930 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.601003885 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601012945 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601020098 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601023912 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601027012 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601037025 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601047993 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601058006 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.601078987 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.601094961 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.601104975 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601114988 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601121902 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601139069 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601152897 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.601164103 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.601172924 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601185083 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601191998 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.601207018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.601222038 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.601233006 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601242065 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601248980 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601277113 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.601295948 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.601391077 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601401091 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601408958 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601418018 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601425886 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601439953 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.601454973 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.601464033 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601474047 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601481915 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.601490974 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601511002 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.601521015 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601531982 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.601538897 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601547956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.601574898 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.601588964 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.602086067 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602093935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602102041 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602109909 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602119923 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602129936 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602143049 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.602159977 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.602171898 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602185011 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.602195978 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602205038 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602214098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.602221966 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602231026 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.602241993 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602251053 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.602264881 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602271080 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.602282047 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.602288961 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602298021 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602308035 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.602317095 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602325916 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.602344990 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.602356911 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602379084 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.602390051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602402925 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.602411985 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602421999 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602431059 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.602447987 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602459908 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.602473974 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602494955 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.602505922 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602519035 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.602543116 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602550983 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.602588892 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.602636099 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602678061 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.602689981 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602727890 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.602757931 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602783918 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602797031 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.602833033 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.602881908 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602897882 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.602932930 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.602946997 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.603053093 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.603061914 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.603101969 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.603167057 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.603174925 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.603225946 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.603249073 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.603256941 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.603306055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.603367090 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.603375912 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.603420019 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.603440046 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.603449106 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.603456020 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.603492022 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.603507996 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.603584051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.603591919 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.603632927 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.603683949 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.603692055 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.603766918 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.603826046 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.603835106 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.603838921 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.603893042 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.603969097 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.603977919 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.603986025 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.604028940 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.604115009 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.604123116 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.604151964 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.604183912 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.604209900 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.604404926 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.604413986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.604422092 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.604494095 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.604542017 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.604598045 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.604727030 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.604779959 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.605068922 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.605077028 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.605083942 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.605092049 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.605101109 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.605109930 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.605133057 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.605160952 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.605182886 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.605226994 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.605334997 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.605384111 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.605525017 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.605585098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.605585098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.605611086 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.605663061 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.605740070 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.605786085 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.605858088 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.605920076 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.605937004 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.605984926 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.606014013 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.606061935 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.606122971 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.606172085 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.606281996 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.606342077 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.606396914 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.606461048 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.606492043 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.606504917 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.606540918 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.606551886 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.606575012 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.606621981 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.606704950 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.606755972 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.606834888 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.606872082 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.606888056 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.606913090 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.607029915 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.607104063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.607177973 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.607230902 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.607259035 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.607270956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.607326031 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.607382059 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.607429028 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.607445955 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.607494116 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.607525110 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.607585907 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.607645988 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.607695103 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.607717991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.607764006 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.607779980 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.607827902 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.607852936 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.607899904 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.607918978 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.607970953 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.607995987 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.608048916 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.608064890 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.608114958 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.608136892 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.608190060 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.608203888 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.608254910 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.608295918 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.608314037 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.608345985 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.608361959 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.608432055 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.608481884 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.608499050 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.608508110 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.608561039 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.608598948 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.608619928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.608655930 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.608670950 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.608694077 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.608751059 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.608772993 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.608823061 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.608848095 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.608899117 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.608942986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.608994007 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.609046936 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.609097004 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.609112024 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.609164953 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.609186888 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.609231949 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.609385967 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.609436035 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.609471083 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.609524965 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.609608889 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.609616995 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.609664917 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.609894991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.609901905 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.609910965 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.609945059 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.609965086 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.609987974 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.609997034 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.610047102 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.610111952 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.610158920 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.610184908 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.610238075 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.610263109 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.610313892 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.610332012 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.610380888 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.610482931 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.610491991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.610548019 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.610610008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.610656977 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.610677958 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.610722065 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.610757113 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.610801935 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.610857964 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.610904932 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.610918045 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.610964060 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.610982895 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.611032009 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.611044884 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.611099005 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.611119032 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.611160040 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.611171961 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.611219883 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.611243010 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.611294031 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.611306906 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.611358881 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.611380100 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.611424923 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.611483097 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.611530066 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.611552954 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.611594915 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.611630917 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.611674070 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.611694098 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.611716986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.611745119 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.611757994 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.611825943 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.611870050 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.611962080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.611972094 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.612015009 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.612293005 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.612302065 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.612309933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.612344027 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.612355947 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.612370014 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.612379074 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.612418890 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.612431049 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.612447977 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.612476110 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.612488031 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.612541914 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.612590075 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.615849018 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.615861893 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.615870953 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.615879059 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.615888119 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.615900993 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.615920067 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.615935087 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.615952015 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.615962982 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.615972996 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.615982056 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.615991116 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616002083 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616010904 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616020918 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616034031 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616039991 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616050959 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616060019 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616072893 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616077900 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616087914 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616096020 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616111994 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616123915 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616133928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616144896 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616153002 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616162062 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616173983 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616180897 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616194010 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616200924 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616216898 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616230011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616238117 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616246939 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616255999 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616265059 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616277933 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616290092 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616300106 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616313934 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616336107 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616347075 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616355896 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616364956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616373062 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616381884 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616393089 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616406918 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616416931 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616425037 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616441011 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616452932 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616465092 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616476059 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616485119 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616494894 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616506100 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616518021 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616528034 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616537094 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616548061 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616554976 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616564989 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616580009 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616591930 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616599083 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616607904 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616616011 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616626978 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616636038 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616645098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616657972 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616666079 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616677046 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616689920 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616702080 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616722107 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616731882 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616744995 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616777897 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.616801977 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.616843939 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.632819891 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.632915974 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.632962942 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.633017063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.678208113 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.678287983 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.707951069 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.708046913 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.708084106 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.708103895 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.708204985 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.708257914 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.708312988 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.708359957 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.708477974 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.708528042 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.708544016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.708592892 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.708612919 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.708623886 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.708679914 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.708718061 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.708728075 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.708780050 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.708807945 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.708817005 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.708867073 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.708997011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.709080935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.709135056 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.709197044 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.712212086 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.724260092 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.724349976 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.724360943 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.724437952 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.724530935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.724617004 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.724700928 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.724771976 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.724817991 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.724878073 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.724888086 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.724895954 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.724906921 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.725003004 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.725028038 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.725106001 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.725138903 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.725251913 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.725317001 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.725363016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.725372076 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.725464106 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.725513935 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.725558996 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.725614071 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.725655079 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.725703001 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.725749969 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.725800991 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.725846052 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.725908041 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.725948095 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.726001978 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.726042986 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.726059914 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.726094007 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.726102114 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.726130962 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.726140022 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.726157904 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.726188898 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.726211071 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.726217031 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.726252079 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.726252079 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.726305962 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.726306915 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.726350069 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.726402044 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.726442099 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.726447105 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.726497889 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.726500034 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.726561069 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.726567030 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.726613998 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.726663113 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.726666927 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.726696014 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.726757050 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.726758957 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.726789951 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.726841927 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.726917982 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.726947069 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.726994991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.727005005 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.727065086 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.727092981 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.727144003 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.727241039 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.727268934 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.727355003 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.727416039 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.774269104 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 19, 2024 21:35:13.774441957 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 19, 2024 21:35:13.774540901 CET	49730	15666	192.168.2.4	45.130.145.152

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 21:35:09.856362104 CET	192.168.2.4	1.1.1.1	0xc11f	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 21:35:09.994642019 CET	1.1.1.1	192.168.2.4	0xc11f	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Dec 19, 2024 21:35:09.994642019 CET	1.1.1.1	192.168.2.4	0xc11f	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Dec 19, 2024 21:35:09.994642019 CET	1.1.1.1	192.168.2.4	0xc11f	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	104.26.13.205	443	7156	C:\Users\user\Desktop\ruppert.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 20:35:11 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2024-12-19 20:35:11 UTC	423	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 20:35:11 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8f4a2d7d6e5a0ca2-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1568&min_rtt=1560&rtt_var=601&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=738&delivery_rate=1798029&cwnd=32&unsent_bytes=0&cid=f7754fa5711365ad&ts=543&x=0"
2024-12-19 20:35:11 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Target ID:	0
Start time:	15:35:08
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\ruppert.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\ruppert.exe"
Imagebase:	0x7ff675d80000
File size:	2'749'952 bytes
MD5 hash:	C3242CAB034E773DAD42D6FBFF0B4ECF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000000.00000002.1959053950.00000259C0E0B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	25.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	52

Executed Functions

Function 00000259C2A9FB30 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 225
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00000259C2A9FB71
GetSystemMetrics.USER32 ref: 00000259C2A9FB7F
GetSystemMetrics.USER32 ref: 00000259C2A9FB8D
GetSystemMetrics.USER32 ref: 00000259C2A9FB9B
GetDC.USER32 ref: 00000259C2A9FBA5
GetDeviceCaps.GDI32 ref: 00000259C2A9FBBB
GetDeviceCaps.GDI32 ref: 00000259C2A9FBCB
CreateCompatibleDC.GDI32 ref: 00000259C2A9FBD8
CreateCompatibleBitmap.GDI32 ref: 00000259C2A9FBF0
SelectObject.GDI32 ref: 00000259C2A9FC06
BitBlt.GDI32 ref: 00000259C2A9FC3C
SHCreateMemStream.SHLWAPI ref: 00000259C2A9FC72
SelectObject.GDI32 ref: 00000259C2A9FC88
DeleteDC.GDI32 ref: 00000259C2A9FC91
ReleaseDC.USER32 ref: 00000259C2A9FC9C
DeleteObject.GDI32 ref: 00000259C2A9FCA5
EnterCriticalSection.KERNEL32 ref: 00000259C2A9FD9C
LeaveCriticalSection.KERNEL32 ref: 00000259C2A9FDAE
IStream_Size.SHLWAPI ref: 00000259C2A9FDE5
IStream_Reset.SHLWAPI ref: 00000259C2A9FDF6
IStream_Read.SHLWAPI ref: 00000259C2A9FE7B
SelectObject.GDI32 ref: 00000259C2A9FED5
DeleteDC.GDI32 ref: 00000259C2A9FEDE
ReleaseDC.USER32 ref: 00000259C2A9FEEB
DeleteObject.GDI32 ref: 00000259C2A9FEF4

Strings

, xrefs: 00000259C2A9FC11

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Object$DeleteMetricsSystem$CreateSelectStream_$CapsCompatibleCriticalDeviceReleaseSection$BitmapEnterLeaveReadResetSizeStream
String ID:
API String ID: 3214587331-3916222277
Opcode ID: e8e9b911cd9b9f557c011d0a693391b94df579aa06795856880fde4b09ecdcd5
Instruction ID: 84613653aef21ff250846b75e89ee1bddfcdf8c54c331fbbdca8fe7dc1183de0
Opcode Fuzzy Hash: e8e9b911cd9b9f557c011d0a693391b94df579aa06795856880fde4b09ecdcd5
Instruction Fuzzy Hash: 23B11F72218FC0C6EB60DB21E85839AB3A5F79DB82F408516DAC943B99DF3CC585CB04

Function 00000259C2AD98C0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32 ref: 00000259C2AD996D
GetLastError.KERNEL32 ref: 00000259C2AD9977
FindFirstFileW.KERNEL32 ref: 00000259C2AD998E
GetLastError.KERNEL32 ref: 00000259C2AD999A
FindClose.KERNEL32 ref: 00000259C2AD99A8
__std_fs_open_handle.LIBCPMT ref: 00000259C2AD9A3B
CloseHandle.KERNEL32 ref: 00000259C2AD9A51
CloseHandle.KERNEL32 ref: 00000259C2AD9BC4

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: 9b9cafa6476ba7d57e6375b49b2d31870033937920a690a77e8b0d8031f3f21f
Instruction ID: beb8ef0f5d2d41801925fdc58ad28d2c1a977bc50e83a9e160f28a7b3428af42
Opcode Fuzzy Hash: 9b9cafa6476ba7d57e6375b49b2d31870033937920a690a77e8b0d8031f3f21f
Instruction Fuzzy Hash: 67915E32204F42C6FF64CB25AC4875923A1A78DFB7F1547169AFA47BE4DB38C885860C

Function 00000259C2AA1660 Relevance: 26.6, APIs: 4, Strings: 10, Instructions: 2133timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 00000259C2AA1990

Strings

ram, xrefs: 00000259C2AA285B
user_name, xrefs: 00000259C2AA242F
gpu, xrefs: 00000259C2AA2522
[UTC, xrefs: 00000259C2AA1963
timezone, xrefs: 00000259C2AA3414
cpu, xrefs: 00000259C2AA2618
%d-%m-%Y, %H:%M:%S, xrefs: 00000259C2AA2F5F
time, xrefs: 00000259C2AA3041
system, xrefs: 00000259C2AA23E4, 00000259C2AA24D3, 00000259C2AA25C9, 00000259C2AA26C3, 00000259C2AA280B, 00000259C2AA2905, 00000259C2AA29F8, 00000259C2AA2B7F, 00000259C2AA2D70, 00000259C2AA2FF1, 00000259C2AA31B4, 00000259C2AA33CE, 00000259C2AA356D, 00000259C2AA3717, 00000259C2AA37DD
computer_name, xrefs: 00000259C2AA2954

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: %d-%m-%Y, %H:%M:%S$[UTC$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 565725191-1610854563
Opcode ID: 3b056a77ab6aacff0f5bc4b2aed67937af5d42f3596e8105ae4ef8b417f4de78
Instruction ID: bef0570e508256f687c0d495c81faf5b81b96a52afce0646fce5a1212998c7ad
Opcode Fuzzy Hash: 3b056a77ab6aacff0f5bc4b2aed67937af5d42f3596e8105ae4ef8b417f4de78
Instruction Fuzzy Hash: EC236A72614FC0C9EB21CB25E8543DD67A1F78DB9AF509216EADD06BA9DB78C280C704

Function 00000259C2AA1FF0 Relevance: 22.5, APIs: 3, Strings: 9, Instructions: 1516COMMON

Download Yara Rule

APIs

Part of subcall function 00000259C2AA0C30: GetCurrentHwProfileW.ADVAPI32 ref: 00000259C2AA0C6C

Part of subcall function 00000259C2AA0500: EnumDisplayDevicesW.USER32 ref: 00000259C2AA0617
Part of subcall function 00000259C2AA0500: EnumDisplayDevicesW.USER32 ref: 00000259C2AA06BB

Part of subcall function 00000259C2AA0420: RegGetValueA.ADVAPI32 ref: 00000259C2AA0489

Part of subcall function 00000259C2AA0110: GetUserNameW.ADVAPI32 ref: 00000259C2AA0155

Part of subcall function 00000259C2AA01B0: GetComputerNameW.KERNEL32 ref: 00000259C2AA01F5

GlobalMemoryStatusEx.KERNEL32 ref: 00000259C2AA277C
wcsftime.LIBCMT ref: 00000259C2AA2F72
GetModuleFileNameA.KERNEL32 ref: 00000259C2AA3106

Strings

ram, xrefs: 00000259C2AA285B
user_name, xrefs: 00000259C2AA242F
gpu, xrefs: 00000259C2AA2522
timezone, xrefs: 00000259C2AA3414
cpu, xrefs: 00000259C2AA2618
%d-%m-%Y, %H:%M:%S, xrefs: 00000259C2AA2F5F
time, xrefs: 00000259C2AA3041
system, xrefs: 00000259C2AA23E4, 00000259C2AA24D3, 00000259C2AA25C9, 00000259C2AA26C3, 00000259C2AA280B, 00000259C2AA2905, 00000259C2AA29F8, 00000259C2AA2B7F, 00000259C2AA2D70, 00000259C2AA2FF1, 00000259C2AA31B4, 00000259C2AA33CE, 00000259C2AA356D, 00000259C2AA3717, 00000259C2AA37DD
computer_name, xrefs: 00000259C2AA2954

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Name$DevicesDisplayEnum$ComputerCurrentFileGlobalMemoryModuleProfileStatusUserValuewcsftime
String ID: %d-%m-%Y, %H:%M:%S$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 2509368203-1182675529
Opcode ID: f651b7326582497df5145f037cfac37631f424b128664ffa237f7dc2174f46b5
Instruction ID: b02d17303b6ba0a61edd59ba33b4a4391bffeb3abe468711990366b4847fe891
Opcode Fuzzy Hash: f651b7326582497df5145f037cfac37631f424b128664ffa237f7dc2174f46b5
Instruction Fuzzy Hash: 35F25972614FC0C9DB218F65E8943DD77A1F789B9AF409216EA8D07BA9DB78C290C704

Function 00000259C2A5B820 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 862
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00000259C2A5B90C
GetProcAddress.KERNEL32 ref: 00000259C2A5BA17
GetProcAddress.KERNEL32 ref: 00000259C2A5BAD9
GetProcAddress.KERNEL32 ref: 00000259C2A5BB53
GetProcAddress.KERNEL32 ref: 00000259C2A5BBD5
GetProcAddress.KERNEL32 ref: 00000259C2A5BC4F
GetProcAddress.KERNEL32 ref: 00000259C2A5BCD3
FreeLibrary.KERNEL32 ref: 00000259C2A5C801

Strings

cannot use push_back() with , xrefs: 00000259C2A5C84F
system, xrefs: 00000259C2A5C60D
vault, xrefs: 00000259C2A5C663

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: cannot use push_back() with $system$vault
API String ID: 2449869053-1741236777
Opcode ID: 9371eb30fe06620e9d8191ef09f09a1ddfa88cba1675d902425f2d26ea30df17
Instruction ID: e6036827ad5e6dda27e84ad655f74c0a772c6324441e2202853baadd3186908a
Opcode Fuzzy Hash: 9371eb30fe06620e9d8191ef09f09a1ddfa88cba1675d902425f2d26ea30df17
Instruction Fuzzy Hash: AD922872205FC4D9DB608F29E8843DE73A5F749B99F104226EA9C5BB99EF74C684C304

Function 00000259C2A96480 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000259C2A99760: GetCurrentProcess.KERNEL32 ref: 00000259C2A9979B
Part of subcall function 00000259C2A99760: OpenProcessToken.ADVAPI32 ref: 00000259C2A997AE
Part of subcall function 00000259C2A99760: GetTokenInformation.ADVAPI32 ref: 00000259C2A997EA

ExitProcess.KERNEL32 ref: 00000259C2A964C7
OpenMutexA.KERNEL32 ref: 00000259C2A965E2
ExitProcess.KERNEL32 ref: 00000259C2A965F2
CreateMutexA.KERNEL32 ref: 00000259C2A96611
ExitProcess.KERNEL32 ref: 00000259C2A96637

Part of subcall function 00000259C2A99AA0: GetModuleFileNameW.KERNEL32 ref: 00000259C2A99AEA

Part of subcall function 00000259C2AA4740: CoInitializeEx.OLE32 ref: 00000259C2AA47AA

Strings

SeDebugPrivilege, xrefs: 00000259C2A964CE
SeImpersonatePrivilege, xrefs: 00000259C2A964DA

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Process$Exit$MutexOpenToken$CreateCurrentFileInformationInitializeModuleName
String ID: SeDebugPrivilege$SeImpersonatePrivilege
API String ID: 470559343-3768118664
Opcode ID: ee9a05d127fa369541cf39afede76aca2154aefe3429ab8ff2d6008fa31e4eed
Instruction ID: 443133592ee59c4caf8f6a51209f4d9e71ffabe331d59d5cdbc30421d1c70ecf
Opcode Fuzzy Hash: ee9a05d127fa369541cf39afede76aca2154aefe3429ab8ff2d6008fa31e4eed
Instruction Fuzzy Hash: 8B618E61608E80C1EE20BB65AC593AE6355EB8DF83F500513E7CD42BEADF3CC1C58A18

Function 00000259C2AC114C Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00000259C2AC1191

Part of subcall function 00000259C2AC07F8: _invalid_parameter_noinfo.LIBCMT ref: 00000259C2AC080C

Part of subcall function 00000259C2ABB550: HeapFree.KERNEL32 ref: 00000259C2ABB566
Part of subcall function 00000259C2ABB550: GetLastError.KERNEL32 ref: 00000259C2ABB570

Part of subcall function 00000259C2AC9D94: _invalid_parameter_noinfo.LIBCMT ref: 00000259C2AC9CDF

_get_daylight.LIBCMT ref: 00000259C2AC1180

Part of subcall function 00000259C2AC0858: _invalid_parameter_noinfo.LIBCMT ref: 00000259C2AC086C

_get_daylight.LIBCMT ref: 00000259C2AC13F6
_get_daylight.LIBCMT ref: 00000259C2AC1407
_get_daylight.LIBCMT ref: 00000259C2AC1418
GetTimeZoneInformation.KERNEL32 ref: 00000259C2AC143F

Strings

Eastern Standard Time, xrefs: 00000259C2AC14E5
Eastern Summer Time, xrefs: 00000259C2AC14FD

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 355007559-239921721
Opcode ID: 81739166be4aa7f83f73f8b5c4c772bb7cbf832f5b2b22088efdd0610fe74ccd
Instruction ID: e8c8f4cf5da02947f0310d4840b86f36ac9b60bc7e30894fc83f515842d6b8f3
Opcode Fuzzy Hash: 81739166be4aa7f83f73f8b5c4c772bb7cbf832f5b2b22088efdd0610fe74ccd
Instruction Fuzzy Hash: 77D1BE36700A40C5EF20EF3ADC587A967A9E74DF87F448127EA9947BC5DA3AC4C18748

Function 00000259C2A9F200 Relevance: 13.9, APIs: 9, Instructions: 408
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 00000259C2A9F3CB
InternetOpenUrlA.WININET ref: 00000259C2A9F4A8
HttpQueryInfoW.WININET ref: 00000259C2A9F509
HttpQueryInfoW.WININET ref: 00000259C2A9F5A2
InternetQueryDataAvailable.WININET ref: 00000259C2A9F5E6
InternetReadFile.WININET ref: 00000259C2A9F6A9
InternetQueryDataAvailable.WININET ref: 00000259C2A9F774
InternetCloseHandle.WININET ref: 00000259C2A9F81E
Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A9F87B

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Internet$Query$AvailableDataHttpInfoOpen$CloseConcurrency::cancel_current_taskFileHandleRead
String ID:
API String ID: 1475545111-0
Opcode ID: 959a8b8c722fd78e25b7c72defa744749a8e1a74bc870614e379c2a583aa0042
Instruction ID: 214926e85e3893e47686013cfcd2da14fd0858fefa1c1ec47e708f2ce41d21be
Opcode Fuzzy Hash: 959a8b8c722fd78e25b7c72defa744749a8e1a74bc870614e379c2a583aa0042
Instruction Fuzzy Hash: 0A026C32A18F94C5EB10DB6AE84435E77B5F789B99F204216EED857BA8DF39C081C704

Function 00000259C2ADE968 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000259C2ADE54C: _invalid_parameter_noinfo.LIBCMT ref: 00000259C2ADE58D
Part of subcall function 00000259C2ADE54C: _invalid_parameter_noinfo.LIBCMT ref: 00000259C2ADE60B
Part of subcall function 00000259C2ADE54C: _invalid_parameter_noinfo.LIBCMT ref: 00000259C2ADE65C

CreateFileW.KERNEL32 ref: 00000259C2ADEA6E
CreateFileW.KERNEL32 ref: 00000259C2ADEABE
GetLastError.KERNEL32 ref: 00000259C2ADEAEE
GetFileType.KERNEL32 ref: 00000259C2ADEB03
GetLastError.KERNEL32 ref: 00000259C2ADEB0D
CloseHandle.KERNEL32 ref: 00000259C2ADEB40
CloseHandle.KERNEL32 ref: 00000259C2ADECA3
CreateFileW.KERNEL32 ref: 00000259C2ADECD8
GetLastError.KERNEL32 ref: 00000259C2ADECE7

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 484b9744f6cc28d441a3ba22cd2a9bb849a09fc1e06d845b9773f87c4c6ec638
Instruction ID: 625da82a03355fba81bd5af2f2c45010e918825c4e2e5f1884b3dc04ce842eec
Opcode Fuzzy Hash: 484b9744f6cc28d441a3ba22cd2a9bb849a09fc1e06d845b9773f87c4c6ec638
Instruction Fuzzy Hash: DDC18C36721F40C5EF10CFA9C9956AC3761E349FAAF015216DBAA9B7D4CB38C496C304

Function 00000259C2A98F60 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 451
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32 ref: 00000259C2A991A1
SetFilePointer.KERNEL32 ref: 00000259C2A99254
ReadFile.KERNEL32 ref: 00000259C2A99283

Strings

ios_base::eofbit set, xrefs: 00000259C2A996C4
ios_base::badbit set, xrefs: 00000259C2A996B1, 00000259C2A9972F
exists, xrefs: 00000259C2A9970A
ios_base::failbit set, xrefs: 00000259C2A996BD

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: File$PointerReadSize
String ID: exists$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 404940565-15404121
Opcode ID: 130f996bef3d173b626716d9372166bbf675c5929c0e46e11e63a7f840eda3ca
Instruction ID: b6809d637f405f921fc6f49bb02619f0f0fba804eb2b28c24796e3763139ad8e
Opcode Fuzzy Hash: 130f996bef3d173b626716d9372166bbf675c5929c0e46e11e63a7f840eda3ca
Instruction Fuzzy Hash: A3323332214BC5D9EB20CF29DC843DD37A5F789B4AF508226DA8D47B99EB74C685C708

Function 00000259C2AC13C8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00000259C2AC13F6

Part of subcall function 00000259C2AC0858: _invalid_parameter_noinfo.LIBCMT ref: 00000259C2AC086C

_get_daylight.LIBCMT ref: 00000259C2AC1407

Part of subcall function 00000259C2AC07F8: _invalid_parameter_noinfo.LIBCMT ref: 00000259C2AC080C

_get_daylight.LIBCMT ref: 00000259C2AC1418

Part of subcall function 00000259C2AC0828: _invalid_parameter_noinfo.LIBCMT ref: 00000259C2AC083C

Part of subcall function 00000259C2ABB550: HeapFree.KERNEL32 ref: 00000259C2ABB566
Part of subcall function 00000259C2ABB550: GetLastError.KERNEL32 ref: 00000259C2ABB570

GetTimeZoneInformation.KERNEL32 ref: 00000259C2AC143F

Strings

Eastern Standard Time, xrefs: 00000259C2AC14E5
Eastern Summer Time, xrefs: 00000259C2AC14FD

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 8c7917a29c397fa3200ed5a7405142a85cef7c6524de68c4b18d81a385570565
Instruction ID: 7af32c79fe87427cc43e4171c292a9552f4e0dc2b2e7a9a6b2417e3aa4da8214
Opcode Fuzzy Hash: 8c7917a29c397fa3200ed5a7405142a85cef7c6524de68c4b18d81a385570565
Instruction Fuzzy Hash: 62515A32700A44C6EB10EF36EC897996768F74DF87F444127AA9987BD6DB39C4818B48

Function 00000259C2AB749C Relevance: 9.2, APIs: 6, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000259C2AB74BE
_get_daylight.LIBCMT ref: 00000259C2AB751E
_get_daylight.LIBCMT ref: 00000259C2AB752F
_get_daylight.LIBCMT ref: 00000259C2AB7540
_isindst.LIBCMT ref: 00000259C2AB7591
_isindst.LIBCMT ref: 00000259C2AB75E4

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: _get_daylight$_isindst$_invalid_parameter_noinfo
String ID:
API String ID: 1405656091-0
Opcode ID: 842d06e59cb7d0c874962108e89d6781c57040cb1ba9c53ec58eb2fa30030a5a
Instruction ID: 9e36d57b1347b4303a0f27bc8dc1b46a89f70798c30156fcb74d92efce878d06
Opcode Fuzzy Hash: 842d06e59cb7d0c874962108e89d6781c57040cb1ba9c53ec58eb2fa30030a5a
Instruction Fuzzy Hash: ED81C8B3700645CBEF588F39CD053A837A5E75CB8BF049126DA498ABC9EB78D581C744

Function 00000259C2AA8B70 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00000259C2AA8D24
__std_exception_destroy.LIBVCRUNTIME ref: 00000259C2AA8D32
__std_exception_destroy.LIBVCRUNTIME ref: 00000259C2AA8FB5
__std_exception_destroy.LIBVCRUNTIME ref: 00000259C2AA8FC3

Strings

value, xrefs: 00000259C2AA8C4A, 00000259C2AA8EE3

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: 850281e08b541cdb5390706529d716b470d4b8d1bed4819e1008a8dbaf93e1ed
Instruction ID: b7e3c79df9200df1d5151dee95ce696a8013fa84ab2c7100f93ef045ef3811e1
Opcode Fuzzy Hash: 850281e08b541cdb5390706529d716b470d4b8d1bed4819e1008a8dbaf93e1ed
Instruction Fuzzy Hash: 04026C22A14FC0C9EF40CB75D8883AD6761EB99BA6F505212FADD42BDADB78C1C5C704

Function 00000259C2A5C8C0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 328processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00000259C2A5C90A
Process32FirstW.KERNEL32 ref: 00000259C2A5C94C
Process32NextW.KERNEL32 ref: 00000259C2A5CB43
CloseHandle.KERNEL32 ref: 00000259C2A5CDBA

Strings

[PID: , xrefs: 00000259C2A5C98E

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 420147892-2210602247
Opcode ID: ae7c4dced35d93affd00a503f79e7c8bcef263ef5bfb0f1a16b693553bd8a15c
Instruction ID: 7eed6e04d53086e400eeb6c8fe61fd56cc59a28a594c4e64169235c111692e8b
Opcode Fuzzy Hash: ae7c4dced35d93affd00a503f79e7c8bcef263ef5bfb0f1a16b693553bd8a15c
Instruction Fuzzy Hash: 9EE18E72614FC095EB20CB25E88439E77A5F789BAAF504216EA9D07BD9DF38C285C704

Function 00000259C2AA5970 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00000259C2AA59BE
OpenProcessToken.ADVAPI32 ref: 00000259C2AA59D1
LookupPrivilegeValueW.ADVAPI32 ref: 00000259C2AA59F2
AdjustTokenPrivileges.ADVAPI32 ref: 00000259C2AA5A38
CloseHandle.KERNEL32 ref: 00000259C2AA5A58

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3038321057-0
Opcode ID: 29a02e95aae9899e0029659e102052f54fff5397b51cb33b914b83ea41570e5f
Instruction ID: 06f121b2238c35e5ce0d782bb772f0821265cd9c918c5716852822179cf133e0
Opcode Fuzzy Hash: 29a02e95aae9899e0029659e102052f54fff5397b51cb33b914b83ea41570e5f
Instruction Fuzzy Hash: 12215E32218F80C6EB50CB51F84834AB3A4F78CB92F558126EACA43B58DF7CC5858B04

Function 00000259C2A81340 Relevance: 6.8, Strings: 5, Instructions: 599COMMON

Download Yara Rule

Strings

cannot use push_back() with , xrefs: 00000259C2A82095
prefs.js, xrefs: 00000259C2A828A2
status, xrefs: 00000259C2A820D1, 00000259C2A820F3, 00000259C2A8211B, 00000259C2A82143
exists, xrefs: 00000259C2A8374D
directory_iterator::directory_iterator, xrefs: 00000259C2A820E3, 00000259C2A83764

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID: cannot use push_back() with $directory_iterator::directory_iterator$exists$prefs.js$status
API String ID: 0-2713369562
Opcode ID: 4f4f14dd75114081a346586ea709c78d277ac964eca45cf718d416b8a6a0c1ea
Instruction ID: 7f8f20073772461b748c8e6df1a7a7cd1ccca04903dd4c0e56162db3d7173b57
Opcode Fuzzy Hash: 4f4f14dd75114081a346586ea709c78d277ac964eca45cf718d416b8a6a0c1ea
Instruction Fuzzy Hash: 36521932509FC4C5EAB19B15E8853DAB3A4F7CDB86F505226DACC42B99EF78C194CB04

Function 00000259C2A9E9F0 Relevance: 6.4, APIs: 4, Instructions: 417networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00000259C2A9EBCC
recv.WS2_32 ref: 00000259C2A9F0AC
closesocket.WS2_32 ref: 00000259C2A9F0BE
WSACleanup.WS2_32 ref: 00000259C2A9F0C4

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: recv$Cleanupclosesocket
String ID:
API String ID: 146070474-0
Opcode ID: 6f4091cd486aafdfe5a78df46b912ecd752a41b095143445b23a4eef97a08e8e
Instruction ID: 064e5c7323a3a9fd9465fe187b40cae57111746a996529b5131c40c4933ac528
Opcode Fuzzy Hash: 6f4091cd486aafdfe5a78df46b912ecd752a41b095143445b23a4eef97a08e8e
Instruction Fuzzy Hash: 03125B72618FC0C1EE209B15E8583DAA761E78DB92F504213EAED46BDADF79C4C5CB04

Function 00000259C2A5ACC0 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 671COMMON

Download Yara Rule

APIs

CredEnumerateA.ADVAPI32 ref: 00000259C2A5AD22
CredFree.ADVAPI32 ref: 00000259C2A5B746

Strings

cannot use push_back() with , xrefs: 00000259C2A5B794

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Cred$EnumerateFree
String ID: cannot use push_back() with
API String ID: 3403564193-4122110429
Opcode ID: c36819fedae0510b011262ae9609d54af2ded0009ad2dbf1c32083310b9cb21a
Instruction ID: b4dff9bee1312a6af73542cdc38351464455ddf916ece1f6b790e82bca8dc495
Opcode Fuzzy Hash: c36819fedae0510b011262ae9609d54af2ded0009ad2dbf1c32083310b9cb21a
Instruction Fuzzy Hash: 89623972614FC4C9EB208F65E8843DD77A1F789B9AF504216EAAD17BD9DB38C284C704

Function 00000259C2AAC55A Relevance: 5.6, Strings: 4, Instructions: 566COMMON

Download Yara Rule

Strings

object separator, xrefs: 00000259C2AACAB3, 00000259C2AACDEE
object, xrefs: 00000259C2AACD39
object key, xrefs: 00000259C2AACB5C, 00000259C2AACEA3
array, xrefs: 00000259C2AACC84

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID: array$object$object key$object separator
API String ID: 0-2277530871
Opcode ID: 67436389a04c99e8054f3e0aa3fffa1fd3ae553f7ec7f9764ff34f684751c61b
Instruction ID: e20572a767bc54df5a0c01bac17380d551af63b63fdb75cdfcea76bae19c428a
Opcode Fuzzy Hash: 67436389a04c99e8054f3e0aa3fffa1fd3ae553f7ec7f9764ff34f684751c61b
Instruction Fuzzy Hash: C742A062614F84D6EF10DB34C8583ED2361FB9AB86F902613EA8957BDADF74C284C744

Function 00000259C2A91EA0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 00000259C2A91EF8
LocalFree.KERNEL32 ref: 00000259C2A91F8A

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 534917215b691bdf8008ca3940d01222a19eb5e5d5bf9c8332b99172fc4e0cb2
Instruction ID: aa57932dc851f70d18f7a4d4d525274f08148fc130bed25707ec4d5fb3915c2d
Opcode Fuzzy Hash: 534917215b691bdf8008ca3940d01222a19eb5e5d5bf9c8332b99172fc4e0cb2
Instruction Fuzzy Hash: 4E415B33614B80CAFB209F75D8443DD37A4F759B8DF44422AEB8806E8ADB79C5A4C348

Function 00000259C2AA13B0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32 ref: 00000259C2AA1421

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: 05563d9c9f8d9765ab942f76f343afa8ceddb3167ad04ffcdfa04968ca2d4d44
Instruction ID: c6ed5ffaec5603a1005c860aeb4ce8451a863182a9f6ec06d797f2f4051488d1
Opcode Fuzzy Hash: 05563d9c9f8d9765ab942f76f343afa8ceddb3167ad04ffcdfa04968ca2d4d44
Instruction Fuzzy Hash: 3C418132A18F80C2E710CF25E88439EB774F799B84F145216EAC823B69DB78D5D1DB44

Function 00000259C2AA0110 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00000259C2AA0155

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 5706546f313706de72a237bf98d2ae5729b4666c4094d2ca0903643dc08702f3
Instruction ID: 652e5634dd104d2ba225dc55b5c019424ac63e86fa6d35de26f6861c575a85aa
Opcode Fuzzy Hash: 5706546f313706de72a237bf98d2ae5729b4666c4094d2ca0903643dc08702f3
Instruction Fuzzy Hash: CC016132218B80C2EB21DF25E85539AB3A5F79CB89F440112EACD42799DFBCC6D4CB44

Function 00000259C2AA0820 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

cores, xrefs: 00000259C2AA0A7E

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID: cores
API String ID: 0-2370456839
Opcode ID: 4fc0d753065259fec565b281c6730a4adfab5fad9c1ffe782f646639cec6a140
Instruction ID: 5b66983b957133625ddb279f889dc33e18564247908f6474562d0f49ab770ca7
Opcode Fuzzy Hash: 4fc0d753065259fec565b281c6730a4adfab5fad9c1ffe782f646639cec6a140
Instruction Fuzzy Hash: 78C1FD63E04B80CAEB10CF79D8043AD7761E79DBA9F105316EA9812BDADB78C2C5C744

Function 00000259C2AA70B0 Relevance: 1.5, Strings: 1, Instructions: 212COMMON

Download Yara Rule

Strings

\u%04x, xrefs: 00000259C2AA72A2

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID: \u%04x
API String ID: 0-2916071157
Opcode ID: 06a80ac53363f504e8d291dc153b6a47b21947aca11156197ff4547b1ef6832f
Instruction ID: c4170b1f63889b13446aa0f2fe16b5df325c8096b6f2f501e171497208cca886
Opcode Fuzzy Hash: 06a80ac53363f504e8d291dc153b6a47b21947aca11156197ff4547b1ef6832f
Instruction Fuzzy Hash: 8F81E322204A80C1EE54CB55DD587AE67A1FB89F82F848023DF8E437E5DF38C699C748

Function 00000259C2AA662B Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

": , xrefs: 00000259C2AA6711, 00000259C2AA67BE

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID: ":
API String ID: 0-3662656813
Opcode ID: 896a4f67027aaf01e5dfe48ac692d3832c0c554c68eb6b2fca54ea41666aa8bb
Instruction ID: d07b6fd4861ddb3b75f948ff89d1776057ad5d3ab8619cfabcc5130b59cd0fb1
Opcode Fuzzy Hash: 896a4f67027aaf01e5dfe48ac692d3832c0c554c68eb6b2fca54ea41666aa8bb
Instruction Fuzzy Hash: 1091F176204A85C1DF209F2AD49879E63A1F789FCAF449002CB9E47BA4CF39C598CB04

Function 00000259C2A622D0 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 00000259C2A62359

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
API String ID: 0-1713319389
Opcode ID: 0e1e18df8e43834f8c2d261b7060e305521bf1430a60c216941d6cdd0af00934
Instruction ID: e8808eed582286f274fd3eca36049a2cf8d73dd7daebe4c5c743f169c160beb5
Opcode Fuzzy Hash: 0e1e18df8e43834f8c2d261b7060e305521bf1430a60c216941d6cdd0af00934
Instruction Fuzzy Hash: 3341D263619AE08ADB02CB39841537D7FB1E36AF89F1C8162DBD487B46DA3DC246D710

Function 00000259C2A5CF60 Relevance: .7, Instructions: 715COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5dfab60cd898a47b142bfcdc239227ece7719f4ad1c1a5427b439e5710bfaff
Instruction ID: 522ff8c808052cf5d181231d9a69d21c84d3d34ce9883cb41d1548905ef271b0
Opcode Fuzzy Hash: b5dfab60cd898a47b142bfcdc239227ece7719f4ad1c1a5427b439e5710bfaff
Instruction Fuzzy Hash: 63723A72614FC4C9EB20CB69E84439E73A5F78DB99F504216EADC57B99EB78C280C704

Function 00000259C2A4F1C0 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c220a6810ee678c063d72965325b525ecaaf8d2400666b94ac433f277fe0e33
Instruction ID: ea954b81a1b885d40a88163ef488ddcd9102f095770e03b40b26bfda71b7410e
Opcode Fuzzy Hash: 6c220a6810ee678c063d72965325b525ecaaf8d2400666b94ac433f277fe0e33
Instruction Fuzzy Hash: CFF16D72A04F84CAEB218B69E84535DB7A5F78CBA9F105315EEDC57B98EB38C190C704

Function 00000259C2A4F8B0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dff676497c9fb129e8543d1e2cfdd6b70021982477bb203991b294b01c83d258
Instruction ID: 55f5fbff8fafff361e4302b69a3fef3ec3350bceefd20f67cac988257b1db714
Opcode Fuzzy Hash: dff676497c9fb129e8543d1e2cfdd6b70021982477bb203991b294b01c83d258
Instruction Fuzzy Hash: A8F15D32604F84CAEB218B69E84535D77A5F78CBA9F105316EEDC57B99EB38C190CB04

Function 00000259C2A98B30 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 194
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000259C2A988B0: InitializeCriticalSectionEx.KERNEL32 ref: 00000259C2A98901
Part of subcall function 00000259C2A988B0: GetLastError.KERNEL32 ref: 00000259C2A9890B

EnterCriticalSection.KERNEL32 ref: 00000259C2A98B71
GdiplusStartup.GDIPLUS ref: 00000259C2A98B98
LeaveCriticalSection.KERNEL32 ref: 00000259C2A98BA6
LeaveCriticalSection.KERNEL32 ref: 00000259C2A98BD4
GdipGetImageEncodersSize.GDIPLUS ref: 00000259C2A98BE2
GdipGetImageEncoders.GDIPLUS ref: 00000259C2A98C76
GdipCreateBitmapFromScan0.GDIPLUS ref: 00000259C2A98D40
GdipSaveImageToStream.GDIPLUS ref: 00000259C2A98D5E
GdipDisposeImage.GDIPLUS ref: 00000259C2A98DC3
GdipDisposeImage.GDIPLUS ref: 00000259C2A98DD7

Strings

&, xrefs: 00000259C2A98D3A

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream
String ID: &
API String ID: 1703174404-3042966939
Opcode ID: e0228fc8eea7d5b1ef60bb9784c8d30ef67e4de2cf218bbc2f582390e882f76a
Instruction ID: 99fd5c6b45710e28f48f7331ac994afdce08efb75b08725e6e738028c9dff8ce
Opcode Fuzzy Hash: e0228fc8eea7d5b1ef60bb9784c8d30ef67e4de2cf218bbc2f582390e882f76a
Instruction Fuzzy Hash: E8915A32205F40DAEF249F22DC0879837A4F75DF9BF558216AA8947BD4DB38C995C348

Function 00000259C2A99BE0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 250
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000259C2A9F890: GetUserGeoID.KERNEL32 ref: 00000259C2A9F8B7
Part of subcall function 00000259C2A9F890: GetGeoInfoA.KERNEL32 ref: 00000259C2A9F8D1
Part of subcall function 00000259C2A9F890: GetGeoInfoA.KERNEL32 ref: 00000259C2A9F921

WSAStartup.WS2_32 ref: 00000259C2A99D59
socket.WS2_32 ref: 00000259C2A99D7A
htons.WS2_32 ref: 00000259C2A99DA0
inet_pton.WS2_32 ref: 00000259C2A99DE3
connect.WS2_32 ref: 00000259C2A99DFD
closesocket.WS2_32 ref: 00000259C2A99E1C
WSACleanup.WS2_32 ref: 00000259C2A99E22

Strings

system, xrefs: 00000259C2A99CC5
geo, xrefs: 00000259C2A99D06

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Info$CleanupStartupUserclosesocketconnecthtonsinet_ptonsocket
String ID: geo$system
API String ID: 213021568-2364779556
Opcode ID: 67ab7e2fe52b207ab43a2340c61f1b33df04f9e154bcc21d82dc9e4adf29d0cd
Instruction ID: a74b90704718e02360ec29c1b2b338141f1df8fd4afc05e0a46308a0183c1ed4
Opcode Fuzzy Hash: 67ab7e2fe52b207ab43a2340c61f1b33df04f9e154bcc21d82dc9e4adf29d0cd
Instruction Fuzzy Hash: 8EC18A62B05F41D9EF00DBA5D89839C23B6A74DB9BF414213DA9D177E9DE38C586C308

Function 00000259C2AA3B30 Relevance: 13.6, APIs: 9, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00000259C2AA3B61
GetProcessId.KERNEL32 ref: 00000259C2AA3B6A
RmStartSession.RSTRTMGR ref: 00000259C2AA3B8A
RmRegisterResources.RSTRTMGR ref: 00000259C2AA3BB5
RmGetList.RSTRTMGR ref: 00000259C2AA3BEE
RmGetList.RSTRTMGR ref: 00000259C2AA3C50
RmEndSession.RSTRTMGR ref: 00000259C2AA3C8B
RmEndSession.RSTRTMGR ref: 00000259C2AA3CC2
RmEndSession.RSTRTMGR ref: 00000259C2AA3CD7

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Session$ListProcess$CurrentRegisterResourcesStart
String ID:
API String ID: 3299295986-0
Opcode ID: fd498ee3de36280c394abacf9467fc5b9ce5ac8d70b1b0db778499f5d870b0f3
Instruction ID: 1321074710944a344bcabdc111fa5467d920ecf3a2be1e5a75671323f0cfe7e2
Opcode Fuzzy Hash: fd498ee3de36280c394abacf9467fc5b9ce5ac8d70b1b0db778499f5d870b0f3
Instruction Fuzzy Hash: 8D513F32700A51CAFB10CFA5E85869D73A1F74CB4AF50412BEE4A57BD4DE38C98ACB44

Function 00000259C2ABD5F0 Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000259C2ABDA1D

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 47550b20993fbd762e226fa4ca9e05ae32b1ced83bd225dda60327e294bd4ee8
Instruction ID: 629e0699ba635975e138f8e548d6f8a686a77d0ae70c86e4ff9360d9e8c41b4b
Opcode Fuzzy Hash: 47550b20993fbd762e226fa4ca9e05ae32b1ced83bd225dda60327e294bd4ee8
Instruction Fuzzy Hash: 6BC1EC3A208F85C5EF618B5598483AE3BA0E389F83F594157DACA077D1DB79C8C9C308

Function 00000259C2A98990 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00000259C2A989D3
EnterCriticalSection.KERNEL32 ref: 00000259C2A989E5
EnterCriticalSection.KERNEL32 ref: 00000259C2A989F5
GdiplusShutdown.GDIPLUS ref: 00000259C2A98A03
LeaveCriticalSection.KERNEL32 ref: 00000259C2A98A10
LeaveCriticalSection.KERNEL32 ref: 00000259C2A98A1A

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: 83031f1c3d95a3b59bc2a22e43b72ccd41805d9851eefa9cc92077698de98015
Instruction ID: 46ecccc5c9eebbdc2006d3cd288486d1a8c9d6a557967f13101ceb00b8d4873d
Opcode Fuzzy Hash: 83031f1c3d95a3b59bc2a22e43b72ccd41805d9851eefa9cc92077698de98015
Instruction Fuzzy Hash: 0F11E632111F50C5EF149F25E858159B3A4FB48FA6B684216DAA906BE4DF38C997C348

Function 00000259C2AA0420 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegGetValueA.ADVAPI32 ref: 00000259C2AA0489

Strings

ProductName, xrefs: 00000259C2AA0474
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00000259C2AA047B

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Value
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-1787575317
Opcode ID: 4b31b020cac4b58e91cc22bf7df28ffde147e0876d00deb1f16a5955c36cd2ac
Instruction ID: b7a337e52ea27da95ebfd73ec24bd9346f3e4442121ff14d3b82f1bfbfe47ae1
Opcode Fuzzy Hash: 4b31b020cac4b58e91cc22bf7df28ffde147e0876d00deb1f16a5955c36cd2ac
Instruction Fuzzy Hash: 0C115132618B80C2DB21CF21F84539AB3A4F79DB95F514216EAD807B99DFBCC195CB44

Function 00000259C2A9ED77 Relevance: 4.7, APIs: 3, Instructions: 182networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00000259C2A9F0AC
closesocket.WS2_32 ref: 00000259C2A9F0BE
WSACleanup.WS2_32 ref: 00000259C2A9F0C4

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Cleanupclosesocketrecv
String ID:
API String ID: 3447645871-0
Opcode ID: cededbd8a01b1ec152068a66c0021e75133b9fca01e86202f2537a2f13f52944
Instruction ID: f7060afa996d243737d6df8a67ff7f2a515d54521532150061d5e4dd33dabca9
Opcode Fuzzy Hash: cededbd8a01b1ec152068a66c0021e75133b9fca01e86202f2537a2f13f52944
Instruction Fuzzy Hash: AF915062A18FC0C1EE209B15E85839E6761E79DBA2F104313EAED47BDADF79C4C18744

Function 00000259C2AA1111 Relevance: 4.7, APIs: 3, Instructions: 163registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00000259C2AA1129
RegEnumKeyExA.ADVAPI32 ref: 00000259C2AA116E
RegCloseKey.ADVAPI32 ref: 00000259C2AA1364

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: 46a2b425fe9aeba63369c68ca3981fb753a76c630a185bcaa84e67fe462df2c1
Instruction ID: e7d142a2670df4c8288ecaad9bfa4e28a67f819c5af02b9a43b50795ca2e728e
Opcode Fuzzy Hash: 46a2b425fe9aeba63369c68ca3981fb753a76c630a185bcaa84e67fe462df2c1
Instruction Fuzzy Hash: C9717072A04F80C5EF10CB69E84839D6761F789BAAF100216EBE957BD9DB79C1C5CB04

Function 00000259C2AA10A0 Relevance: 4.6, APIs: 3, Instructions: 96registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00000259C2AA1129
RegEnumKeyExA.ADVAPI32 ref: 00000259C2AA116E

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: EnumOpen
String ID:
API String ID: 3231578192-0
Opcode ID: a8920e58832bf877e089fa0af907033f7a3b2d639e35d700202a240f283f6ca3
Instruction ID: 20f34495e384d3386e97da3040c22ff2a1305d238969dd9fc26b4b2765040724
Opcode Fuzzy Hash: a8920e58832bf877e089fa0af907033f7a3b2d639e35d700202a240f283f6ca3
Instruction Fuzzy Hash: CF317F32700B84D5EB20CFA5EC5879E7364FB48B9AF200216EE9917B98DB78C596C704

Function 00000259C2AA0DDB Relevance: 4.6, APIs: 3, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00000259C2AA0DF7
RegQueryValueExA.ADVAPI32 ref: 00000259C2AA0E36
RegCloseKey.ADVAPI32 ref: 00000259C2AA0ED4

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 0e9a2bb39f3aee4e9858c282cea2b023be1d8108f9c73034c28012e758624651
Instruction ID: 12d1a1e06a0c52214177a8703262fd2f83253aaf86da279dfa51b7425a50b67d
Opcode Fuzzy Hash: 0e9a2bb39f3aee4e9858c282cea2b023be1d8108f9c73034c28012e758624651
Instruction Fuzzy Hash: 4B218262624F80C1EE608B25E89435AA761EBDDBD6F505213EACD42BD9DF3CC1C4DB04

Function 00000259C2A9F890 Relevance: 4.6, APIs: 3, Instructions: 50COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32 ref: 00000259C2A9F8B7
GetGeoInfoA.KERNEL32 ref: 00000259C2A9F8D1
GetGeoInfoA.KERNEL32 ref: 00000259C2A9F921

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: d34c2ece54cb3812040e4eef0477fed434900964bc97860851aa3e607d5351a2
Instruction ID: d433e21b5bd0b667c0ae34f67d26e509a3d121e3d024ae11086174d2145f86ce
Opcode Fuzzy Hash: d34c2ece54cb3812040e4eef0477fed434900964bc97860851aa3e607d5351a2
Instruction Fuzzy Hash: CE119D32618B80C2EB109F61F81471EB7A1F789F8AF045225EB8503B99DF7CD5908B88

Function 00000259C2A99760 Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00000259C2A9979B
OpenProcessToken.ADVAPI32 ref: 00000259C2A997AE
GetTokenInformation.ADVAPI32 ref: 00000259C2A997EA

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: ProcessToken$CurrentInformationOpen
String ID:
API String ID: 2743777493-0
Opcode ID: 5cf106d3b2ffd2a7e9a61a7f883b18dc6c947c023f1ec599732081f4b0d6fdce
Instruction ID: 95ac80760901068d294fccdd93cbc32def0d9937cbf5a2eeb8b9867198c12944
Opcode Fuzzy Hash: 5cf106d3b2ffd2a7e9a61a7f883b18dc6c947c023f1ec599732081f4b0d6fdce
Instruction Fuzzy Hash: A1110D32218F40D2EB509F16F84434AB2A5F788B82F545126EBC957B68CF3DC445CB48

Function 00000259C2A5F350 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A5F53C

Strings

, xrefs: 00000259C2A5F3D3

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-3916222277
Opcode ID: ecea8943f82965ce62faed458054ccd8cfb24b04489c1c816735c8e5d90b1431
Instruction ID: a596bf667ccca07babb1a0eca77ea66e50ee5d0aac4ab04d896990be4ebc3bcd
Opcode Fuzzy Hash: ecea8943f82965ce62faed458054ccd8cfb24b04489c1c816735c8e5d90b1431
Instruction Fuzzy Hash: F4512572204F44D6EE258F2AD95836933A0F34DF96F944622DB9E83BE5CB79D0A1C304

Function 00000259C2AA0C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32 ref: 00000259C2AA0C6C

Strings

Unknown, xrefs: 00000259C2AA0D26

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: 327d7d51cf89ce8cae5e34d504ec04f85fc3bceab43135c4ad84e114b6f625fa
Instruction ID: 7b1a8293ff65b0ad47df6b08e476dd555c9859543cb2aaa31c5b835d01684eb5
Opcode Fuzzy Hash: 327d7d51cf89ce8cae5e34d504ec04f85fc3bceab43135c4ad84e114b6f625fa
Instruction Fuzzy Hash: 9431D023628FC0C6EB11CF25E95439AA360F799B45F545216EBC902B8ADF7CC6D5CB04

Function 00000259C2A651E0 Relevance: 3.2, APIs: 2, Instructions: 192COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A65320
Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A6541F

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 047492ee40e0bcaf5b16723200e7cf24537bdb93927abe219c582ebd26aa8ba3
Instruction ID: 31f6ff9a6bf048f46f5652125d60dd8c30fa4ee6f6bca933df1d26eefaa2b13d
Opcode Fuzzy Hash: 047492ee40e0bcaf5b16723200e7cf24537bdb93927abe219c582ebd26aa8ba3
Instruction Fuzzy Hash: 9951B262305F44C5EE249B66A90839DA365A70CFE7F5806339EED0BBD6DB78C4C18308

Function 00000259C2A98E10 Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 00000259C2A98E69
CoTaskMemFree.OLE32 ref: 00000259C2A98F2A

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: FolderFreeKnownPathTask
String ID:
API String ID: 969438705-0
Opcode ID: 2e1fffe90520dd557920388e28507833548f1b316689cdecaf84a1eb2a2be702
Instruction ID: 56cdfeb75212fee36703d5e9ea012d31000c08255b8bea6d56acdfe69af6ca27
Opcode Fuzzy Hash: 2e1fffe90520dd557920388e28507833548f1b316689cdecaf84a1eb2a2be702
Instruction Fuzzy Hash: F8316072A14B80C5EA20DF69E88435AB761F79DBA5F105316EAEC03BD5DB7CC1C18B44

Function 00000259C2AAE614 Relevance: 3.1, APIs: 2, Instructions: 77COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000259C2AAE63B

Part of subcall function 00000259C2AAE5D0: _invalid_parameter_noinfo.LIBCMT ref: 00000259C2AAE5E7

_invalid_parameter_noinfo.LIBCMT ref: 00000259C2AAE6EF

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cb30a7c2c620b97f400ef9b33bc0fdb0214d80daa24a11497eeb67f4fc095207
Instruction ID: 13cb941f49411208516cfe0bbbc8663974180919f1823783930c6d8ee1320565
Opcode Fuzzy Hash: cb30a7c2c620b97f400ef9b33bc0fdb0214d80daa24a11497eeb67f4fc095207
Instruction Fuzzy Hash: FD31B132610E44C1EE54DB54EE593A93361EB9DF83F940933E689473D2EB78C280CB18

Function 00000259C2A97390 Relevance: 3.1, APIs: 2, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00000259C2A973E1
RegCloseKey.ADVAPI32 ref: 00000259C2A973F3

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: f079ec761da95b766b8b6afbeec7fda29d97571b2deafd3f5d4343d11bd09f0c
Instruction ID: 1650fe8f1bca5c5214a868ad697031fab9d28d5e4bf34933e2bd9c6d72d68541
Opcode Fuzzy Hash: f079ec761da95b766b8b6afbeec7fda29d97571b2deafd3f5d4343d11bd09f0c
Instruction Fuzzy Hash: 4A21F661714E40C5EE50AB22FC4439AA760EB9DFD6F080122EE8D43BDADE38C4C1C704

Function 00000259C2A9664C Relevance: 3.1, APIs: 2, Instructions: 58synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00000259C2A5C8C0: CreateToolhelp32Snapshot.KERNEL32 ref: 00000259C2A5C90A
Part of subcall function 00000259C2A5C8C0: Process32FirstW.KERNEL32 ref: 00000259C2A5C94C

Part of subcall function 00000259C2A5ACC0: CredEnumerateA.ADVAPI32 ref: 00000259C2A5AD22

Part of subcall function 00000259C2A9E9F0: recv.WS2_32 ref: 00000259C2A9EBCC

ReleaseMutex.KERNEL32 ref: 00000259C2A966BB
CloseHandle.KERNEL32 ref: 00000259C2A966C4

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: CloseCreateCredEnumerateFirstHandleMutexProcess32ReleaseSnapshotToolhelp32recv
String ID:
API String ID: 420082584-0
Opcode ID: 6cbb35264d3af9d3b1548d5a1ccd0fc23f5837e511aba725e3f5ecd0c3bcc6bd
Instruction ID: df388ca5bc1f4b4e0682ab03beeb3ab53de7fe43e51ecb4d47bdb182cea00411
Opcode Fuzzy Hash: 6cbb35264d3af9d3b1548d5a1ccd0fc23f5837e511aba725e3f5ecd0c3bcc6bd
Instruction Fuzzy Hash: C1218161608E80C1FE61B7BAAC5E3AE1241AF4DF93F541623E6D5017E79E38C0C4862D

Function 00000259C2A9667D Relevance: 3.0, APIs: 2, Instructions: 47synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00000259C2A9E9F0: recv.WS2_32 ref: 00000259C2A9EBCC

ReleaseMutex.KERNEL32 ref: 00000259C2A966BB
CloseHandle.KERNEL32 ref: 00000259C2A966C4

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: CloseHandleMutexReleaserecv
String ID:
API String ID: 2659716615-0
Opcode ID: eca0cdce0ddfb544edceff3c729bb4a71f08e5ff18005c1b5199ae0a99c22d4d
Instruction ID: 4f9032484f2906ab3cf503696687cfba18703e8d56b55cb14712d35c3a0f3e70
Opcode Fuzzy Hash: eca0cdce0ddfb544edceff3c729bb4a71f08e5ff18005c1b5199ae0a99c22d4d
Instruction Fuzzy Hash: 7111A361608E80C1FE607B79AC4E39E1341AF4DF93F444613EAD9017E79E38C0C5861D

Function 00000259C2ABDB60 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 00000259C2ABDBAC
GetLastError.KERNEL32 ref: 00000259C2ABDBB6

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7e9ab1c6d8c64915d6648e9c143c2363700413bfa3c055332623f50353a46816
Instruction ID: 28a1eda3c0c7362b90862c4a61d43800a6ceb8529de9f6e184c01a32b455a413
Opcode Fuzzy Hash: 7e9ab1c6d8c64915d6648e9c143c2363700413bfa3c055332623f50353a46816
Instruction Fuzzy Hash: 44118F76214F80C1DE109B25A8482596761A789FF6F544312EBB94B7D9CE78C095C704

Function 00000259C2A558F3 Relevance: 3.0, APIs: 2, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 00000259C2A55936
FindClose.KERNELBASE ref: 00000259C2A55958

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: c09ff1b7f36846cd2f70e20038cef65db65028f9499b4e4cc306786389cb5efe
Instruction ID: 2d759bf11a18390e9384615af0f7e7b5c97d757ecec93c9ba5e166e83663e1d9
Opcode Fuzzy Hash: c09ff1b7f36846cd2f70e20038cef65db65028f9499b4e4cc306786389cb5efe
Instruction Fuzzy Hash: FB01EC36218E80C5EA60DB56F85839A6364F78DB96F804023DE8D43B59DE38C8868B04

Function 00000259C2ACCB98 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2ACCBC8

Part of subcall function 00000259C2ACDBEC: std::bad_alloc::bad_alloc.LIBCMT ref: 00000259C2ACDBF5

Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2ACCBCE

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 267b89f17236609d1417f10d46edbd95984192d968a560c5371d581f7ac22313
Instruction ID: fc6d756b0df5cb4fbddbd97e52203ca2b076dc1b77a39728254884cfe676ecd9
Opcode Fuzzy Hash: 267b89f17236609d1417f10d46edbd95984192d968a560c5371d581f7ac22313
Instruction Fuzzy Hash: F3E0E231612E09E1FD2C66BA1C1E2A402494B1DF73E281B23AAF6093C3A936C4D18258

Function 00000259C2ABB550 Relevance: 2.5, APIs: 2, Instructions: 18memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 00000259C2ABB566
GetLastError.KERNEL32 ref: 00000259C2ABB570

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 47cbcda289b4926f8a5fa232dbc04e0ffd722977d505590b0caac84d58b1b127
Instruction ID: 5edfc7f2aa87502aa07b6f8690b435d00093579acf43e8aafe7a2df9838ef1d1
Opcode Fuzzy Hash: 47cbcda289b4926f8a5fa232dbc04e0ffd722977d505590b0caac84d58b1b127
Instruction Fuzzy Hash: 73E0E271B11E49C2FE1867F29CAD62906956B9DF43F0449229A96867D2EA38C8C9820D

Function 00000259C2AAD450 Relevance: 1.7, APIs: 1, Instructions: 189COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2AAD6A0

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: ad2cb0bc93a9f2c573dc059c32f6bb17e3aa8d1924772eb3367983a946f19d44
Instruction ID: 8e76097b75e673906895c8fe0be2c4bc484109b7ae3ac4a192ba4aeed11811ab
Opcode Fuzzy Hash: ad2cb0bc93a9f2c573dc059c32f6bb17e3aa8d1924772eb3367983a946f19d44
Instruction Fuzzy Hash: 8F61AB6A300E80C5EF15DF1AD95836D23A1AB08F9AF548512DEED0B7D5DB39CAC6C708

Function 00000259C2A4E150 Relevance: 1.7, APIs: 1, Instructions: 175COMMON

Download Yara Rule

APIs

__std_fs_directory_iterator_open.LIBCPMT ref: 00000259C2A4E283

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: __std_fs_directory_iterator_open
String ID:
API String ID: 4007087469-0
Opcode ID: f97e729366d47bfa4c7aafed75f1aa1c45cd1a185c9e6d560cf73fb06629d366
Instruction ID: 1e2d6de669929b2304583abdbf77b63da02fa6d2d04da025cec947f4a9bbdc63
Opcode Fuzzy Hash: f97e729366d47bfa4c7aafed75f1aa1c45cd1a185c9e6d560cf73fb06629d366
Instruction Fuzzy Hash: 2461D062B00F40D5FF10CB69D9883AC23A1E74DF9AF009613DE99577D9EA34C8C58358

Function 00000259C2A65B00 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A65C95

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 93ff4aefe56a1fbcd8fc278d924c6e22c2da32e4497507a5f2ef2736dfcda9af
Instruction ID: e9df7440d3eba065ae3e99de6dba1c8e125a65a0a8d1303af8c81627570dfcdb
Opcode Fuzzy Hash: 93ff4aefe56a1fbcd8fc278d924c6e22c2da32e4497507a5f2ef2736dfcda9af
Instruction Fuzzy Hash: 61418B62304F84D5EE109B16E84839E6366B74DFD6F580622EFED0B7C6EB39C0818308

Function 00000259C2A8B010 Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A8B1B7

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 70463512125a8373cde5a3b87be7849059a838aa6b28dcb32a5bc345d01126ba
Instruction ID: df17ea187b65a09e1a26327583d49a6a70daf2244127330427cb5f4a5e6b376a
Opcode Fuzzy Hash: 70463512125a8373cde5a3b87be7849059a838aa6b28dcb32a5bc345d01126ba
Instruction Fuzzy Hash: E4418E72214F84C2DE24CB65E9582AAA3A1F74CFD2F544A16EBED47BC5DB38C084C304

Function 00000259C2A69ED0 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A6A034

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: f861d8dc2613c7c80dd27573cd720c77548c38ce1937873e8d76364d9b51d931
Instruction ID: 238b8f555db7165dab5a845253c900e9dc9e598326b3df8919dcfbc81b60d26b
Opcode Fuzzy Hash: f861d8dc2613c7c80dd27573cd720c77548c38ce1937873e8d76364d9b51d931
Instruction Fuzzy Hash: 1931BF62301E85C5ED14DB66A8086AAA254B34CFE6F944A26AFAD077D6CB3DC1818308

Function 00000259C2A65CB0 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A65E2C

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 51a6ed7fb7b4fe90d851e2ce25433792cdcab9d14c71ee120367246829675a15
Instruction ID: e77dd31f1c531e2efc64d06815d342062cb9771123424a6892887edfa06c1911
Opcode Fuzzy Hash: 51a6ed7fb7b4fe90d851e2ce25433792cdcab9d14c71ee120367246829675a15
Instruction Fuzzy Hash: 41418E62301F44D5EE24EB56AD0C39AA361A70CFD6F584623DEED0B7D6DB38C1818748

Function 00000259C2A615C0 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A61711

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: e2ba41051abda489aea9c977d78c40073930bd061eee85ef7ac46d88b0847fa1
Instruction ID: f5a0bfc65985b00949edda6f6194fd79f0afcb73bf4a5791d51765ac728a95c1
Opcode Fuzzy Hash: e2ba41051abda489aea9c977d78c40073930bd061eee85ef7ac46d88b0847fa1
Instruction Fuzzy Hash: 2031D266701F44C4FE159B59A9083A91A95970CFEBF5806239EAD07BC6EB39C4C18348

Function 00000259C2ABBA50 Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000259C2ABBA78

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 62a68b64f697a3323ce5c67975f603dd912b7630c4b3619a8df593f8b8e10b11
Instruction ID: 379a7a537d9c1c56790409b53454a5796421725d56ef706a654c532692375f24
Opcode Fuzzy Hash: 62a68b64f697a3323ce5c67975f603dd912b7630c4b3619a8df593f8b8e10b11
Instruction Fuzzy Hash: 8E410232615A04C7EE348B19ED5876973A0E75AF83F141506EBD6837E6CB78C882C758

Function 00000259C2AA0250 Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32 ref: 00000259C2AA02E0

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: bab2c3626ac6b4d65a00a26ee52bdc39fa55a87b0d5a689555181bbd374438f5
Instruction ID: 86e4ba0dbb62be44816fe120933f6905050ec5e2f99df68e63351619f6303b8d
Opcode Fuzzy Hash: bab2c3626ac6b4d65a00a26ee52bdc39fa55a87b0d5a689555181bbd374438f5
Instruction Fuzzy Hash: 0D516C32A14F80CAEB10CB69E84439D73A4F799B89F505212EBDC53B99DF78C685CB44

Function 00000259C2A5FE50 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A5FF58

Part of subcall function 00000259C2A4B7B0: __std_exception_copy.LIBVCRUNTIME ref: 00000259C2A4B7F8

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy
String ID:
API String ID: 317858897-0
Opcode ID: fa5db2aca4c7c8d6f58f58726680fb60434e957890374861043c0cd68a3ad1fe
Instruction ID: 2b7ed87fab54367f21649438c5d9d1b9099e7758c87515bee202b88b23e4c93f
Opcode Fuzzy Hash: fa5db2aca4c7c8d6f58f58726680fb60434e957890374861043c0cd68a3ad1fe
Instruction Fuzzy Hash: EF21F922A01F40C1EE18DB55A90436A6390A75DFA6F2447339EBC87BD2EA79C4D28344

Function 00000259C2ABD4D0 Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000259C2ABD556

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 90e282629e3327800b1a09ea2473f0e2941ce1167cc6a0942764be9094e0e12c
Instruction ID: c0e9ff882447a2efda70546d4611a2b109a4e4e00182ed836db8f67197e11d2e
Opcode Fuzzy Hash: 90e282629e3327800b1a09ea2473f0e2941ce1167cc6a0942764be9094e0e12c
Instruction Fuzzy Hash: 6B31BF76214E50C6FF116B65CC5935C2660A78CFABF410257EAA9473D2DBB8C4C1C729

Function 00000259C2ADE208 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000259C2ADE22B

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c41a516aab5bbd5a0cb5ee3d8915c07e5e449c965519035ee3790c186b832703
Instruction ID: 5d01594d7e8efc49ab866cba70d36ae3ec4c5eaf579672adef68c85c6af34a18
Opcode Fuzzy Hash: c41a516aab5bbd5a0cb5ee3d8915c07e5e449c965519035ee3790c186b832703
Instruction Fuzzy Hash: C6218132214F40C7EF618F18D944369B6A1E798F56F544226EBE9877D9DB39C8808B04

Function 00000259C2ADC510 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000259C2ADC46D

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6080b6f5c7735027f4532a4154f17099be5a1c2b37b88469d38b788aa2f2ab04
Instruction ID: 96cf3b62abd6a2834d7d8b159c8ed5b281f37d06ab716931cb90deb38c8154bf
Opcode Fuzzy Hash: 6080b6f5c7735027f4532a4154f17099be5a1c2b37b88469d38b788aa2f2ab04
Instruction Fuzzy Hash: 57118E72618B40D1FE619F519C183B9A261F78DF83F844512EAC847BC6CB7DC5818748

Function 00000259C2A9ADC0 Relevance: 1.5, APIs: 1, Instructions: 38networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00000259C2A9AE08

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: af342f55a76444dc29af71e8fb4152a83f454f5b800a0383b076c9e997804f61
Instruction ID: 401975b6c856bd5291446d615f13316a158ae980ac8e06424b3b8619c30ac849
Opcode Fuzzy Hash: af342f55a76444dc29af71e8fb4152a83f454f5b800a0383b076c9e997804f61
Instruction Fuzzy Hash: FB01A225718A94C2DF509F1BB984319A3A0F78CFD5F485132EE9D43B89DB38C8918B44

Function 00000259C2AAED2C Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000259C2AAED4B

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8baf8acf487f5caa78a15ef12004ef049afcc069522c3c2ef46e844b516c0117
Instruction ID: 4c3cd1c542b96bb1350ce725e63ff3999281665d119c0f67f711c773802bc36e
Opcode Fuzzy Hash: 8baf8acf487f5caa78a15ef12004ef049afcc069522c3c2ef46e844b516c0117
Instruction Fuzzy Hash: 8CE02231229F41C5EF242BB4EA49328B160AF0CFB2F144733A7B4023CACA39C4D08A18

Function 00000259C2AD97D0 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 00000259C2AD97D4

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 4177796e15072c585db232ab642f29accb6d05ea1f689265af403d42f2bb1474
Instruction ID: e8fa2cd4c8b5c1cb3618338e216a59ae0e61dacd32afb6c875845be075bb51f7
Opcode Fuzzy Hash: 4177796e15072c585db232ab642f29accb6d05ea1f689265af403d42f2bb1474
Instruction Fuzzy Hash: 98C04829F56E06C2FE586BA25C8A24611A0B75CB03F804422C28880790EA3CC1EB8A1D

Function 00000259C2ADB3C4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 00000259C2ADB3CD

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 5d96549d17151685d9874b2efd5e6665c09aeaad6767ec6861ada1b691878f94
Instruction ID: 8e954a876a194ea80c3edb16af6cc491fb8a36fa9381da8842daa82b25ce1ca4
Opcode Fuzzy Hash: 5d96549d17151685d9874b2efd5e6665c09aeaad6767ec6861ada1b691878f94
Instruction Fuzzy Hash: E2B09226A14CC0C3CA11EB04EC460097331F798B0EFD00001E28D42B64CE2CCA2A8E04

Function 00000259C2ABDEDC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00000259C2ABDF1A

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: ad1b43cdb7c3550550fd4afa13c905d117ea5c1f34bfd66f5f885cc22fb7391c
Instruction ID: 97869ffca7fcd78bba1c4ee84c4e424c78d9c08d69124fbaf1c7351e39cb3ed1
Opcode Fuzzy Hash: ad1b43cdb7c3550550fd4afa13c905d117ea5c1f34bfd66f5f885cc22fb7391c
Instruction Fuzzy Hash: C1F0A029319E49C4FE181BB25C5C36522946B4CFB3F084763ADE6863C1DA3CC4C1C518

Non-executed Functions

Function 00000259C2AB0D98 Relevance: 49.1, APIs: 25, Strings: 2, Instructions: 1888COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000259C2AB10CF
_invalid_parameter_noinfo.LIBCMT ref: 00000259C2AB1332
_invalid_parameter_noinfo.LIBCMT ref: 00000259C2AB15F5
_invalid_parameter_noinfo.LIBCMT ref: 00000259C2AB1895
memcpy_s.LIBCPMT ref: 00000259C2AB1AA2
memcpy_s.LIBCPMT ref: 00000259C2AB1B3E
memcpy_s.LIBCPMT ref: 00000259C2AB1FF6
memcpy_s.LIBCPMT ref: 00000259C2AB2031
memcpy_s.LIBCPMT ref: 00000259C2AB215D
memcpy_s.LIBCPMT ref: 00000259C2AB2284
memcpy_s.LIBCPMT ref: 00000259C2AB232F
memcpy_s.LIBCPMT ref: 00000259C2AB2377
memcpy_s.LIBCPMT ref: 00000259C2AB23A1
memcpy_s.LIBCPMT ref: 00000259C2AB2452
memcpy_s.LIBCPMT ref: 00000259C2AB2652
memcpy_s.LIBCPMT ref: 00000259C2AB2697
memcpy_s.LIBCPMT ref: 00000259C2AB274E
memcpy_s.LIBCPMT ref: 00000259C2AB287B
memcpy_s.LIBCPMT ref: 00000259C2AB1F46

Part of subcall function 00000259C2AB31E4: _invalid_parameter_noinfo.LIBCMT ref: 00000259C2AB3216

memcpy_s.LIBCPMT ref: 00000259C2AB1FC1
memcpy_s.LIBCPMT ref: 00000259C2AB2A35

Strings

, xrefs: 00000259C2AB2928
, xrefs: 00000259C2AB27FB

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: memcpy_s$_invalid_parameter_noinfo
String ID: $
API String ID: 2880407647-227171996
Opcode ID: df87294ae73204ead43c2230939cbb6a00851c436377c9d63da8146f7a05de15
Instruction ID: 36ffce4eb846ee4e615b4429f7467a8614f9c6b83ab26db513f3fbbca8c5ee76
Opcode Fuzzy Hash: df87294ae73204ead43c2230939cbb6a00851c436377c9d63da8146f7a05de15
Instruction Fuzzy Hash: 1D03A272610AC0CBEB758F29DD587EA3791F748B8AF00511BDA4697BC8D735DA80CB44

Function 00000259C2AA43F0 Relevance: 34.3, APIs: 18, Strings: 1, Instructions: 1015stringmemorynativeCOMMON

Download Yara Rule

APIs

RtlAcquirePebLock.NTDLL ref: 00000259C2AA4433
NtAllocateVirtualMemory.NTDLL ref: 00000259C2AA446B
lstrcpyW.KERNEL32 ref: 00000259C2AA44CD
lstrcatW.KERNEL32 ref: 00000259C2AA4582
NtAllocateVirtualMemory.NTDLL ref: 00000259C2AA4609
lstrcpyW.KERNEL32 ref: 00000259C2AA46BC
RtlInitUnicodeString.NTDLL ref: 00000259C2AA46D1
RtlInitUnicodeString.NTDLL ref: 00000259C2AA46E6
LdrEnumerateLoadedModules.NTDLL ref: 00000259C2AA46F9
RtlReleasePebLock.NTDLL ref: 00000259C2AA46FF

Part of subcall function 00000259C2A98E10: SHGetKnownFolderPath.SHELL32 ref: 00000259C2A98E69
Part of subcall function 00000259C2A98E10: CoTaskMemFree.OLE32 ref: 00000259C2A98F2A

CoInitializeEx.OLE32 ref: 00000259C2AA47AA
lstrcpyW.KERNEL32 ref: 00000259C2AA4989
lstrcatW.KERNEL32 ref: 00000259C2AA4B8E
CoGetObject.OLE32 ref: 00000259C2AA4BAC
lstrcpyW.KERNEL32 ref: 00000259C2AA5229
lstrcatW.KERNEL32 ref: 00000259C2AA544C
CoGetObject.OLE32 ref: 00000259C2AA546A
CoUninitialize.OLE32 ref: 00000259C2AA5932

Strings

0, xrefs: 00000259C2AA506A

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AllocateInitLockMemoryObjectStringUnicodeVirtual$AcquireEnumerateFolderFreeInitializeKnownLoadedModulesPathReleaseTaskUninitialize
String ID: 0
API String ID: 1424456515-4108050209
Opcode ID: fd08a15f5606d8e955b5eeb1fbd96735714114fddb27a0e231a6530836212068
Instruction ID: d647f82ea5abd3ae970822dfa56731f3ab3b5dc81970321b3422e5913387fb10
Opcode Fuzzy Hash: fd08a15f5606d8e955b5eeb1fbd96735714114fddb27a0e231a6530836212068
Instruction Fuzzy Hash: AAC29436626F84CAD7908F69E88169DB3B5F788B88F106219EECD57B18EF38C154C744

Function 00000259C2A26180 Relevance: 30.2, Strings: 24, Instructions: 238COMMON

Download Yara Rule

Strings

ntuser.dat.log, xrefs: 00000259C2A2632D
indexervolumeguid, xrefs: 00000259C2A26473
ntuser.ini, xrefs: 00000259C2A26359
BOOTNXT, xrefs: 00000259C2A2658D
bootsect.bak, xrefs: 00000259C2A26246
bootstat.dat, xrefs: 00000259C2A26415
bootmgfw.efi, xrefs: 00000259C2A261F9
wpsettings.dat, xrefs: 00000259C2A264A2
reagent.xml, xrefs: 00000259C2A2652F
bootfont.bin, xrefs: 00000259C2A26220
d3d9caps.dat, xrefs: 00000259C2A263E6
winsipolicy.p7b, xrefs: 00000259C2A262B8
bootmgr, xrefs: 00000259C2A2655E
boot.ini, xrefs: 00000259C2A261D1
ntldr, xrefs: 00000259C2A26292
gdipfontcachev1.dat, xrefs: 00000259C2A263B7
ntuser.dat, xrefs: 00000259C2A26304
mib.bin, xrefs: 00000259C2A26444
thumbs.db, xrefs: 00000259C2A26388
desktop.ini, xrefs: 00000259C2A2626C
winre.wim, xrefs: 00000259C2A26500
iconcache.db, xrefs: 00000259C2A262DE
boot.sdi, xrefs: 00000259C2A264D1
autorun.inf, xrefs: 00000259C2A261A8

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: BOOTNXT$autorun.inf$boot.ini$boot.sdi$bootfont.bin$bootmgfw.efi$bootmgr$bootsect.bak$bootstat.dat$d3d9caps.dat$desktop.ini$gdipfontcachev1.dat$iconcache.db$indexervolumeguid$mib.bin$ntldr$ntuser.dat$ntuser.dat.log$ntuser.ini$reagent.xml$thumbs.db$winre.wim$winsipolicy.p7b$wpsettings.dat
API String ID: 118556049-850610325
Opcode ID: dea6d34053270f54165e7821960ee4cc20a6cc02140d0cf59d37aac2e2ba149c
Instruction ID: 79cb60e9842f0d2ae969fa9e8ce890958176ea5f2e625835d3721ddff35bd615
Opcode Fuzzy Hash: dea6d34053270f54165e7821960ee4cc20a6cc02140d0cf59d37aac2e2ba149c
Instruction Fuzzy Hash: BEC14052D60FC984EB21DF35DC823E95321F7EE785F606317A98866856AFB4E2C4C344

Function 00000259C2A6C820 Relevance: 29.3, APIs: 2, Strings: 14, Instructions: 1339COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A6DEA1
Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A6DF4F

Part of subcall function 00000259C2A4B930: __std_exception_copy.LIBVCRUNTIME ref: 00000259C2A4B973

Part of subcall function 00000259C2ACF198: RtlPcToFileHeader.KERNEL32 ref: 00000259C2ACF1E8
Part of subcall function 00000259C2ACF198: RaiseException.KERNEL32 ref: 00000259C2ACF229

Strings

word wasnt properly ended, xrefs: 00000259C2A6DF55
unexpected key without object, xrefs: 00000259C2A6DE7A
quote was opened but not closed., xrefs: 00000259C2A6DDC6, 00000259C2A6DE3B
*, xrefs: 00000259C2A6CB3D
#include, xrefs: 00000259C2A6D1F9
key opened, but never closed, xrefs: 00000259C2A6DF28
key declared, but no value, xrefs: 00000259C2A6DDED, 00000259C2A6DE14, 00000259C2A6DF01
unexpected '}', xrefs: 00000259C2A6DF7C
#base, xrefs: 00000259C2A6D225
/, xrefs: 00000259C2A6CB12
Unexpected eof, xrefs: 00000259C2A6DD72
object is not closed with '}', xrefs: 00000259C2A6DD9F
", xrefs: 00000259C2A6CD13
No closed word, xrefs: 00000259C2A6DEA7, 00000259C2A6DECE

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$ExceptionFileHeaderRaise__std_exception_copy
String ID: "$#base$#include$*$/$No closed word$Unexpected eof$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 145623376-3561477107
Opcode ID: 779049d0dfa49f441fc86eb20f891799c0f327457b323729577624a3d6bcce72
Instruction ID: ddd3015c541f8342984faa11db501bdf16c87fe2956e5369ebb249723a34d35d
Opcode Fuzzy Hash: 779049d0dfa49f441fc86eb20f891799c0f327457b323729577624a3d6bcce72
Instruction Fuzzy Hash: 94D24672201FC4D9EF619F25DC983D923A5E749B8AF448123DA8D1ABDADF74C685C308

Function 00000259C2A25DB0 Relevance: 25.2, Strings: 20, Instructions: 202COMMON

Download Yara Rule

Strings

$windows.~ws, xrefs: 00000259C2A25F89
Program Files, xrefs: 00000259C2A260D2
PerfLogs, xrefs: 00000259C2A25F34
Program Files (x86), xrefs: 00000259C2A26101
Application Data, xrefs: 00000259C2A25E9C
$winreagent, xrefs: 00000259C2A25F5D
Windows, xrefs: 00000259C2A25E01
All users, xrefs: 00000259C2A26074
AppData, xrefs: 00000259C2A25FE7
bootmgr, xrefs: 00000259C2A260A3
Windows.old, xrefs: 00000259C2A25EE8
config.msi, xrefs: 00000259C2A25EC2
Boot, xrefs: 00000259C2A25E50
#recycle, xrefs: 00000259C2A25E29
ntldr, xrefs: 00000259C2A26016
ProgramData, xrefs: 00000259C2A26045
Windows.~bt, xrefs: 00000259C2A25FB8
$windows.~bt, xrefs: 00000259C2A25F0E
System Volume Information, xrefs: 00000259C2A25E76
$recycle.bin, xrefs: 00000259C2A25DD8

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: #recycle$$recycle.bin$$windows.~bt$$windows.~ws$$winreagent$All users$AppData$Application Data$Boot$PerfLogs$Program Files$Program Files (x86)$ProgramData$System Volume Information$Windows$Windows.old$Windows.~bt$bootmgr$config.msi$ntldr
API String ID: 118556049-2722463023
Opcode ID: b349f0743e28fad41dd0cf6d04c419ecc5bc303b8eb5692233894048f4044c83
Instruction ID: 8c56977ff0abf90e32215a774a723826493507170bc669a4bec79618d4666782
Opcode Fuzzy Hash: b349f0743e28fad41dd0cf6d04c419ecc5bc303b8eb5692233894048f4044c83
Instruction Fuzzy Hash: 16A16152E60FC984EB11DB35DC823E95321F7EE786F606317A98862956AFB4E2C4C344

Function 00000259C2A6E320 Relevance: 24.1, APIs: 2, Strings: 11, Instructions: 1388COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A6FA31
Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A6FB06

Strings

word wasnt properly ended, xrefs: 00000259C2A6FA85, 00000259C2A6FB0C
unexpected key without object, xrefs: 00000259C2A6FA0A
#base, xrefs: 00000259C2A6EDB6
quote was opened but not closed., xrefs: 00000259C2A6F956, 00000259C2A6F9CB
#include, xrefs: 00000259C2A6ED8A
Unexpected eof, xrefs: 00000259C2A6F902
object is not closed with '}', xrefs: 00000259C2A6F92F
key opened, but never closed, xrefs: 00000259C2A6FADF
key declared, but no value, xrefs: 00000259C2A6F97D, 00000259C2A6F9A4, 00000259C2A6FAB8
unexpected '}', xrefs: 00000259C2A6FB33
No closed word, xrefs: 00000259C2A6FA37, 00000259C2A6FA5E

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: #base$#include$No closed word$Unexpected eof$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 118556049-1838291449
Opcode ID: 518946e1d895b6e528b4344295d9f590ad1199015f90ecf2709bb257a5717606
Instruction ID: dc1a3fa2f8820721b06ce3726d4f71545f88ba68ef8e51ff96a90e3008a79d0f
Opcode Fuzzy Hash: 518946e1d895b6e528b4344295d9f590ad1199015f90ecf2709bb257a5717606
Instruction Fuzzy Hash: 78E25862211EC4C9EF608F24DD583E923A5E74DB9AF448122DA9D4BBD9DF78C6C5C308

Function 00000259C2AA3CF0 Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 351nativelibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00000259C2AA3D36
GetProcAddress.KERNEL32 ref: 00000259C2AA3D46
OpenProcess.KERNEL32 ref: 00000259C2AA3D78
NtQuerySystemInformation.NTDLL ref: 00000259C2AA3DA0
NtQuerySystemInformation.NTDLL ref: 00000259C2AA3DCE
GetCurrentProcess.KERNEL32 ref: 00000259C2AA3E93
NtQueryObject.NTDLL ref: 00000259C2AA3ED9
GetFinalPathNameByHandleA.KERNEL32 ref: 00000259C2AA3FCD
CloseHandle.KERNEL32 ref: 00000259C2AA40E8
CloseHandle.KERNEL32 ref: 00000259C2AA4178

Strings

NtDuplicateObject, xrefs: 00000259C2AA3D3F
File, xrefs: 00000259C2AA3F0A
ntdll.dll, xrefs: 00000259C2AA3D2F

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Handle$Query$CloseInformationProcessSystem$AddressCurrentFinalModuleNameObjectOpenPathProc
String ID: File$NtDuplicateObject$ntdll.dll
API String ID: 2729825427-3955674919
Opcode ID: 19a329b1698b27f6415894aedb489b4e345f624b28bb062fda18895a27a00e6b
Instruction ID: 15d4132f6ec7009f179ad5d6c09104aeb383161f1ed9e94f90078110aedd4809
Opcode Fuzzy Hash: 19a329b1698b27f6415894aedb489b4e345f624b28bb062fda18895a27a00e6b
Instruction Fuzzy Hash: 57E1A462714E40C9FF10CB65D8183AD67A1EB49F8AF004112EE9D57BD9DF79C58AC708

Function 00000259C2A8F040 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 218COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32 ref: 00000259C2A8F09F

Strings

@, xrefs: 00000259C2A8F226

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Initialize
String ID: @
API String ID: 2538663250-2766056989
Opcode ID: 28daa065bdd922f2104b70152547a23b89895abeef6d42904c205fc10f82d609
Instruction ID: edaa34e7e9157ecb1cbf591865ce7cdec67910216870b5f571529963ff69a25b
Opcode Fuzzy Hash: 28daa065bdd922f2104b70152547a23b89895abeef6d42904c205fc10f82d609
Instruction Fuzzy Hash: C3A15B72B04A40CAEB10CB75E8187AD77B1F78CB8AF504216DE9A57B94EF38C1958348

Function 00000259C2A951E0 Relevance: 21.5, APIs: 1, Strings: 11, Instructions: 465COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32 ref: 00000259C2A95767

Strings

runas, xrefs: 00000259C2A956E6
.exe, xrefs: 00000259C2A9532D
.vbs, xrefs: 00000259C2A952D2
.ps1, xrefs: 00000259C2A95274
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;', xrefs: 00000259C2A95374
ios_base::eofbit set, xrefs: 00000259C2A9598C
.cmd, xrefs: 00000259C2A952A3
open, xrefs: 00000259C2A956DD
ios_base::badbit set, xrefs: 00000259C2A9597A
.exe, xrefs: 00000259C2A95245
ios_base::failbit set, xrefs: 00000259C2A95985

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: .cmd$.exe$.exe$.ps1$.vbs$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;'$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$open$runas
API String ID: 587946157-4093014531
Opcode ID: df2d4dabee3204ae2a58fd944dc839f708084f1b3e06dbc7e46acf9e24b3ec9d
Instruction ID: cfd39fcb01f453b29bf1a2c4ee9a01392d07bc3bb468e6dcaca4c6dd2688d103
Opcode Fuzzy Hash: df2d4dabee3204ae2a58fd944dc839f708084f1b3e06dbc7e46acf9e24b3ec9d
Instruction Fuzzy Hash: C222B072A10F80C9EF10DF29E84939D27A1F789BAAF505216EA9D07BE9DF74C184C704

Function 00000259C2AA4740 Relevance: 16.6, APIs: 8, Strings: 1, Instructions: 839stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00000259C2AA43F0: RtlAcquirePebLock.NTDLL ref: 00000259C2AA4433
Part of subcall function 00000259C2AA43F0: NtAllocateVirtualMemory.NTDLL ref: 00000259C2AA446B
Part of subcall function 00000259C2AA43F0: lstrcpyW.KERNEL32 ref: 00000259C2AA44CD
Part of subcall function 00000259C2AA43F0: lstrcatW.KERNEL32 ref: 00000259C2AA4582

CoInitializeEx.OLE32 ref: 00000259C2AA47AA
lstrcpyW.KERNEL32 ref: 00000259C2AA4989
lstrcatW.KERNEL32 ref: 00000259C2AA4B8E
CoGetObject.OLE32 ref: 00000259C2AA4BAC
lstrcpyW.KERNEL32 ref: 00000259C2AA5229
lstrcatW.KERNEL32 ref: 00000259C2AA544C
CoGetObject.OLE32 ref: 00000259C2AA546A
CoUninitialize.OLE32 ref: 00000259C2AA5932

Strings

0, xrefs: 00000259C2AA506A

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: lstrcatlstrcpy$Object$AcquireAllocateInitializeLockMemoryUninitializeVirtual
String ID: 0
API String ID: 3636535045-4108050209
Opcode ID: 148f1cac526a25eedb59746f716de0c0cfa115320cfb54a3382c2084b1ee678e
Instruction ID: 29b70efe6ac3cdc857b7d881c1218ee442925d0c31918b93004ac66afea8fd7b
Opcode Fuzzy Hash: 148f1cac526a25eedb59746f716de0c0cfa115320cfb54a3382c2084b1ee678e
Instruction Fuzzy Hash: A7B2963662AFC58AD7808F69E88165EB7B5F788B88F106215FECD57B18EB38C154C740

Function 00000259C2A9AE50 Relevance: 13.2, APIs: 2, Strings: 4, Instructions: 2695COMMON

Download Yara Rule

Strings

cannot use push_back() with , xrefs: 00000259C2A9E393
cannot compare iterators of different containers, xrefs: 00000259C2A9E43F, 00000259C2A9E4EF, 00000259C2A9E61F
value, xrefs: 00000259C2A9B688
type must be string, but is , xrefs: 00000259C2A9E3FD, 00000259C2A9E4AD, 00000259C2A9E571, 00000259C2A9E5CB

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: cannot compare iterators of different containers$cannot use push_back() with $type must be string, but is $value
API String ID: 118556049-2711811579
Opcode ID: de5d6f4c971ed528525af043bb64d6a1cd148540575aaaf437ad282287534789
Instruction ID: 92fd5d50dd5e32b70400ddd65b9d6a856d0ae1d4a5d5f635e1d078f36ce54ef6
Opcode Fuzzy Hash: de5d6f4c971ed528525af043bb64d6a1cd148540575aaaf437ad282287534789
Instruction Fuzzy Hash: 8D533422614FC0C9EF609F25DC883DD23A5F749B9AF509616DA9D5ABDAEF34C284C304

Function 00000259C2AC6F14 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000259C2AB81FC: GetLastError.KERNEL32 ref: 00000259C2AB820B
Part of subcall function 00000259C2AB81FC: FlsGetValue.KERNEL32 ref: 00000259C2AB8220
Part of subcall function 00000259C2AB81FC: SetLastError.KERNEL32 ref: 00000259C2AB82AB

TranslateName.LIBCMT ref: 00000259C2AC6F7E
TranslateName.LIBCMT ref: 00000259C2AC6FB9
GetACP.KERNEL32 ref: 00000259C2AC7000
IsValidCodePage.KERNEL32 ref: 00000259C2AC7038
GetLocaleInfoW.KERNEL32 ref: 00000259C2AC71F5

Strings

utf8, xrefs: 00000259C2AC711C

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: 4309449c26b629e9b6de698707476955217e9cbe9722d2e68f3c85218e94a805
Instruction ID: 25f6e82d7929fdcec698aac3c060da19b07236afcccae6c8b015394f6f5db496
Opcode Fuzzy Hash: 4309449c26b629e9b6de698707476955217e9cbe9722d2e68f3c85218e94a805
Instruction Fuzzy Hash: 57916A32200B40C5EF649F61DD497A923ADF78CF83F4481239A99477E9DB3AC995C748

Function 00000259C2AC795C Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000259C2AB81FC: GetLastError.KERNEL32 ref: 00000259C2AB820B
Part of subcall function 00000259C2AB81FC: FlsGetValue.KERNEL32 ref: 00000259C2AB8220
Part of subcall function 00000259C2AB81FC: SetLastError.KERNEL32 ref: 00000259C2AB82AB

Part of subcall function 00000259C2AB81FC: FlsSetValue.KERNEL32 ref: 00000259C2AB8241
Part of subcall function 00000259C2AB81FC: FlsGetValue.KERNEL32 ref: 00000259C2AB82E1

GetUserDefaultLCID.KERNEL32 ref: 00000259C2AC7ACC

Part of subcall function 00000259C2AB81FC: FlsSetValue.KERNEL32 ref: 00000259C2AB826E
Part of subcall function 00000259C2AB81FC: FlsSetValue.KERNEL32 ref: 00000259C2AB827F
Part of subcall function 00000259C2AB81FC: FlsSetValue.KERNEL32 ref: 00000259C2AB8290
Part of subcall function 00000259C2AB81FC: FlsSetValue.KERNEL32 ref: 00000259C2AB8300
Part of subcall function 00000259C2AB81FC: FlsSetValue.KERNEL32 ref: 00000259C2AB8328

EnumSystemLocalesW.KERNEL32 ref: 00000259C2AC7AB3
ProcessCodePage.LIBCMT ref: 00000259C2AC7AF6
IsValidCodePage.KERNEL32 ref: 00000259C2AC7B08
IsValidLocale.KERNEL32 ref: 00000259C2AC7B1E
GetLocaleInfoW.KERNEL32 ref: 00000259C2AC7B7A
GetLocaleInfoW.KERNEL32 ref: 00000259C2AC7B96

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 5eb0d27aa7dc3a9912447742f13a9ce850b1caaedf69b48f01ffc0c9247ee539
Instruction ID: 0f7c03f326f3c70edd3aa19ffdd5c5388e3c9d21cedff9aae100a014cf851e19
Opcode Fuzzy Hash: 5eb0d27aa7dc3a9912447742f13a9ce850b1caaedf69b48f01ffc0c9247ee539
Instruction Fuzzy Hash: 42717532700A00CAFF159B61DC597A837A8BB4CF4BF4440278A9A57BD5EB3AC985C318

Function 00000259C2A84710 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00000259C2A848C4
__std_exception_destroy.LIBVCRUNTIME ref: 00000259C2A848D2
__std_exception_destroy.LIBVCRUNTIME ref: 00000259C2A84B55
__std_exception_destroy.LIBVCRUNTIME ref: 00000259C2A84B63

Strings

value, xrefs: 00000259C2A847EA, 00000259C2A84A83

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: 6739eb1e44084382e61603688e34c692cafcc2fd8894cdb90ee5299e3fffaf56
Instruction ID: 9db3670e57e0a89b2a7339dbc8e00f07611478314e68563556005d93828160e4
Opcode Fuzzy Hash: 6739eb1e44084382e61603688e34c692cafcc2fd8894cdb90ee5299e3fffaf56
Instruction Fuzzy Hash: 45027D62614FC0CAEF00CB75D8883AD6761E789BA6F505212EAED43BDADB78C1C5C704

Function 00000259C2AAF920 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00000259C2AAF999
RtlLookupFunctionEntry.KERNEL32 ref: 00000259C2AAF9B1
RtlVirtualUnwind.KERNEL32 ref: 00000259C2AAF9EC
IsDebuggerPresent.KERNEL32 ref: 00000259C2AAFA25
SetUnhandledExceptionFilter.KERNEL32 ref: 00000259C2AAFA2F
UnhandledExceptionFilter.KERNEL32 ref: 00000259C2AAFA3A

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: c7f70f128318b326f672a7b0d6647dc5eb587961ea58d1b4d09a7c2ba848fd84
Instruction ID: a1ff81d66a501c49659ce2d56aac1929f6963ef70c272e826c290432866fec6a
Opcode Fuzzy Hash: c7f70f128318b326f672a7b0d6647dc5eb587961ea58d1b4d09a7c2ba848fd84
Instruction Fuzzy Hash: 33314C36214F80D6EB64CB25EC4439E73A4F78DB5AF540116EA9D43BA5DF38C286CB04

Function 00000259C2A59090 Relevance: 8.4, Strings: 6, Instructions: 916COMMON

Download Yara Rule

Strings

content, xrefs: 00000259C2A59D62
filename, xrefs: 00000259C2A59BE9
key, xrefs: 00000259C2A595ED, 00000259C2A597CD
exists, xrefs: 00000259C2A5A167, 00000259C2A5A182
directory_iterator::directory_iterator, xrefs: 00000259C2A5A1D4
files, xrefs: 00000259C2A59EE5

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID: content$directory_iterator::directory_iterator$exists$filename$files$key
API String ID: 0-2980817763
Opcode ID: 1bd9b4b04057703ed62958e17289e5447afc4a23408f4e6ee9393a8372b7d45b
Instruction ID: 17b0a17690f7df224238b1aec5fe070d079554b242faea51489d349539ed76a8
Opcode Fuzzy Hash: 1bd9b4b04057703ed62958e17289e5447afc4a23408f4e6ee9393a8372b7d45b
Instruction Fuzzy Hash: DDA24872611FC489DB218F24DC883DE73A5F799B5AF405626EA9C0BB99EF74C284C344

Function 00000259C2A57B8D Relevance: 7.4, Strings: 5, Instructions: 1142COMMON

Download Yara Rule

Strings

content, xrefs: 00000259C2A57E5F, 00000259C2A581E7, 00000259C2A58B04
config, xrefs: 00000259C2A57F9D
filename, xrefs: 00000259C2A57E06, 00000259C2A5818E, 00000259C2A58A22
users, xrefs: 00000259C2A58522
status, xrefs: 00000259C2A59027

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID: config$content$filename$status$users
API String ID: 0-2677590375
Opcode ID: 4165bd58960aafecdd003df91eb6536fe65e46e20be2c6c9dcca7782a2fe16dd
Instruction ID: e97d3f7f6b6fbc4657629932dfcee50e9dc05f57ce9c3268b86f637671dfee7f
Opcode Fuzzy Hash: 4165bd58960aafecdd003df91eb6536fe65e46e20be2c6c9dcca7782a2fe16dd
Instruction Fuzzy Hash: B7C23C62611FC189DF21DF24DC983DE6361F789B9AF405222DA9D4ABDAEF34C684C344

Function 00000259C2ADBB14 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000259C2ADBB75
IsDebuggerPresent.KERNEL32 ref: 00000259C2ADBB8D
OutputDebugStringW.KERNEL32 ref: 00000259C2ADBB9E

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00000259C2ADBB97

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: e8ffe009acab376759065dd43441e42d099b308a5e20a56206d0bc25ee25ae09
Instruction ID: 502287773beef330fcd8955ceed56f32eced0a04908ab2496614149371e35168
Opcode Fuzzy Hash: e8ffe009acab376759065dd43441e42d099b308a5e20a56206d0bc25ee25ae09
Instruction Fuzzy Hash: 5B114C32210F40D7FB049B26DE883A932A4FB48B47F504126C79982A95EF78D0E4C718

Function 00000259C2A502E0 Relevance: 7.0, Strings: 5, Instructions: 747COMMON

Download Yara Rule

Strings

content, xrefs: 00000259C2A50946
filename, xrefs: 00000259C2A5088E
status, xrefs: 00000259C2A50F58, 00000259C2A50F6E
exists, xrefs: 00000259C2A50F26
directory_iterator::directory_iterator, xrefs: 00000259C2A50F42, 00000259C2A50F92

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: __std_fs_convert_wide_to_narrow$__std_fs_code_page
String ID: content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 3645842244-3429737954
Opcode ID: a8971aaf6fee6977f157dfbe61e61e20bd4e64a57e8da1fa10372b5881c59e42
Instruction ID: a2e450efa3d0214b8fea76b61a36229c592b56032a11573fac23e1b99abba313
Opcode Fuzzy Hash: a8971aaf6fee6977f157dfbe61e61e20bd4e64a57e8da1fa10372b5881c59e42
Instruction Fuzzy Hash: 54725B32611FC0C9EF619F25D8843EA6360F78DB5AF549222DA8D47BA9EF74C684C704

Function 00000259C2AB7348 Relevance: 6.1, APIs: 4, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00000259C2AB739F
GetSystemInfo.KERNEL32 ref: 00000259C2AB73B8
VirtualAlloc.KERNEL32 ref: 00000259C2AB7426
VirtualProtect.KERNEL32 ref: 00000259C2AB7441

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: 324fd5cd604fef47d1152131e1f7c01459585a6c12e9a2e3e67a5e0172bc20d3
Instruction ID: b3d8260595ba88d2a80c70cf617242940ab5bc68be2a69b7e6a7ac44bbb2d452
Opcode Fuzzy Hash: 324fd5cd604fef47d1152131e1f7c01459585a6c12e9a2e3e67a5e0172bc20d3
Instruction Fuzzy Hash: 54313732310A80DEDB20CF35DC587D963A5F74CB8AF844026EA8D47B98DB38D686C704

Function 00000259C2ACDC18 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000259C2ACDC44
GetCurrentThreadId.KERNEL32 ref: 00000259C2ACDC52
GetCurrentProcessId.KERNEL32 ref: 00000259C2ACDC5E
QueryPerformanceCounter.KERNEL32 ref: 00000259C2ACDC6E

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: f06392d29159ea5021ae0933302a5494cfde722d0989828b5d6bd782ea4d1856
Instruction ID: ac39c56c252752ae948c59d9e14d45bc74550bb9230537aba3f4549158efcd0f
Opcode Fuzzy Hash: f06392d29159ea5021ae0933302a5494cfde722d0989828b5d6bd782ea4d1856
Instruction Fuzzy Hash: F011FA26710F01CAEF00DF60EC593A833A4F75DB5AF441E26EAAD46BA4DF78C1958354

Function 00000259C2A88950 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 376COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000259C2A88BAE

Strings

parse_error, xrefs: 00000259C2A889DE
value, xrefs: 00000259C2A898D3

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: __std_exception_copy
String ID: parse_error$value
API String ID: 592178966-1739288027
Opcode ID: ecccdd723cc9930d84514b897044e7338d1ab82e9746f924356a8bea6347d9a9
Instruction ID: 46145bb994dbcacdab74707af347fee887b9a920546e62ac56fb46883898f811
Opcode Fuzzy Hash: ecccdd723cc9930d84514b897044e7338d1ab82e9746f924356a8bea6347d9a9
Instruction Fuzzy Hash: 46F19F62A10E84D9EF00DF64DC593ED2322F79DB9AF905213AA8C56ADAEF74C185C344

Function 00000259C2A5A1F0 Relevance: 5.6, Strings: 4, Instructions: 609COMMON

Download Yara Rule

Strings

content, xrefs: 00000259C2A5A94F
filename, xrefs: 00000259C2A5A7A9
exists, xrefs: 00000259C2A5AC67
directory_iterator::directory_iterator, xrefs: 00000259C2A5AC83

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID: content$directory_iterator::directory_iterator$exists$filename
API String ID: 0-1400943384
Opcode ID: d92f4d0aab53d789c1591f50fd56a96dda56f9b3aff1918d571ab19eca3d0f56
Instruction ID: 4737e19e3dc732a2bcad954c10ec3bd878139ba3eecfca4cacb165ed7499b567
Opcode Fuzzy Hash: d92f4d0aab53d789c1591f50fd56a96dda56f9b3aff1918d571ab19eca3d0f56
Instruction Fuzzy Hash: 64526C72610FC4CAEB608F69E8443DE73A1F789B9AF405212EA9D47B99EF74C580C704

Function 00000259C2AAB68A Relevance: 5.6, Strings: 4, Instructions: 563COMMON

Download Yara Rule

Strings

object separator, xrefs: 00000259C2AABBD4, 00000259C2AABF1E
object, xrefs: 00000259C2AABE66
object key, xrefs: 00000259C2AABC80, 00000259C2AABFD6
array, xrefs: 00000259C2AABDAE

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: array$object$object key$object separator
API String ID: 2453523683-2277530871
Opcode ID: 9c7edec81dc448aff70d24d02dc47a3d94d478b34c0c2cec5b208f141bd3f369
Instruction ID: e7085b2a59f999d679b882c0e297f8cad87c1acdbea060fd8894be6918283a6c
Opcode Fuzzy Hash: 9c7edec81dc448aff70d24d02dc47a3d94d478b34c0c2cec5b208f141bd3f369
Instruction Fuzzy Hash: FC329322614E84D6EF00DF34C8593ED6321FB9EB86F802513EA89577DAEB74C684C748

Function 00000259C2AC19B8 Relevance: 5.5, APIs: 3, Instructions: 1005COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000259C2AC1DEE
_get_daylight.LIBCMT ref: 00000259C2AC1E89
_get_daylight.LIBCMT ref: 00000259C2AC1EA2

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: 3362572290862af57679fdc4baef7ebaaf60df3fe4e64099d27ff34f0326e21c
Instruction ID: 1fe72856e926bb297076f160ce2521f7a7e638b03ae074e2c70e8e2eabdfb997
Opcode Fuzzy Hash: 3362572290862af57679fdc4baef7ebaaf60df3fe4e64099d27ff34f0326e21c
Instruction Fuzzy Hash: C2929D32204B80C6EF658F289D5826937A9F749F8BF548117DBC507BD9DB3AC994C708

Function 00000259C2AD9480 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32 ref: 00000259C2AD94A6
FormatMessageA.KERNEL32 ref: 00000259C2AD94D9

Strings

!x-sys-default-locale, xrefs: 00000259C2AD9499

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: f19c835850623712fbca22d426e0c2013945c380ca8add72a55f3f09a2f97b50
Instruction ID: 98ea601d609e58cf4e4a1e1ccd11365a4e2c2df7741a45c3492e7cca4c9c5949
Opcode Fuzzy Hash: f19c835850623712fbca22d426e0c2013945c380ca8add72a55f3f09a2f97b50
Instruction Fuzzy Hash: 99018072704F85C2FB218B12B85879A67A5F389B87F444026DAC947BD9CB3CC985C708

Function 00000259C2AB2CD0 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00000259C2AB2D36
memcpy_s.LIBCPMT ref: 00000259C2AB2D61

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: e899307af8ea146bffc4d3d3e4071cf966dfaa801a3502f7d3bb1face14528cf
Instruction ID: 97193832823ecf657f66ee19884ffead6d267aafd01e20192c32bac4bea41a86
Opcode Fuzzy Hash: e899307af8ea146bffc4d3d3e4071cf966dfaa801a3502f7d3bb1face14528cf
Instruction Fuzzy Hash: F6C12772715A84C7EF24CF1AE84876AB7A5F388B86F418127DB8A437C4D739D845CB44

Function 00000259C2A906A6 Relevance: 4.4, Strings: 3, Instructions: 653COMMON

Download Yara Rule

Strings

2OWqJZldB3s=, xrefs: 00000259C2A907D1
rXwr2/Mp0kvTmn+hdCWeFmDWltFpcKXkn/UOvH+3cNE=, xrefs: 00000259C2A90749
port, xrefs: 00000259C2A9135F

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID: 2OWqJZldB3s=$port$rXwr2/Mp0kvTmn+hdCWeFmDWltFpcKXkn/UOvH+3cNE=
API String ID: 0-1454942929
Opcode ID: fc2163450dead3b7ff2f94c13cbc764888e18f3445c3685658d373d3d4dd4d6e
Instruction ID: 63708673b33167915642d51eed6175f83e5c499f7ac3fabd91c3ab1031eefaa7
Opcode Fuzzy Hash: fc2163450dead3b7ff2f94c13cbc764888e18f3445c3685658d373d3d4dd4d6e
Instruction Fuzzy Hash: 78726072629FC4C5EA60CB25E88439AB3A4F7D9B85F505216EBCD13B99DF38C185CB04

Function 00000259C2A56130 Relevance: 3.9, Strings: 2, Instructions: 1357COMMON

Download Yara Rule

Strings

Software, xrefs: 00000259C2A565AD, 00000259C2A5677B
exists, xrefs: 00000259C2A57701

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID: Software$exists
API String ID: 0-2364128853
Opcode ID: 8e57a09e20af07ecd921f6856e5cca299930e26b060332fb4e4f5cca0387100e
Instruction ID: 8ba7b0f10d48f1a2d469742d8d48286bd53f91d36b38ff3b3b45a7dd9d686ba0
Opcode Fuzzy Hash: 8e57a09e20af07ecd921f6856e5cca299930e26b060332fb4e4f5cca0387100e
Instruction Fuzzy Hash: F0D24A72A10FC4CAEB20CF29D8443DE63A4F789B9AF105216EA9D56BE9DF74C581C304

Function 00000259C2A686D0 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 311COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A68843

Strings

vector<bool> too long, xrefs: 00000259C2A686D4

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: vector<bool> too long
API String ID: 118556049-842332957
Opcode ID: 5e13b41a6391bdc78a93b1e6faf195b367b93dbf385dd2a40b21e873329d8f30
Instruction ID: a51491f06962703912691e13604e1796aa877a9bdcc00800c18cbd6443fc716f
Opcode Fuzzy Hash: 5e13b41a6391bdc78a93b1e6faf195b367b93dbf385dd2a40b21e873329d8f30
Instruction Fuzzy Hash: 5DC19922A14F80CAEB14CF65D8483AD6374F39DB9AF105226EE9C13B99EB78C5C5C704

Function 00000259C2A6E130 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 310COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A6E314

Strings

conditional not closed, xrefs: 00000259C2A6E2CE, 00000259C2A6E2F1

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: conditional not closed
API String ID: 118556049-2481790218
Opcode ID: 4c118f331d096cfae55408887399e4e11ae0b8c8b43513295bcda257272f610d
Instruction ID: 1a7a2e91f4045d4696c307787f0fa0694dc19294f22bd8a7a16cab49abca07d0
Opcode Fuzzy Hash: 4c118f331d096cfae55408887399e4e11ae0b8c8b43513295bcda257272f610d
Instruction Fuzzy Hash: 24D15772601F84C4EF60CF20ED487E977A5F75DB8AF545123AA890AB99EB78C694C304

Function 00000259C2ABC1A8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00000259C2ABC21C

Strings

GetLocaleInfoEx, xrefs: 00000259C2ABC1C4, 00000259C2ABC1D5

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 0fc81d44bec917c2802c26d4724ac6a513cb7d03bb6cf24fcfbb40603345bdc0
Instruction ID: 32d76488ad77d8364f835fc6bb5e3fdf5fe7b411fef9407c14ab2a80baf4d28b
Opcode Fuzzy Hash: 0fc81d44bec917c2802c26d4724ac6a513cb7d03bb6cf24fcfbb40603345bdc0
Instruction Fuzzy Hash: DC018F20700F80D9EF009B56B80868AA761A78DFD2F584127DE8903BD9CE3CC5828348

Function 00000259C2A96760 Relevance: 3.4, APIs: 2, Instructions: 391COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00000259C2A967C3
ShellExecuteW.SHELL32 ref: 00000259C2A96E0A

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: ExecuteFileModuleNameShell
String ID:
API String ID: 1703432166-0
Opcode ID: 8901576b6b951cda90eafd5a26a20cf5036267e5f0251a3f68b90dfb841a72b1
Instruction ID: 9ba58b83dab4b2d0530d6244884af10e4be20596a8b759f10d6c89a3d9caa7ab
Opcode Fuzzy Hash: 8901576b6b951cda90eafd5a26a20cf5036267e5f0251a3f68b90dfb841a72b1
Instruction Fuzzy Hash: B9120B72625F848ADB40CF29E88469EB3A5F788B98F505216FEDD57B58EB38C190C740

Function 00000259C2ABF7F4 Relevance: 3.2, APIs: 2, Instructions: 227COMMON

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00000259C2ABFA43
RaiseException.KERNEL32 ref: 00000259C2ABFA54

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 57a16f90b848e9bfce21c4af82cc5806e79d9fd20c8b8e6b755f3e4c735a4a33
Instruction ID: e7f046bf48f3a04d326f1e3894e030a7f71244d5944fa4448bc09f21a4963ee1
Opcode Fuzzy Hash: 57a16f90b848e9bfce21c4af82cc5806e79d9fd20c8b8e6b755f3e4c735a4a33
Instruction Fuzzy Hash: FBB10C77600B84CBEB59CF29C84A35C7BA0F349F5AF198916EA99877E4CB39C491C704

Function 00000259C2AA0500 Relevance: 3.2, APIs: 2, Instructions: 187COMMON

Download Yara Rule

APIs

EnumDisplayDevicesW.USER32 ref: 00000259C2AA0617
EnumDisplayDevicesW.USER32 ref: 00000259C2AA06BB

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: DevicesDisplayEnum
String ID:
API String ID: 2211661463-0
Opcode ID: 5b7a4cb8399f14eb31c53a614e82d760a5fe78c60bb34002ad903755df935223
Instruction ID: 103cdb42a268533598903d6de07b9542661b08aba22dbc50e33a754fbd291b5e
Opcode Fuzzy Hash: 5b7a4cb8399f14eb31c53a614e82d760a5fe78c60bb34002ad903755df935223
Instruction Fuzzy Hash: 6781CD32614F80C6EB20CF25E84839E77A5F788B99F505216EED817B99DF78C281CB04

Function 00000259C2A55EE0 Relevance: 3.1, APIs: 2, Instructions: 145encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 00000259C2A55F6D
LocalFree.KERNEL32 ref: 00000259C2A55FFF

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: de58b49e5d54267f330502164efeee638c94e0596424ba388b0548b5f4130cdb
Instruction ID: 9aaf8944bd4433b42d7a1a9360e27cfca8a7ebbb2694853e73eed6a44ab9e5e6
Opcode Fuzzy Hash: de58b49e5d54267f330502164efeee638c94e0596424ba388b0548b5f4130cdb
Instruction Fuzzy Hash: 52617D32B14B80DAFB10DFB4E84439D73A1E759B8DF048226EA8916FD9DB78C594C344

Function 00000259C2A921C0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptProtectData.CRYPT32 ref: 00000259C2A92218
LocalFree.KERNEL32 ref: 00000259C2A922AA

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalProtect
String ID:
API String ID: 2714945720-0
Opcode ID: 6da8b2380d1e6afdbe15ad09ed0a82a6e20629f9e1f2d0947d1afcdde56a6e99
Instruction ID: 414ed17d1295291e8994b81ae12150501df9910e73cddd7941c34b78c98c963f
Opcode Fuzzy Hash: 6da8b2380d1e6afdbe15ad09ed0a82a6e20629f9e1f2d0947d1afcdde56a6e99
Instruction Fuzzy Hash: B8415B33614B80CAFB209F74D8443DD77A4F759B8DF04422AEB8806E8ADB79C5A4C348

Function 00000259C2A928C0 Relevance: 3.0, Strings: 2, Instructions: 529COMMON

Download Yara Rule

Strings

%, xrefs: 00000259C2A92F24
+, xrefs: 00000259C2A92F3F

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID: %$+
API String ID: 0-2626897407
Opcode ID: b54e24ea2d3894df035ee9040a2acd847d033f699fed1c2709722eddc90e2de6
Instruction ID: 41775c7c4bc5e6da5dc03d4cf78f11ffe723a8274eccb504ff758ac503710c9e
Opcode Fuzzy Hash: b54e24ea2d3894df035ee9040a2acd847d033f699fed1c2709722eddc90e2de6
Instruction Fuzzy Hash: E3223523718E80CAFF21DB66D8543ED67A1A75DBAAF044213DE8917BC9DB38C485C348

Function 00000259C2AC29F4 Relevance: 2.9, Strings: 2, Instructions: 358COMMONLIBRARYCODE

Download Yara Rule

Strings

am/pm, xrefs: 00000259C2AC2CA3
a/p, xrefs: 00000259C2AC2D0E

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID: a/p$am/pm
API String ID: 0-3206640213
Opcode ID: dad867be523f7f4d56baa7635c1cdc645b8584f083e4b69fc353e0e6fb1d2414
Instruction ID: ba41c6eea1ee4edec715b61067a2fa770603c9d509d6d2976ccf99971a8c72ca
Opcode Fuzzy Hash: dad867be523f7f4d56baa7635c1cdc645b8584f083e4b69fc353e0e6fb1d2414
Instruction Fuzzy Hash: 43E1BC72604A40C5EF688F248D5C7B927A9FB68F87F554103EA8A57BD4DB3AC9C1C708

Function 00000259C2A4FEE0 Relevance: 2.7, Strings: 2, Instructions: 226COMMON

Download Yara Rule

Strings

emoji, xrefs: 00000259C2A4FF50
dumps, xrefs: 00000259C2A4FF28

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID: dumps$emoji
API String ID: 0-2873254224
Opcode ID: f7c1d0fb9677e435d25e24cad687abe55fd77fc57aacf0daad7dd5b9b370ae1b
Instruction ID: fd8dd61507504d70d770eed575852e360c24f1a15a4b66de347fe8a52a0e9e09
Opcode Fuzzy Hash: f7c1d0fb9677e435d25e24cad687abe55fd77fc57aacf0daad7dd5b9b370ae1b
Instruction Fuzzy Hash: F9B11C22928FC486D760CB25E88165AB7A4F79DB84F546316FFCD13B59DB38D290CB04

Function 00000259C2A755B0 Relevance: 2.0, APIs: 1, Instructions: 455COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A7562B

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6c29bfcbf4af02599662019b9b632f87c035addbb376791c7633461b336fa7bf
Instruction ID: 9cf13dabbe679a0674326304d09832c567bcbe15398cbb924c603cfc876cd9a1
Opcode Fuzzy Hash: 6c29bfcbf4af02599662019b9b632f87c035addbb376791c7633461b336fa7bf
Instruction Fuzzy Hash: 56027962711F84C6EE10CBA5E85839E63B1E348F9AF548622DE9C177D5EB34C495C388

Function 00000259C2A8CF70 Relevance: 1.7, APIs: 1, Instructions: 232COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A8D28B

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 474e3a437ea233f98959df63cb75406d1df34f3a045781f6baf1a50faa7e5945
Instruction ID: 9654ff3e88f150438cbdcb8bf917705535faa74da667875720a2573f0425b11c
Opcode Fuzzy Hash: 474e3a437ea233f98959df63cb75406d1df34f3a045781f6baf1a50faa7e5945
Instruction Fuzzy Hash: 2FA17722611F98CAEF00CBBAD8843AC67B0F359B4AF948416DF8D57B99DB38C195C354

Function 00000259C2A8C930 Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A8CC44

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: c119fda8a9de2da8aa704513d54b9ca19ba9b462ee068ab1662025d9693643fb
Instruction ID: 5951dfa02731ffb85e38def13db5bcecaca408861e2f961576f8d0b12c5f2748
Opcode Fuzzy Hash: c119fda8a9de2da8aa704513d54b9ca19ba9b462ee068ab1662025d9693643fb
Instruction Fuzzy Hash: 67A18962601F98DAEF04CBAAD8843AC77B1F319B4AF948416DF8D53B99DB38C191C354

Function 00000259C2A8CC50 Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A8CF64

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8e26d5924d2bdda6809c7ba14e83fc4a85feecd9e9e7ccd546660065fe342c69
Instruction ID: a9512c67e02628c05ca13743c929787afb636b0be9101498471687ee16e25119
Opcode Fuzzy Hash: 8e26d5924d2bdda6809c7ba14e83fc4a85feecd9e9e7ccd546660065fe342c69
Instruction Fuzzy Hash: 58A19963611B98DAEF04CBAAD8843AC37B1F359B4AF948416DF8D53B99DB38C091C740

Function 00000259C2A8C600 Relevance: 1.7, APIs: 1, Instructions: 220COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A8C929

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 2c2d4eec14a64dcafd5ce3643fe487428c14e8435e54e1261b7e81d14bf6b778
Instruction ID: a2e49c6721a4f3fc75274ab6c410ed00a159cf09fbc36322f0d204ceb63539dc
Opcode Fuzzy Hash: 2c2d4eec14a64dcafd5ce3643fe487428c14e8435e54e1261b7e81d14bf6b778
Instruction Fuzzy Hash: 6FA19922B15F98DAEB04CBAAD8843AC37B1F359B4AF945126DF8D57B95DB38C091C300

Function 00000259C2A8C300 Relevance: 1.7, APIs: 1, Instructions: 214COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A8C5F8

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 468506bd705783cb04321f8421e7cee2424660cea4b76ff9ef63ca7c48a70ec2
Instruction ID: 298e44344a03fe9d4466374378c3dea165a4546cf591e5e43506981c1cea317c
Opcode Fuzzy Hash: 468506bd705783cb04321f8421e7cee2424660cea4b76ff9ef63ca7c48a70ec2
Instruction Fuzzy Hash: 09A1AA62711B98DAEF04CBA9D8883AC77B1F319B4AF948416CF8D57B95DB38C191C344

Function 00000259C2A8D2A0 Relevance: 1.7, APIs: 1, Instructions: 210COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A8D598

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: adea9a2f053ff77c94f107ab8ec5be1b99452ae781f7e1d9d0e1f39d926e6c83
Instruction ID: a59bf3ef5cd1e38328dad951aa9314b0edfa237304c635f9ef2992152d5b24a6
Opcode Fuzzy Hash: adea9a2f053ff77c94f107ab8ec5be1b99452ae781f7e1d9d0e1f39d926e6c83
Instruction Fuzzy Hash: 5BA16666601F98CAEF04CBBAE8843AC67B0F359B4AF948416CF8D57B95DB38D091C354

Function 00000259C2AC7270 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000259C2AB81FC: GetLastError.KERNEL32 ref: 00000259C2AB820B
Part of subcall function 00000259C2AB81FC: FlsGetValue.KERNEL32 ref: 00000259C2AB8220
Part of subcall function 00000259C2AB81FC: SetLastError.KERNEL32 ref: 00000259C2AB82AB

EnumSystemLocalesW.KERNEL32 ref: 00000259C2AC730E

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 58800bb6c4d0d9c609f2f6f306793987a7a581936cd52f064e9451565f60872b
Instruction ID: 9d79cfa457b612c858477d391f44b42df81d39e5ca57718ec5accdb29b56f9cf
Opcode Fuzzy Hash: 58800bb6c4d0d9c609f2f6f306793987a7a581936cd52f064e9451565f60872b
Instruction Fuzzy Hash: 9911E463A14A44CAEF148F2AD8447987BA8F354FE2F448116DA95473C4CB35C5D1C744

Function 00000259C2A79A10 Relevance: 1.6, Strings: 1, Instructions: 304COMMON

Download Yara Rule

Strings

., xrefs: 00000259C2A79D10

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 3daecdbd55c9c22db29b6e9ecc3dd405d8fe90d94cda49bc0af5f93eb4a6cfc3
Instruction ID: 31833fb43dd1f77267fdce13ea488133c8dca7573046173d2412f3ac22518219
Opcode Fuzzy Hash: 3daecdbd55c9c22db29b6e9ecc3dd405d8fe90d94cda49bc0af5f93eb4a6cfc3
Instruction Fuzzy Hash: 1DC15E22200F86C6EF60CE25D8683A963A5F38DF96F544213EB99437D9DB78D881C34C

Function 00000259C2AC7340 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000259C2AB81FC: GetLastError.KERNEL32 ref: 00000259C2AB820B
Part of subcall function 00000259C2AB81FC: FlsGetValue.KERNEL32 ref: 00000259C2AB8220
Part of subcall function 00000259C2AB81FC: SetLastError.KERNEL32 ref: 00000259C2AB82AB

EnumSystemLocalesW.KERNEL32 ref: 00000259C2AC73BE

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: fd6ab9fb082eedb8b2c8f5dae22463227a7604b7e6560a2cecb061507bc0ecca
Instruction ID: 52bd42e97fc3546e55483ceb62fd01885de926f1ca4a4c14dc596dcd41f8f175
Opcode Fuzzy Hash: fd6ab9fb082eedb8b2c8f5dae22463227a7604b7e6560a2cecb061507bc0ecca
Instruction Fuzzy Hash: C201B172704A80C6EF144F56EC48B9977E9E748FA7F458263DAA1477C4CB75C8C18708

Function 00000259C2A8F1C7 Relevance: 1.5, APIs: 1, Instructions: 34comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00000259C2A8F1FD
CoSetProxyBlanket.OLE32 ref: 00000259C2A8F252

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: BlanketCreateInstanceProxy
String ID:
API String ID: 1899829610-0
Opcode ID: 090b67bd202e28ba5db5dc4b677ffd3c3d0e2274786d4c4dd6ee0b60b436dba7
Instruction ID: 689e623c25175e8219ffc61f5dd92755d83cbd18476927334951109c267a1828
Opcode Fuzzy Hash: 090b67bd202e28ba5db5dc4b677ffd3c3d0e2274786d4c4dd6ee0b60b436dba7
Instruction Fuzzy Hash: AE016222701E50C7FF22DB65E8053ADA765A74CB5AF8005178F8943B95EF38C1C6C388

Function 00000259C2ABBC68 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32 ref: 00000259C2ABBCB7

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: f8325550294e071d185dd7c07cc84b153cedbfbab89d167ada8b5b9da10e3d51
Instruction ID: 69adb25c537d72faa704f8fa62fb419b35e63d835b59fc90c8284f8c6c044fec
Opcode Fuzzy Hash: f8325550294e071d185dd7c07cc84b153cedbfbab89d167ada8b5b9da10e3d51
Instruction Fuzzy Hash: 90F01976300E44C2EB04DB65EC946993365F79DB82F549026EA89877A5DE38C5D1C308

Function 00000259C2A483D0 Relevance: .8, Instructions: 795COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9b8fdb5bbf29e83ba46770476c642bc1a2f153b56793c0f77b40a01b05bd800
Instruction ID: 5e7029dc79396118cfec24c83c11064ecfdbbb73173da15ded912c5fc3be0190
Opcode Fuzzy Hash: b9b8fdb5bbf29e83ba46770476c642bc1a2f153b56793c0f77b40a01b05bd800
Instruction Fuzzy Hash: 2CA29236615FC88AD7408FAAEC8119D73BAF749BA8B101629EFCC57F19EBB4C1548740

Function 00000259C2A45520 Relevance: .8, Instructions: 792COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d994d20f84aa1386fd0f79cb4df871a2668494586329fb3d57151dc71e3222dc
Instruction ID: b1f0041820b2c78a17a68a2fc0532893d8749f029e49aad223f3f72ef70af6fc
Opcode Fuzzy Hash: d994d20f84aa1386fd0f79cb4df871a2668494586329fb3d57151dc71e3222dc
Instruction Fuzzy Hash: 5592D832915FC88AD7718F25E88129AB3A8F79D788F505316EACC16B59EF78C394C704

Function 00000259C2A766A0 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff8ff783da37649173626c7f7158936b22345755ff077d27462f74136c1878ba
Instruction ID: 224ec432028845ab9b7b077783ed82d8b9a9cab01dae94a55f26f53e49d1fd49
Opcode Fuzzy Hash: ff8ff783da37649173626c7f7158936b22345755ff077d27462f74136c1878ba
Instruction Fuzzy Hash: 36C14873721AA487EB56CF56D9587A9B762F3D8FD1F45C121DE8A03B94C638C882C704

Function 00000259C2A26610 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2e47488768c35e6cc6abc03d29711516037972d3efd2b60ee3509700c14b337
Instruction ID: 47e0d4fd224afc296478a836ac7b4240b6670018439c043213310ecfc90cc391
Opcode Fuzzy Hash: f2e47488768c35e6cc6abc03d29711516037972d3efd2b60ee3509700c14b337
Instruction Fuzzy Hash: 9412D732515FC88AD7718F29E84139AB3A4F78DB48F545316EACC57B59EB38C294CB04

Function 00000259C2A8FDB0 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34fb1097c6f2363caac24c1e5b45ae24c1a6ca50cb597d280e611698873f3a91
Instruction ID: a8eb1e65f18d1b1273c1b740889c371b7478be6517504c8fa8cae1c436407acd
Opcode Fuzzy Hash: 34fb1097c6f2363caac24c1e5b45ae24c1a6ca50cb597d280e611698873f3a91
Instruction Fuzzy Hash: 4EC1C2B3A146948BE355CF2DD40195D7BA0F398B84F40A629EB56C3B01E778E9A5CF80

Function 00000259C2A46510 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58385eaf4bb05c4dd650fe9c3293d5d132ea8d53e59e9018c70652c9bfdaf018
Instruction ID: b2a1789807e2692515b88106a70a4e36328e1b0da54e1552fe67542d31b1ee16
Opcode Fuzzy Hash: 58385eaf4bb05c4dd650fe9c3293d5d132ea8d53e59e9018c70652c9bfdaf018
Instruction Fuzzy Hash: 7002D632A15FC489D7628F79EC413D977A4F7AD788F105216EACC2AB59EBB4C294C700

Function 00000259C2AB8C34 Relevance: .3, Instructions: 309COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: f39b52ed8424437b231758bdb93ffc4f840ea96165d05f634ae1d9fa5926c97e
Instruction ID: b1861ca3df135581247d4f3b99b44aa0b59eb8b4f0759dca9ffa69f12ba3ec37
Opcode Fuzzy Hash: f39b52ed8424437b231758bdb93ffc4f840ea96165d05f634ae1d9fa5926c97e
Instruction Fuzzy Hash: F1C1C376200B80C9EF64DB669C187AA67A5F798F8BF404017DEC987BD8DB39C585C708

Function 00000259C2AB088C Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58993cc49f4dd608ba7a820bbbd73e261f21bf312b089c0bcad54f873d9ee38f
Instruction ID: 04e06248207cb9f9156e0b2b4484b5893e48a9d7190d23c4a0b4b886879f7d4a
Opcode Fuzzy Hash: 58993cc49f4dd608ba7a820bbbd73e261f21bf312b089c0bcad54f873d9ee38f
Instruction Fuzzy Hash: 5D914933310A44CAFE244E2798583BA2690B75DF9BF15062ADED6477C1EE38C585D70C

Function 00000259C2AB58D0 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29683b013f8ac11bc27aba6a7a5ac6f6d500d56baa688bda10aee56a2ac3d60c
Instruction ID: 142a680ddc9b9ee36371ecb332f156b6248650bba52b251bad6a782535b9cc29
Opcode Fuzzy Hash: 29683b013f8ac11bc27aba6a7a5ac6f6d500d56baa688bda10aee56a2ac3d60c
Instruction Fuzzy Hash: 81C1CA72600A40C6EF28CF29C89836D37A1E70AF4BF24421ACE89177D5DB35C88AC748

Function 00000259C2AB5044 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 961d3e7eb4dbe1c42d41fae25b585760f3c2351026af9e0dc6bb8535c2ebc898
Instruction ID: 4a2c227b22cbb4fda3d223954617d84cc2c99245ec6506a2f3db86369be46adf
Opcode Fuzzy Hash: 961d3e7eb4dbe1c42d41fae25b585760f3c2351026af9e0dc6bb8535c2ebc898
Instruction Fuzzy Hash: 24B17B72505B84CAEB648F39D8A836C3BA4F34DF4AF284116CB8A473D5DB76C485DB48

Function 00000259C2AB7060 Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 091f4ed8b1e5dd1d34995432db1c011eef8551be6e7d0024f18eedab46e94d23
Instruction ID: f792a864a84f8dc0e9fe72bdb11f6fed7ce7119c96053b851058351e1f357220
Opcode Fuzzy Hash: 091f4ed8b1e5dd1d34995432db1c011eef8551be6e7d0024f18eedab46e94d23
Instruction Fuzzy Hash: 63817C32600E50C6EF64CE25D88936963A4F788FAAF549617EE9E977D5CF35C181C308

Function 00000259C2A26D20 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e8cb9989ebccae2b4934454dacc3e473b3a3bc5e9d1377eb956669a5a9cd281
Instruction ID: 0eb7928f15fb4ac7a1504553ee7606cadbec63f6b4643022e37d3a6f3af44fa8
Opcode Fuzzy Hash: 4e8cb9989ebccae2b4934454dacc3e473b3a3bc5e9d1377eb956669a5a9cd281
Instruction Fuzzy Hash: BAB1F532915FC88ADB108FA9EC40299B7B5F799BA8F145316EACC13F59EB74C194C700

Function 00000259C2ADE2CC Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0101b5bfc7e861b0726451e18251d4484926b191a0e7c85200f779e0e00e1385
Instruction ID: 2eedaba883c9c4cc150e7e86e96e18b1cd0b8ee79d4352ae0aaa03f7d552896b
Opcode Fuzzy Hash: 0101b5bfc7e861b0726451e18251d4484926b191a0e7c85200f779e0e00e1385
Instruction Fuzzy Hash: AF61E532704F90C6FF688A288D5C37D6691A74CF77F18462BEA96877C5E676C8C08708

Function 00000259C2A901F0 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8564914535ee6488183395aa034df85c3b96b43cc627a35cfc23d0d483c1855f
Instruction ID: caeae3ee2ae4154d0322a73734fafb58dfe9ece4873dbabd965b51fcb26aaed9
Opcode Fuzzy Hash: 8564914535ee6488183395aa034df85c3b96b43cc627a35cfc23d0d483c1855f
Instruction Fuzzy Hash: 5561EE2321E2C48FD30EDF7C589106D7F61D3A7908388469DEAC5EBB4BC514C95ACBA6

Function 00000259C2A98230 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08e682c8f50e6a31ebca66eccf7bc014078cfb37ed238d168109819e35b8cd79
Instruction ID: e5bf60ed8f0e3f4a3404d39f50f4e92fecc54de4515b755c0b2e1201509653df
Opcode Fuzzy Hash: 08e682c8f50e6a31ebca66eccf7bc014078cfb37ed238d168109819e35b8cd79
Instruction Fuzzy Hash: 5F51E4A3B0568443DB248B49FC42796F7A5FB987C5F00A126EE8D57B68EB3CD581C700

Function 00000259C2AB4A00 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction ID: e3aa87d8eb24aa10caa25f81c1a648a536ea21e1c1fcd313d3f99f1625115851
Opcode Fuzzy Hash: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction Fuzzy Hash: A9517E36214E50CAEF248B29C86832937A0E38DF5BF244116CF89577E9D7B6D892D748

Function 00000259C2AB47FC Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction ID: c349be6be2e03ace2b70ca23880eeef567af32c84e6c7d05750c2c2b1a2ec706
Opcode Fuzzy Hash: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction Fuzzy Hash: 81515D36614EA0CAEF248F29C86836837A0F34DF5AF249112DAC9577E5C7B6D893C744

Function 00000259C2AB45F8 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction ID: 2f922814ad9a1212f4ddd363883f7dfe7ded22a6f3edac5c8275d2f182a1e42b
Opcode Fuzzy Hash: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction Fuzzy Hash: 94517076210E50CAEB248B29C86832837B1E75DF5BF244112CE8957BE5D7B6DCD2C784

Function 00000259C2AC9EA0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 7d3dc9fee99d1a793cda94341ed908f3bcfa2b26da772502c09f4d0e1d5ddaa1
Instruction ID: cfca33dd1ae89294fc09d0de4546bbf0af9ffc9b0e1f894f069797ad6c7030a4
Opcode Fuzzy Hash: 7d3dc9fee99d1a793cda94341ed908f3bcfa2b26da772502c09f4d0e1d5ddaa1
Instruction Fuzzy Hash: 8F41B172310E5482EF04CF6AD958669A3A5B34CFD5F499427EE8D87B98DE3EC5828304

Function 00000259C2AF2008 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65fcb47a17adf94f373ff647ddafb07328eb1c747429ddd71517b78256354565
Instruction ID: 39f9551bc196dee42667cdcd7dd53921c794c05e67c32c74441ae4c1b3b3946b
Opcode Fuzzy Hash: 65fcb47a17adf94f373ff647ddafb07328eb1c747429ddd71517b78256354565
Instruction Fuzzy Hash: 37F0C247A1DFD09AF75256240C7E3841F91D396D23F4D404B8AC083FDB945A8D47D206

Function 00000259C2AF22D8 Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d53a79903260b7a4f0e6c71e7ffc168a0f2adb2b336afcda935cdf6e025e0c2f
Instruction ID: 49859890d9cd06beca0c6a1930313adfdf0ba321e8e1a67fbe0da3967b953ced
Opcode Fuzzy Hash: d53a79903260b7a4f0e6c71e7ffc168a0f2adb2b336afcda935cdf6e025e0c2f
Instruction Fuzzy Hash: 86F01DDBE5FED086FBA295240D3E20C6ED2D3B9E07F1D418B8B84037C3A419AC85521A

Function 00000259C2AF2398 Relevance: .0, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91d01cb9ed2bd3d2d45766b86e1c76849cdc335525e86e8d4b249a2a0640e502
Instruction ID: 45b50ae603be924a2d4d8b4b138ed4133a62d59910ba1fb8f4bced074070dffd
Opcode Fuzzy Hash: 91d01cb9ed2bd3d2d45766b86e1c76849cdc335525e86e8d4b249a2a0640e502
Instruction Fuzzy Hash: 9AE04FC7A4DEC099F71646600C3F6082ED1977AE13B4D81DF878403BD3B45DAC018312

Function 00000259C2AF26E0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a42a01495bc10c92585e70db87d9dd7e84e2cd6d90333ee8a624f4433841b9f2
Instruction ID: 72dc1379d307df9fe2eef78a8eee362180b80f93c600c0d0ee3ed3a63e60d1bd
Opcode Fuzzy Hash: a42a01495bc10c92585e70db87d9dd7e84e2cd6d90333ee8a624f4433841b9f2
Instruction Fuzzy Hash: 4AA01253308890C6F5430B10480D1442750D752902B888040854002943C029084E8A08

Function 00000259C2AF2090 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01a4154ba30de378ee8f3a0bf3b2dfb59d47392f9fc814d815bb3a6ccc76d7c
Instruction ID: 141a9e7d1a93080848667bb95270544006d0d24074dfe6e6c9ed73c2720241a9
Opcode Fuzzy Hash: f01a4154ba30de378ee8f3a0bf3b2dfb59d47392f9fc814d815bb3a6ccc76d7c
Instruction Fuzzy Hash:

Function 00000259C2A8ED30 Relevance: 28.7, APIs: 19, Instructions: 177processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00000259C2A8ED86
Process32FirstW.KERNEL32 ref: 00000259C2A8EDCA
Process32NextW.KERNEL32 ref: 00000259C2A8EDDF
OpenProcess.KERNEL32 ref: 00000259C2A8EE1B
OpenProcessToken.ADVAPI32 ref: 00000259C2A8EE42
GetTokenInformation.ADVAPI32 ref: 00000259C2A8EE6E
GetLastError.KERNEL32 ref: 00000259C2A8EE7C
GetTokenInformation.ADVAPI32 ref: 00000259C2A8EEBC
ConvertSidToStringSidA.ADVAPI32 ref: 00000259C2A8EED3
CloseHandle.KERNEL32 ref: 00000259C2A8EF46
CloseHandle.KERNEL32 ref: 00000259C2A8EF51
CloseHandle.KERNEL32 ref: 00000259C2A8EFB6
Process32NextW.KERNEL32 ref: 00000259C2A8EFC3
CloseHandle.KERNEL32 ref: 00000259C2A8EFE9
CloseHandle.KERNEL32 ref: 00000259C2A8EFF2
CloseHandle.KERNEL32 ref: 00000259C2A8F007

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: CloseHandle$Process32Token$InformationNextOpenProcess$ConvertCreateErrorFirstLastSnapshotStringToolhelp32
String ID:
API String ID: 3925315391-0
Opcode ID: 9cfa9a338c49679a1929b549c81fccef5f16dbb46e3a6c3e399b60bd0c466e0c
Instruction ID: c3e344b3ee0d0b037e06b0b326c87f0019f307a57c1b9cfaaed5a200e30008a0
Opcode Fuzzy Hash: 9cfa9a338c49679a1929b549c81fccef5f16dbb46e3a6c3e399b60bd0c466e0c
Instruction Fuzzy Hash: D4812A32215F80C2EB508B25ED4875AA3A5F78DF96F404126EE8957BD8DF78C985C708

Function 00000259C2AB81FC Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000259C2AB820B
FlsGetValue.KERNEL32 ref: 00000259C2AB8220
FlsSetValue.KERNEL32 ref: 00000259C2AB8241
FlsSetValue.KERNEL32 ref: 00000259C2AB826E
FlsSetValue.KERNEL32 ref: 00000259C2AB827F
FlsSetValue.KERNEL32 ref: 00000259C2AB8290
SetLastError.KERNEL32 ref: 00000259C2AB82AB
FlsGetValue.KERNEL32 ref: 00000259C2AB82E1
FlsSetValue.KERNEL32 ref: 00000259C2AB8300

Part of subcall function 00000259C2ABBBB8: HeapAlloc.KERNEL32 ref: 00000259C2ABBC0D

FlsSetValue.KERNEL32 ref: 00000259C2AB8328

Part of subcall function 00000259C2ABB550: HeapFree.KERNEL32 ref: 00000259C2ABB566
Part of subcall function 00000259C2ABB550: GetLastError.KERNEL32 ref: 00000259C2ABB570

FlsSetValue.KERNEL32 ref: 00000259C2AB8339
FlsSetValue.KERNEL32 ref: 00000259C2AB834A

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 36390ee60d7853b2b61aae55913fe849076646fcf7fe757753152af4f23a704c
Instruction ID: a61afbe489381439235555b0103ad0d230926628b5a8d7125cfb9078ae070cac
Opcode Fuzzy Hash: 36390ee60d7853b2b61aae55913fe849076646fcf7fe757753152af4f23a704c
Instruction Fuzzy Hash: 6241BE30604E01C9FD6CA33A6D5D72952829B4DFB3F084B2799F6067C6EE39D8C1C218

Function 00000259C2AAFDCC Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 407COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000259C2AAFDFB
_invalid_parameter_noinfo.LIBCMT ref: 00000259C2AAFECB

Strings

0, xrefs: 00000259C2AAFEF5
0, xrefs: 00000259C2AAFE9D
0, xrefs: 00000259C2AAFF07

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$0$0
API String ID: 3215553584-3137946472
Opcode ID: c13ea352d321776aceeea9581779599aef3778c14aa0c6b54d648fb53a65a266
Instruction ID: b00b15f3b624a76a27f359c3424597b3fca07095a53d97f71d627ac67a2ec9d0
Opcode Fuzzy Hash: c13ea352d321776aceeea9581779599aef3778c14aa0c6b54d648fb53a65a266
Instruction Fuzzy Hash: 98E1CF32505E85C9FF648F2998983AD6BA5A71AF87F548013C7C4873D6CA3AC9D9C70C

Function 00000259C2A94C60 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 159COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000259C2A94CDD
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000259C2A94D25
Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A94EA1
Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A94EB4
Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A94EBA

Strings

bad locale name, xrefs: 00000259C2A94EA7
true, xrefs: 00000259C2A94DDC
false, xrefs: 00000259C2A94DAD

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: 6d80fb12eb3313207d0587c3af823ac137beb0f19c49a4efd21ce154c7ae78c0
Instruction ID: 614817007dddc332d582ff4b968dba3f379886426cfb7127d170be90faad7af6
Opcode Fuzzy Hash: 6d80fb12eb3313207d0587c3af823ac137beb0f19c49a4efd21ce154c7ae78c0
Instruction Fuzzy Hash: EF714932705F40CAFF15DFA5D8583AC37BAEB88B0AF1441269A8867BD9DB34C591D348

Function 00000259C2ABBCE4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00000259C2ABBE60
GetProcAddress.KERNEL32 ref: 00000259C2ABBE6C

Strings

api-ms-, xrefs: 00000259C2ABBDAA
ext-ms-, xrefs: 00000259C2ABBDBD

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: c6120ce6c378417c8061f2daa80316ce8b84504fe2d3d9dfde353b277e126bba
Instruction ID: f56a62d2e7f11ac08027d10c839cbf9ce8ea8397e7be3c5bab8b563c900f02af
Opcode Fuzzy Hash: c6120ce6c378417c8061f2daa80316ce8b84504fe2d3d9dfde353b277e126bba
Instruction Fuzzy Hash: BA41CF35311E00C6EE16CB16AC48B566395BB4DFA3F494A279E8A477D4EF3CC485C708

Function 00000259C2A95090 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00000259C2A950FB
InternetOpenUrlA.WININET ref: 00000259C2A95130
InternetReadFile.WININET ref: 00000259C2A95151
InternetReadFile.WININET ref: 00000259C2A9518F
InternetCloseHandle.WININET ref: 00000259C2A9519C
InternetCloseHandle.WININET ref: 00000259C2A951A5

Strings

File Downloader, xrefs: 00000259C2A950F4

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandleOpenRead
String ID: File Downloader
API String ID: 4038090926-3631955488
Opcode ID: d760029ad861ea7f7ea2ffc299629ee0db5f3c755485599aed123bc73a668a15
Instruction ID: 51b3d3ec955acb1787d7f4073aa26003e78b4f5e2fe1ace9e1edb9d1902f7921
Opcode Fuzzy Hash: d760029ad861ea7f7ea2ffc299629ee0db5f3c755485599aed123bc73a668a15
Instruction Fuzzy Hash: 6E314C32218F80C6EF109F56A85979AB364F789FC6F544016EE8943B98DF7CC5858B04

Function 00000259C2AB32AC Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000259C2AB32EF
_invalid_parameter_noinfo.LIBCMT ref: 00000259C2AB36DC
_invalid_parameter_noinfo.LIBCMT ref: 00000259C2AB3978

Strings

p, xrefs: 00000259C2AB3419
p, xrefs: 00000259C2AB33A1
f, xrefs: 00000259C2AB3411

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: da133f4d1d1d50a9f8077a7ed93c78c5851a9c9ee1111e96f3e2a2a160aeb47c
Instruction ID: 7dab58c2f4b098a86f7cae256a69aa09e4d6156aedc456b393419bb9a971dad5
Opcode Fuzzy Hash: da133f4d1d1d50a9f8077a7ed93c78c5851a9c9ee1111e96f3e2a2a160aeb47c
Instruction Fuzzy Hash: 8712D172604A41C6FF209B59E86C7AA76A1F388F57F94411BEAC247BC4D778C9C0CB18

Function 00000259C2ACABDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000259C2ACAC0D
GetLastError.KERNEL32 ref: 00000259C2ACAC19
CloseHandle.KERNEL32 ref: 00000259C2ACAC31
CreateFileW.KERNEL32 ref: 00000259C2ACAC5C
WriteConsoleW.KERNEL32 ref: 00000259C2ACAC7B

Strings

CONOUT$, xrefs: 00000259C2ACAC3D

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 97ef1f90b5d1e549fd4d93c948d975b58c02b300c1de8e440893a5efab19f807
Instruction ID: c91f94c1f7a67bafa0e8bacad866e01b7191bbb73fd0ee014053732173682df9
Opcode Fuzzy Hash: 97ef1f90b5d1e549fd4d93c948d975b58c02b300c1de8e440893a5efab19f807
Instruction Fuzzy Hash: 99115B31314E80C6EB508B56EC5832977A4F78DFE7F044226EA9987BE4CB7CC8958748

Function 00000259C2ADB73C Relevance: 9.2, APIs: 6, Instructions: 239COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00000259C2ADB7E9
MultiByteToWideChar.KERNEL32 ref: 00000259C2ADB885
MultiByteToWideChar.KERNEL32 ref: 00000259C2ADB92E
MultiByteToWideChar.KERNEL32 ref: 00000259C2ADB958
MultiByteToWideChar.KERNEL32 ref: 00000259C2ADBA00
CompareStringEx.KERNEL32 ref: 00000259C2ADBA4D

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: ab7e75f2883cad40e90fab743296f144bd79ee85a7c99ab5de0f741cdd8f7a66
Instruction ID: 4accb23b5ba7314d0a72478a5e9aa5af3486195c9cb731a4ab2f3d7b23f0dfd1
Opcode Fuzzy Hash: ab7e75f2883cad40e90fab743296f144bd79ee85a7c99ab5de0f741cdd8f7a66
Instruction Fuzzy Hash: FFA19072600F80CAFF218B2598583AD6691F748FABF444A23DA994BBD5DB38C585C348

Function 00000259C2ADB3DC Relevance: 9.2, APIs: 6, Instructions: 206COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00000259C2ADB44C
MultiByteToWideChar.KERNEL32 ref: 00000259C2ADB4EA
LCMapStringEx.KERNEL32 ref: 00000259C2ADB553
LCMapStringEx.KERNEL32 ref: 00000259C2ADB5A5
LCMapStringEx.KERNEL32 ref: 00000259C2ADB64A
WideCharToMultiByte.KERNEL32 ref: 00000259C2ADB6A4

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: a17d41df7d4fcd83c170866fb1b58b26a6ae7521d63a390143938d7d4d5e554f
Instruction ID: e53ceedab05f5c0b131f6dfc13c86705510b7ab3f81f322187ffc1bdfcb9b013
Opcode Fuzzy Hash: a17d41df7d4fcd83c170866fb1b58b26a6ae7521d63a390143938d7d4d5e554f
Instruction Fuzzy Hash: 2D816372200B40C6FF248F25D84875977A5FB58FEBF544A26EA9947BD8DB38C485C708

Function 00000259C2AB03B8 Relevance: 9.2, APIs: 6, Instructions: 157COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000259C2AB042A
_invalid_parameter_noinfo.LIBCMT ref: 00000259C2AB045B
_invalid_parameter_noinfo.LIBCMT ref: 00000259C2AB049B
_invalid_parameter_noinfo.LIBCMT ref: 00000259C2AB04DD
_invalid_parameter_noinfo.LIBCMT ref: 00000259C2AB0512
_invalid_parameter_noinfo.LIBCMT ref: 00000259C2AB058F

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ca3f80eaf004f362beb8f5b3b26ae04cc2cf7c865ac26bc256f85fe2d54e20e3
Instruction ID: 81b475a7ba861d926be4633dd26ec22eca95c8f5cbfbc55ef218b13de5ab1b40
Opcode Fuzzy Hash: ca3f80eaf004f362beb8f5b3b26ae04cc2cf7c865ac26bc256f85fe2d54e20e3
Instruction Fuzzy Hash: 54514E76109E84C9EB629F26D8683AD3BA5A749F47F448043C7C8477C6DE39C885C71E

Function 00000259C2AB8374 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000259C2AB8383
FlsSetValue.KERNEL32(?,?,-2891666E48DAA7FF,00000259C2AB40D5,?,?,?,?,00000259C2ABB584), ref: 00000259C2AB83B9
FlsSetValue.KERNEL32(?,?,-2891666E48DAA7FF,00000259C2AB40D5,?,?,?,?,00000259C2ABB584), ref: 00000259C2AB83E6
FlsSetValue.KERNEL32(?,?,-2891666E48DAA7FF,00000259C2AB40D5,?,?,?,?,00000259C2ABB584), ref: 00000259C2AB83F7
FlsSetValue.KERNEL32(?,?,-2891666E48DAA7FF,00000259C2AB40D5,?,?,?,?,00000259C2ABB584), ref: 00000259C2AB8408
SetLastError.KERNEL32 ref: 00000259C2AB8423

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: afe38cc287240995e2e9d2378547507dd5cbbb9e4fb21f15aad5b3e1c77e3c65
Instruction ID: c2711bbe0bdc0056ea71c5ac500c8714bee5a9a49b753007510978dc1773eb4b
Opcode Fuzzy Hash: afe38cc287240995e2e9d2378547507dd5cbbb9e4fb21f15aad5b3e1c77e3c65
Instruction Fuzzy Hash: BE119A30304E41CAFE58A7296E9D72D62529B4DFB3F044726ADF646BD6DE39D4C1C208

Function 00000259C2A4DB90 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 281COMMON

Download Yara Rule

APIs

__std_fs_code_page.LIBCPMT ref: 00000259C2A4DBEF

Part of subcall function 00000259C2AD9570: AreFileApisANSI.KERNEL32 ref: 00000259C2AD9582

__std_exception_destroy.LIBVCRUNTIME ref: 00000259C2A4DE97
__std_exception_destroy.LIBVCRUNTIME ref: 00000259C2A4DF51

Strings

: ", xrefs: 00000259C2A4DCAA
", ", xrefs: 00000259C2A4DCDD

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy$ApisFile__std_fs_code_page
String ID: ", "$: "
API String ID: 741338541-747220369
Opcode ID: 70c3df3b0665392bb10dec36982789de03aed693fc70c4f23570ae3ae5983821
Instruction ID: 0384a59728cc99b6112202f31798408a5a2424db5ea8b83345268b997df63783
Opcode Fuzzy Hash: 70c3df3b0665392bb10dec36982789de03aed693fc70c4f23570ae3ae5983821
Instruction Fuzzy Hash: 0CB1AA72701F40D5EF00DF65E8483AC2366E749F8AF109522EA9907BDADF39C591C388

Function 00000259C2ABF4D8 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000259C2ABF517
_set_statfp.LIBCMT ref: 00000259C2ABF535
_set_statfp.LIBCMT ref: 00000259C2ABF55E
_set_statfp.LIBCMT ref: 00000259C2ABF79A

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 5459f65f4676636fdc901623b58b7eba5cdeda63d87ce883b5aed9902fe8fe9f
Instruction ID: 0d8716585592fd62086e3b308d422fd7950c729f137fc56db2dbd8c701f7ddc4
Opcode Fuzzy Hash: 5459f65f4676636fdc901623b58b7eba5cdeda63d87ce883b5aed9902fe8fe9f
Instruction Fuzzy Hash: F781E532500E84C5FA728F35AC5836A66A1AB5DF97F1C4303BED9A6BE5D738C5C1C608

Function 00000259C2AB843C Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000259C2AAF8AF,?,?,00000000,00000259C2AAFB4A,?,?,?,?,-2891666E48DAA7FF,00000259C2AAFAD6), ref: 00000259C2AB845B
FlsSetValue.KERNEL32(?,?,?,00000259C2AAF8AF,?,?,00000000,00000259C2AAFB4A,?,?,?,?,-2891666E48DAA7FF,00000259C2AAFAD6), ref: 00000259C2AB847A
FlsSetValue.KERNEL32(?,?,?,00000259C2AAF8AF,?,?,00000000,00000259C2AAFB4A,?,?,?,?,-2891666E48DAA7FF,00000259C2AAFAD6), ref: 00000259C2AB84A2
FlsSetValue.KERNEL32(?,?,?,00000259C2AAF8AF,?,?,00000000,00000259C2AAFB4A,?,?,?,?,-2891666E48DAA7FF,00000259C2AAFAD6), ref: 00000259C2AB84B3
FlsSetValue.KERNEL32(?,?,?,00000259C2AAF8AF,?,?,00000000,00000259C2AAFB4A,?,?,?,?,-2891666E48DAA7FF,00000259C2AAFAD6), ref: 00000259C2AB84C4

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 4ce4a5051ebace67528a179680f56dd4679384bab99bc7618957d122f6916756
Instruction ID: 2c226a56236984756c264da2ec2cd13c3a6b9c56477ac384b0d710e0902a571c
Opcode Fuzzy Hash: 4ce4a5051ebace67528a179680f56dd4679384bab99bc7618957d122f6916756
Instruction Fuzzy Hash: E4119030705E41C9FE6C932AAE5972921469B4CFF3F484727A9FA467DADE38D4C1C208

Function 00000259C2A66510 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000259C2A66580
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000259C2A665C8
_Getcoll.LIBCPMT ref: 00000259C2A665FC

Strings

bad locale name, xrefs: 00000259C2A66701

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: std::_$GetcollLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1287851536-1405518554
Opcode ID: fbfbbd7b2027d036e315073af143bae7ec25fc3c62d82c00348e94651dbbdfc6
Instruction ID: b1da6d41b97dd165ffc20757a8efaa959fcbe1cbd70016c9db5f3aea150cfd78
Opcode Fuzzy Hash: fbfbbd7b2027d036e315073af143bae7ec25fc3c62d82c00348e94651dbbdfc6
Instruction Fuzzy Hash: AA915B62701F80CAEF149FB5E85439C7366EB48F8AF0445269A9967BDADF38C4918348

Function 00000259C2ADD3EC Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000259C2ADD6CB

Part of subcall function 00000259C2ACA7BC: _invalid_parameter_noinfo.LIBCMT ref: 00000259C2ACA7D9

Strings

ccs, xrefs: 00000259C2ADD606
UTF-8, xrefs: 00000259C2ADD64A
UTF-16LEUNICODE, xrefs: 00000259C2ADD669

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: c93d0c80d14289c47e4e012ab7823fd63e1d2ef69c6c82be7162492af36b69b4
Instruction ID: d50fa8102020a80a42dff89f6d9735288cf68b36f810d01ffb957c8d0ac7ec2a
Opcode Fuzzy Hash: c93d0c80d14289c47e4e012ab7823fd63e1d2ef69c6c82be7162492af36b69b4
Instruction Fuzzy Hash: 688188BF604F00C5FF658F29895C3682AA0A31AF8FF568007DA86973D5D339D9819649

Function 00000259C2A79E10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00000259C2A79FF0
__std_exception_destroy.LIBVCRUNTIME ref: 00000259C2A79FFD

Strings

, column , xrefs: 00000259C2A79EC8
at line , xrefs: 00000259C2A79E9A

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: at line $, column
API String ID: 2453523683-191570568
Opcode ID: 8e1d1b64992ebb00d4d77e0a1fed3680f94c34247a39cf19bc8266c22a1fe26b
Instruction ID: 5d8036cc46c29f28428e8cdacb7464bb3bfcda2b4fcbd487672b963746f2e242
Opcode Fuzzy Hash: 8e1d1b64992ebb00d4d77e0a1fed3680f94c34247a39cf19bc8266c22a1fe26b
Instruction Fuzzy Hash: 78516C62604B80C1EA10DB2AE99835E6765F78DFD2F104613EBE807BDADF39C5D18748

Function 00000259C2A4C910 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000259C2A4C97F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000259C2A4C9C7
_Getctype.LIBCPMT ref: 00000259C2A4CA05

Strings

bad locale name, xrefs: 00000259C2A4CABE

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: std::_$GetctypeLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1612978173-1405518554
Opcode ID: 85691f01e980f503a8a5ffab79cefbcc4565558e69c5e965dadd8410ba14cca9
Instruction ID: 3af45647e08d42c857c1a846238c0f942907eb35a60dcba1a3fa49b0000398be
Opcode Fuzzy Hash: 85691f01e980f503a8a5ffab79cefbcc4565558e69c5e965dadd8410ba14cca9
Instruction Fuzzy Hash: 98512832702F40DAFF10DFA0E8943AC3376EB49B4AF4445279A8926B9ADB34C595D358

Function 00000259C2AA0F00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00000259C2AA0F8B

Strings

?, xrefs: 00000259C2AA0F40

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Open
String ID: ?
API String ID: 71445658-1684325040
Opcode ID: e858e0353f0b0f51294932793ef27480847be266b4f1ddbad7c6a163f917eadb
Instruction ID: 894ef458a51a0e918925ae2a1b273f7b1436e31dcaeea01a622a682ca095c630
Opcode Fuzzy Hash: e858e0353f0b0f51294932793ef27480847be266b4f1ddbad7c6a163f917eadb
Instruction Fuzzy Hash: 2A418072618B80C1EF508B25F88936AB361FB8DB96F105216FAD942B99DF7CC1D4CB44

Function 00000259C2AD9520 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000259C2AD9536
GetProcAddress.KERNEL32 ref: 00000259C2AD9546

Strings

kernel32.dll, xrefs: 00000259C2AD952F
GetTempPath2W, xrefs: 00000259C2AD953C

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetTempPath2W$kernel32.dll
API String ID: 1646373207-1846531799
Opcode ID: 54cfff917e61736e637f3daaf4ede8ca0052c6a8694a4254edfc7bf5cdf1c370
Instruction ID: ffb2302e17927f945baf3f847e676adc301865990dc4fa7193196b311bcd9416
Opcode Fuzzy Hash: 54cfff917e61736e637f3daaf4ede8ca0052c6a8694a4254edfc7bf5cdf1c370
Instruction Fuzzy Hash: D8E0E561300E44C2EE189B11FD882696361FB8DF87F58502ADA8E07BB4DE3CC4CA8308

Function 00000259C2A8F480 Relevance: 6.5, APIs: 4, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00000259C2A8ED30: CreateToolhelp32Snapshot.KERNEL32 ref: 00000259C2A8ED86
Part of subcall function 00000259C2A8ED30: Process32FirstW.KERNEL32 ref: 00000259C2A8EDCA
Part of subcall function 00000259C2A8ED30: Process32NextW.KERNEL32 ref: 00000259C2A8EDDF
Part of subcall function 00000259C2A8ED30: OpenProcess.KERNEL32 ref: 00000259C2A8EE1B
Part of subcall function 00000259C2A8ED30: OpenProcessToken.ADVAPI32 ref: 00000259C2A8EE42
Part of subcall function 00000259C2A8ED30: CloseHandle.KERNEL32 ref: 00000259C2A8EFB6
Part of subcall function 00000259C2A8ED30: Process32NextW.KERNEL32 ref: 00000259C2A8EFC3
Part of subcall function 00000259C2A8ED30: CloseHandle.KERNEL32 ref: 00000259C2A8F007

ImpersonateLoggedOnUser.ADVAPI32 ref: 00000259C2A8F4DD
ImpersonateLoggedOnUser.ADVAPI32 ref: 00000259C2A8F9C8
RevertToSelf.ADVAPI32 ref: 00000259C2A8F9E6

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Process32$CloseHandleImpersonateLoggedNextOpenProcessUser$CreateFirstRevertSelfSnapshotTokenToolhelp32
String ID:
API String ID: 1562318730-0
Opcode ID: 316c2e6fdf35f67638a24c1b45d4b3dc2851aea21892dc61ca1780e4b7a94a99
Instruction ID: 5ce2b33fab4063cd674afde4aa4e993e1fd98ed1d9c80b0a31c340125a20c4dd
Opcode Fuzzy Hash: 316c2e6fdf35f67638a24c1b45d4b3dc2851aea21892dc61ca1780e4b7a94a99
Instruction Fuzzy Hash: 6022C062614F81C6FF009B78D85839D2761E78DBA6F905212EAED46BEADF78C4C1C704

Function 00000259C2ABA888 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000259C2ABA907
WriteFile.KERNEL32 ref: 00000259C2ABABCF
WriteFile.KERNEL32 ref: 00000259C2ABAC15
GetLastError.KERNEL32 ref: 00000259C2ABACCB

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 523722e26ffa46449d979bd975143a43a29be3ae997596a7a20ff96f8c1017ee
Instruction ID: 20204d0daca17afae9cedf971bf4965eb4f6fb871ec43b4a3842dbd8bd35e9d4
Opcode Fuzzy Hash: 523722e26ffa46449d979bd975143a43a29be3ae997596a7a20ff96f8c1017ee
Instruction Fuzzy Hash: D5D1CF32B14E80CAEB11CFA9D84439C37B1F759B9AF044216DE9E97BDADA34C496C344

Function 00000259C2ABB248 Relevance: 6.2, APIs: 4, Instructions: 218COMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000259C2ABB364
GetLastError.KERNEL32 ref: 00000259C2ABB3EF

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 051a95757f3cd31bcbf302130b81a7499006cb3b8c40f8426fd2f443c90a72fc
Instruction ID: 70edc396ced51a4d4fd3c304d3c04329b6ecaf3a37f8f4e346be35c614343d6a
Opcode Fuzzy Hash: 051a95757f3cd31bcbf302130b81a7499006cb3b8c40f8426fd2f443c90a72fc
Instruction Fuzzy Hash: 1291BF72610E50C5FF608F659C88BAD2BA4B359F8BF54451ADE8A67BD5CA34C8C2C708

Function 00000259C2AA4220 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00000259C2AA4240
FreeEnvironmentStringsW.KERNEL32 ref: 00000259C2AA433B
RtlInitUnicodeString.NTDLL ref: 00000259C2AA43AE
RtlInitUnicodeString.NTDLL ref: 00000259C2AA43BB

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: EnvironmentInitStringStringsUnicode$Free
String ID:
API String ID: 2488768755-0
Opcode ID: 2b2f1f90d0b32243a53be456331d7bdf6004e7484ecf8859458b1b26bd362795
Instruction ID: 9cc32f5cb6bae774c454d1549b744ad0ba7a60d4a174ba6d708f5f3e9766f551
Opcode Fuzzy Hash: 2b2f1f90d0b32243a53be456331d7bdf6004e7484ecf8859458b1b26bd362795
Instruction Fuzzy Hash: 8D519D32A04B80C6EB108F15F84435DB360FB98F96F589216EB9903B95DFB8D6E1C708

Function 00000259C2A60120 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 00000259C2ADA8FC: std::_Lockit::_Lockit.LIBCPMT ref: 00000259C2ADA919
Part of subcall function 00000259C2ADA8FC: std::locale::_Setgloballocale.LIBCPMT ref: 00000259C2ADA93C

std::_Lockit::_Lockit.LIBCPMT ref: 00000259C2A60161
std::_Lockit::_Lockit.LIBCPMT ref: 00000259C2A60186
std::_Facet_Register.LIBCPMT ref: 00000259C2A60232
Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A60294

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_RegisterSetgloballocalestd::locale::_
String ID:
API String ID: 3698853521-0
Opcode ID: 7fc3597cd9704a6304594a27bb2dfeeca3e59ce2e728f14c12add50f8541c22a
Instruction ID: 3896e3bdfd8c8c20a55c3f60155a93c66d3a2a443358b3b8c7bb55f835e5b711
Opcode Fuzzy Hash: 7fc3597cd9704a6304594a27bb2dfeeca3e59ce2e728f14c12add50f8541c22a
Instruction Fuzzy Hash: B3412562210F40C2EE11DB26EC48359B3A4F78DF96F580627AAD9477A6DF78C4C6C718

Function 00000259C2AB0274 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000259C2AB02ED
_invalid_parameter_noinfo.LIBCMT ref: 00000259C2AB0349
_invalid_parameter_noinfo.LIBCMT ref: 00000259C2AB0384
_invalid_parameter_noinfo.LIBCMT ref: 00000259C2AB03A9

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f47f5365830de18e31c9f66efcfcebced3ed900e80df05c2fe820f8996efde49
Instruction ID: 40535937b41ed38a047476a945e2d2e5c758a11706274bd2d6a6a37cab9bd975
Opcode Fuzzy Hash: f47f5365830de18e31c9f66efcfcebced3ed900e80df05c2fe820f8996efde49
Instruction Fuzzy Hash: 13411C72509E84CAEB529F26C82836D7BA4E749F46F498042CBC9473CADE39C585C71E

Function 00000259C2A739F0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000259C2A73A1B
std::_Lockit::_Lockit.LIBCPMT ref: 00000259C2A73A40
std::_Facet_Register.LIBCPMT ref: 00000259C2A73AEB
Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A73B36

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 268a738e79390acd07def2dc4d1be91678e0d7bbd421806bae9408622498fc9b
Instruction ID: 3bb8ab77015b68716a791acf9489d4b8a353707887ba285d90c1c4f76bbd6778
Opcode Fuzzy Hash: 268a738e79390acd07def2dc4d1be91678e0d7bbd421806bae9408622498fc9b
Instruction Fuzzy Hash: FF415626204F40C1EE119B16EC58369B764F78DF97F590623EAC90B7E6DE38C4C28708

Function 00000259C2A94940 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000259C2A9496B
std::_Lockit::_Lockit.LIBCPMT ref: 00000259C2A94990
std::_Facet_Register.LIBCPMT ref: 00000259C2A94A3B
Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A94A86

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 225fe1b72370eebaf99dac6ca4c61f0c7a8ae1283e1f422937767657019483ac
Instruction ID: ce165322f3143136a6844925b427c7ef84cd6f6d04f89945c20353a8fa53b5b4
Opcode Fuzzy Hash: 225fe1b72370eebaf99dac6ca4c61f0c7a8ae1283e1f422937767657019483ac
Instruction Fuzzy Hash: CF416A26214F40C9FE11EB16E8483597764F38DFA6F180227AADD0B7E9DE78C4818318

Function 00000259C2A61DD0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000259C2A61DFB
std::_Lockit::_Lockit.LIBCPMT ref: 00000259C2A61E20
std::_Facet_Register.LIBCPMT ref: 00000259C2A61ECB
Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A61F16

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: deae80201b058b93dee9511eb23f4883bce05ec3d16f28b31309998fe1f492bf
Instruction ID: 7c78b5f35e4d298c49f2c5872dcb8cdadce8f67e4791f7c4ac1db11ed0716152
Opcode Fuzzy Hash: deae80201b058b93dee9511eb23f4883bce05ec3d16f28b31309998fe1f492bf
Instruction Fuzzy Hash: DB414926214F40C1FE15DB59EC4836967A4F78DFA6F580623AACD4B7E6DB78C4828708

Function 00000259C2A940C0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000259C2A940EB
std::_Lockit::_Lockit.LIBCPMT ref: 00000259C2A94110
std::_Facet_Register.LIBCPMT ref: 00000259C2A941BB
Concurrency::cancel_current_task.LIBCPMT ref: 00000259C2A94206

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: f751cf97cbdb91efc437d10692cdb5900781dee89e6afe037389110580d2090b
Instruction ID: 36a1c4a19a61f02f76668af1fa93e28bb4362e2ecf0e5524c39c7916e150bac7
Opcode Fuzzy Hash: f751cf97cbdb91efc437d10692cdb5900781dee89e6afe037389110580d2090b
Instruction Fuzzy Hash: 8C416822204F40C5FE15EB16EC48359B764F39DF96F680623AAC90B7E6DE78C4868718

Function 00000259C2AD9704 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00000259C2AD974D
GetLastError.KERNEL32 ref: 00000259C2AD975B
WideCharToMultiByte.KERNEL32 ref: 00000259C2AD9790
GetLastError.KERNEL32 ref: 00000259C2AD979E

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 885017ec562e008ced87b7a088d7b161d23e12804f5abb955417809e776ebcf4
Instruction ID: 150843fef078684ae86d6d7d7b2248c0c16741380fa83ad0bb222bc4d64e1ab3
Opcode Fuzzy Hash: 885017ec562e008ced87b7a088d7b161d23e12804f5abb955417809e776ebcf4
Instruction Fuzzy Hash: 53215E72614B85C7F750CF21E84831EBAB4F38DF96F240129DB8957B94DB39C4458B08

Function 00000259C2AD9BF0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00000259C2AD9520: GetModuleHandleW.KERNEL32 ref: 00000259C2AD9536
Part of subcall function 00000259C2AD9520: GetProcAddress.KERNEL32 ref: 00000259C2AD9546

GetLastError.KERNEL32 ref: 00000259C2AD9C14

Part of subcall function 00000259C2AB7BC4: IsProcessorFeaturePresent.KERNEL32 ref: 00000259C2AB7BEA

GetFileAttributesW.KERNEL32 ref: 00000259C2AD9C23
__std_fs_open_handle.LIBCPMT ref: 00000259C2AD9C4C
CloseHandle.KERNEL32 ref: 00000259C2AD9C5E

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: Handle$AddressAttributesCloseErrorFeatureFileLastModulePresentProcProcessor__std_fs_open_handle
String ID:
API String ID: 156590933-0
Opcode ID: ab22cb6cb8c17ed70bd3674071cc7aa31663a6931c8f4e60418ec3b925b4023f
Instruction ID: 0da0a259e1541c058de4ee80c96030eb1db2257e4d3b147985dd1f6c76c20075
Opcode Fuzzy Hash: ab22cb6cb8c17ed70bd3674071cc7aa31663a6931c8f4e60418ec3b925b4023f
Instruction Fuzzy Hash: 6B114621214F41C9FE649725A88C32A66A1E74CFF3F141A16AAF746BE5DA38C4C58B0C

Function 00000259C2A4EAA0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

[json.exception., xrefs: 00000259C2A4EBDB

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID:
String ID: [json.exception.
API String ID: 0-791563284
Opcode ID: 9312c027d5fae459814da3f46332f521891fa988a0930d2691346a9914b04737
Instruction ID: 4e36a0510a4d49476e24b5e0afb0de05c47ae005162e4225b7e63a0c0f1b0b09
Opcode Fuzzy Hash: 9312c027d5fae459814da3f46332f521891fa988a0930d2691346a9914b04737
Instruction Fuzzy Hash: C171F262B10F90C5FB00CB7AE84439D27A5E799B96F549217DE9917BCACB78C1C2C344

Function 00000259C2A94EC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000259C2A94F2F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000259C2A94F77

Strings

bad locale name, xrefs: 00000259C2A9504C

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 33544a4b61bf84f9eb955a3149670865a90af30da0d0207d443c82dd33414cde
Instruction ID: a9a52232f8957e4dd84956feaebdc414fd2dd584fbeced52038e709f65ed0c63
Opcode Fuzzy Hash: 33544a4b61bf84f9eb955a3149670865a90af30da0d0207d443c82dd33414cde
Instruction Fuzzy Hash: 1F51F632705A40CAFF14EF71D8953AC33A4EB58F4AF484037AA8966B96DE34C5A5C348

Function 00000259C2A74780 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000259C2A747EF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000259C2A74837

Strings

bad locale name, xrefs: 00000259C2A74916

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: c058fda049dbde4ffcd4c62f786bcc4b07de1651a8a61ea2a3f562e1823d8c15
Instruction ID: a1cb737e34b747bd707b77b8d9014fbd9918e784def09cf297474cb70ae54226
Opcode Fuzzy Hash: c058fda049dbde4ffcd4c62f786bcc4b07de1651a8a61ea2a3f562e1823d8c15
Instruction Fuzzy Hash: 9F512932302F80C9FF10DFA0D8943AC33B4EB59F4AF444526EA8966B95DA34C5A5D308

Function 00000259C2AC1068 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000259C2AC6448: _invalid_parameter_noinfo.LIBCMT ref: 00000259C2AC647B

_get_daylight.LIBCMT ref: 00000259C2AC1180
_get_daylight.LIBCMT ref: 00000259C2AC1191

Strings

?, xrefs: 00000259C2AC1111

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: ee72351df311ff027eaf8af198dd50b8868fef75caf7a1d708de55c1de70a8ab
Instruction ID: 01a579a1ca61c54653698e452d99543810ad24a8e9eead8d68c2d7cc99719bd5
Opcode Fuzzy Hash: ee72351df311ff027eaf8af198dd50b8868fef75caf7a1d708de55c1de70a8ab
Instruction Fuzzy Hash: F741FB32304F80C5FF649B2AEC197696798E789FA7F144226EED406BD5DA3AC4C1C704

Function 00000259C2ABAF20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000259C2ABB037
GetLastError.KERNEL32 ref: 00000259C2ABB059

Strings

U, xrefs: 00000259C2ABAFE3

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 95c1b5a9b453dd21b53d1d3abd175e481a437f6821d85bbfa209bab1ceee3d57
Instruction ID: 19ba72ce1fda7fa360cab592b87b2d401f2ca5b5e6817977bfc5410d0c762b44
Opcode Fuzzy Hash: 95c1b5a9b453dd21b53d1d3abd175e481a437f6821d85bbfa209bab1ceee3d57
Instruction Fuzzy Hash: 7E418E72214A40C6DB208F65E8487AA77A5F798B86F404022EE8E87BD4EB3CC481C754

Function 00000259C2ACF198 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00000259C2ACF1E8
RaiseException.KERNEL32 ref: 00000259C2ACF229

Strings

csm, xrefs: 00000259C2ACF216

Memory Dump Source

Source File: 00000000.00000002.1959532154.00000259C2A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000259C2A20000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_259c2a20000_ruppert.jbxd

Yara matches

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4d2c4101b9d2858735cfea5a09a2e9289d44dfdbc7b24173af3d04f9105eea82
Instruction ID: 652fc284ae20d9541ac7b3a76c426ddec41b71660f61ea9fa30f7ce503bb6dee
Opcode Fuzzy Hash: 4d2c4101b9d2858735cfea5a09a2e9289d44dfdbc7b24173af3d04f9105eea82
Instruction Fuzzy Hash: 1A110732215B8482EB218F15E844259B7E4F78CB96F584222DECD47BA8EF3DC5958B04

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ruppert.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
ruppert.exe

Function 00000259C2A9FB30 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 225
windowCOMMON

Function 00000259C2AD98C0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Function 00000259C2A5B820 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 862
libraryloaderCOMMON

Function 00000259C2A96480 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173
synchronizationCOMMON

Function 00000259C2AC114C Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Function 00000259C2A9F200 Relevance: 13.9, APIs: 9, Instructions: 408
networkfileCOMMON

Function 00000259C2ADE968 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Function 00000259C2A98F60 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 451
fileCOMMON

Function 00000259C2AC13C8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMONLIBRARYCODE

Function 00000259C2AB749C Relevance: 9.2, APIs: 6, Instructions: 227
COMMON

Function 00000259C2AA8B70 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410
COMMON

Function 00000259C2A98B30 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 194
windowCOMMON

Function 00000259C2A99BE0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 250
networkCOMMON

Function 00000259C2AA3B30 Relevance: 13.6, APIs: 9, Instructions: 117
COMMON

Function 00000259C2ABD5F0 Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre