Edit tour

Windows Analysis Report
markiz.exe

Overview

General Information

Sample name:	markiz.exe
Analysis ID:	1581172
MD5:	bee040fc0caf73ee0cb2e55d4c703f22
SHA1:	6bf7f1fa9dcf930190cabfba9abde2e7faab486f
SHA256:	940d413dd95bc28d5c724d814f2cd1ecca005d2cb58ed28788d9c07d962d829b
Tags:	exeMeduzaStealeruser-lontze7
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Suricata IDS alerts with low severity for network traffic

Terminates after testing mutex exists (may check infected machine status)

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

markiz.exe (PID: 3688 cmdline: "C:\Users\user\Desktop\markiz.exe" MD5: BEE040FC0CAF73EE0CB2E55D4C703F22)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "193.3.19.151", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt", "build_name": "mrfree", "links": "", "port": 15666}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
markiz.exe	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
markiz.exe	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0x113144:$str01: emoji 0x115dc8:$str02: %d-%m-%Y, %H:%M:%S 0x115e38:$str03: [UTC 0x115e40:$str04: user_name 0x115e88:$str05: computer_name 0x115e60:$str06: timezone 0x115d98:$str07: current_path() 0x113108:$str08: [json.exception. 0x12dc2c:$str09: GDI32.dll 0x12de9e:$str10: GdipGetImageEncoders 0x12df16:$str10: GdipGetImageEncoders 0x12d4b0:$str11: GetGeoInfoA

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: markiz.exe PID: 3688	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: markiz.exe PID: 3688	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.markiz.exe.7ff6573f0000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.0.markiz.exe.7ff6573f0000.0.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0x113144:$str01: emoji 0x115dc8:$str02: %d-%m-%Y, %H:%M:%S 0x115e38:$str03: [UTC 0x115e40:$str04: user_name 0x115e88:$str05: computer_name 0x115e60:$str06: timezone 0x115d98:$str07: current_path() 0x113108:$str08: [json.exception. 0x12dc2c:$str09: GDI32.dll 0x12de9e:$str10: GdipGetImageEncoders 0x12df16:$str10: GdipGetImageEncoders 0x12d4b0:$str11: GetGeoInfoA
0.2.markiz.exe.7ff6573f0000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.markiz.exe.7ff6573f0000.0.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0x113144:$str01: emoji 0x115dc8:$str02: %d-%m-%Y, %H:%M:%S 0x115e38:$str03: [UTC 0x115e40:$str04: user_name 0x115e88:$str05: computer_name 0x115e60:$str06: timezone 0x115d98:$str07: current_path() 0x113108:$str08: [json.exception. 0x12dc2c:$str09: GDI32.dll 0x12de9e:$str10: GdipGetImageEncoders 0x12df16:$str10: GdipGetImageEncoders 0x12d4b0:$str11: GetGeoInfoA

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T06:52:07.770868+0100	2049441	1	A Network Trojan was detected	192.168.2.6	49707	193.3.19.151	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T06:52:07.770868+0100	2050806	1	A Network Trojan was detected	192.168.2.6	49707	193.3.19.151	15666	TCP
2024-12-27T06:52:07.890721+0100	2050806	1	A Network Trojan was detected	192.168.2.6	49707	193.3.19.151	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T06:52:07.770868+0100	2050807	1	A Network Trojan was detected	192.168.2.6	49707	193.3.19.151	15666	TCP
2024-12-27T06:52:07.890721+0100	2050807	1	A Network Trojan was detected	192.168.2.6	49707	193.3.19.151	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: markiz.exe

Malware Configuration Extractor: Meduza Stealer {"C2 url": "193.3.19.151", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt", "build_name": "mrfree", "links": "", "port": 15666}

Multi AV Scanner detection for submitted file

Source: markiz.exe	ReversingLabs: Detection: 65%
Source: markiz.exe	Virustotal: Detection: 80%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: markiz.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657467BA0 CryptUnprotectData,LocalFree,	0_2_00007FF657467BA0
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657468440 BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,Concurrency::cancel_current_task,	0_2_00007FF657468440
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF6574683C0 BCryptCloseAlgorithmProvider,_invalid_parameter_noinfo_noreturn,	0_2_00007FF6574683C0
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657468020 BCryptDecrypt,BCryptDecrypt,_invalid_parameter_noinfo_noreturn,	0_2_00007FF657468020
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657467EC0 CryptProtectData,LocalFree,	0_2_00007FF657467EC0
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657427C20 CryptUnprotectData,LocalFree,_invalid_parameter_noinfo_noreturn,	0_2_00007FF657427C20
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657423A30 BCryptDestroyKey,	0_2_00007FF657423A30

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:49708 version: TLS 1.2

Source: markiz.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF6574AB5B0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		0_2_00007FF6574AB5B0
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF6574AB500 FindClose,FindFirstFileExW,GetLastError,		0_2_00007FF6574AB500

Source: C:\Users\user\Desktop\markiz.exe

Code function: 0_2_00007FF6574773F0 GetLogicalDriveStringsW,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6574773F0

Source: C:\Users\user\Desktop\markiz.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.6:49707 -> 193.3.19.151:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.6:49707 -> 193.3.19.151:15666

Source: global traffic

TCP traffic: 192.168.2.6:49707 -> 193.3.19.151:15666

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 193.3.19.151 193.3.19.151

Source: Joe Sandbox View

ASN Name: ARNES-NETAcademicandResearchNetworkofSloveniaSI ARNES-NETAcademicandResearchNetworkofSloveniaSI

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.6:49707 -> 193.3.19.151:15666

Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.151

Source: C:\Users\user\Desktop\markiz.exe

Code function: 0_2_00007FF657475240 InternetOpenA,InternetOpenUrlA,HttpQueryInfoW,HttpQueryInfoW,InternetQueryDataAvailable,InternetReadFile,InternetQueryDataAvailable,InternetCloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,Concurrency::cancel_current_task,

0_2_00007FF657475240

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: markiz.exe, 00000000.00000003.2360887292.0000027B45C70000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2151933457.0000027B45C61000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2360985704.0000027B45C74000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2360913678.0000027B45C70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsoft.t/Regi
Source: markiz.exe, 00000000.00000003.2153560696.0000027B4699B000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2153639176.0000027B45C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: markiz.exe, 00000000.00000003.2152488246.0000027B43E3B000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000002.2361417714.0000027B43E20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: markiz.exe, 00000000.00000003.2152488246.0000027B43E3B000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000002.2361417714.0000027B43E20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/b
Source: markiz.exe, 00000000.00000003.2161154860.0000027B46AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: markiz.exe, 00000000.00000003.2160516068.0000027B46AB0000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2161154860.0000027B46AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: markiz.exe, 00000000.00000003.2153560696.0000027B4699B000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2153639176.0000027B45C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: markiz.exe, 00000000.00000003.2153560696.0000027B4699B000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2153639176.0000027B45C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: markiz.exe, 00000000.00000003.2153560696.0000027B4699B000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2153639176.0000027B45C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: markiz.exe, 00000000.00000003.2161154860.0000027B46AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: markiz.exe, 00000000.00000003.2160516068.0000027B46AB0000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2161154860.0000027B46AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: markiz.exe, 00000000.00000003.2153418967.0000027B46982000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2153560696.0000027B4699B000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2153560696.0000027B46983000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: markiz.exe, 00000000.00000003.2153418967.0000027B46982000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2153560696.0000027B4699B000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2153560696.0000027B46983000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: markiz.exe, 00000000.00000003.2153418967.0000027B46982000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2153560696.0000027B4699B000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2153560696.0000027B46983000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: markiz.exe, 00000000.00000003.2161154860.0000027B46AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: markiz.exe, 00000000.00000003.2160516068.0000027B46A2D000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2160516068.0000027B46A35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: markiz.exe, 00000000.00000003.2160410744.0000027B46AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: markiz.exe, 00000000.00000003.2160410744.0000027B46AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: markiz.exe, 00000000.00000003.2160516068.0000027B46AB0000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2161154860.0000027B46AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: markiz.exe, 00000000.00000003.2153560696.0000027B4699B000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2153639176.0000027B45C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: markiz.exe, 00000000.00000003.2153560696.0000027B4699B000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2153639176.0000027B45C24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: markiz.exe, 00000000.00000003.2158768878.0000027B46FC0000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2160410744.0000027B46AE1000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2157269577.0000027B45EB8000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2160516068.0000027B46A35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: markiz.exe, 00000000.00000003.2160516068.0000027B46A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org#
Source: markiz.exe, 00000000.00000003.2160410744.0000027B46AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: markiz.exe, 00000000.00000003.2160410744.0000027B46AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: markiz.exe, 00000000.00000003.2160410744.0000027B46AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: markiz.exe, 00000000.00000003.2161154860.0000027B46AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:49708 version: TLS 1.2

Source: C:\Users\user\Desktop\markiz.exe

Code function: 0_2_00007FF657475B70 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,EnterCriticalSection,LeaveCriticalSection,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

0_2_00007FF657475B70

System Summary

Malicious sample detected (through community Yara rule)

Source: markiz.exe, type: SAMPLE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 0.0.markiz.exe.7ff6573f0000.0.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 0.2.markiz.exe.7ff6573f0000.0.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io

Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65747A430 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,_invalid_parameter_noinfo_noreturn,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,		0_2_00007FF65747A430
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657479D30 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,		0_2_00007FF657479D30

Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657476860	0_2_00007FF657476860
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF6574776A0	0_2_00007FF6574776A0
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF6574B0658	0_2_00007FF6574B0658
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65741F730	0_2_00007FF65741F730
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF6574AB5B0	0_2_00007FF6574AB5B0
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65742D570	0_2_00007FF65742D570
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65742E610	0_2_00007FF65742E610
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65747C5CB	0_2_00007FF65747C5CB
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657420450	0_2_00007FF657420450
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657456350	0_2_00007FF657456350
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657475240	0_2_00007FF657475240
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657435310	0_2_00007FF657435310
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657478330	0_2_00007FF657478330
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65748918C	0_2_00007FF65748918C
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65745D080	0_2_00007FF65745D080
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF6574220B0	0_2_00007FF6574220B0
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65747D050	0_2_00007FF65747D050
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657439F80	0_2_00007FF657439F80
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65746F020	0_2_00007FF65746F020
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657492E3C	0_2_00007FF657492E3C
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65741FE20	0_2_00007FF65741FE20
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65742ECB0	0_2_00007FF65742ECB0
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657422CA0	0_2_00007FF657422CA0
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657421B90	0_2_00007FF657421B90
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657424B70	0_2_00007FF657424B70
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657475B70	0_2_00007FF657475B70
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657455970	0_2_00007FF657455970
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65742CA10	0_2_00007FF65742CA10
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65748A924	0_2_00007FF65748A924
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF6574298CD	0_2_00007FF6574298CD
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65746C8E0	0_2_00007FF65746C8E0
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65747A780	0_2_00007FF65747A780
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65744B780	0_2_00007FF65744B780
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65748579C	0_2_00007FF65748579C
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657452750	0_2_00007FF657452750
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65748F7E6	0_2_00007FF65748F7E6
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF6574936A8	0_2_00007FF6574936A8
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65748666C	0_2_00007FF65748666C
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657498674	0_2_00007FF657498674
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657444720	0_2_00007FF657444720
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF6574946E4	0_2_00007FF6574946E4
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657485598	0_2_00007FF657485598
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657476540	0_2_00007FF657476540
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF6573F6610	0_2_00007FF6573F6610
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65744B480	0_2_00007FF65744B480
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65749A44F	0_2_00007FF65749A44F
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657416510	0_2_00007FF657416510
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657415520	0_2_00007FF657415520
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF6574914E4	0_2_00007FF6574914E4
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657485394	0_2_00007FF657485394
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF6574663A6	0_2_00007FF6574663A6
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65747A430	0_2_00007FF65747A430
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65746B420	0_2_00007FF65746B420
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65744C420	0_2_00007FF65744C420
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF6574183D0	0_2_00007FF6574183D0
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65749A3C8	0_2_00007FF65749A3C8
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF6574602C0	0_2_00007FF6574602C0
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65746E2F0	0_2_00007FF65746E2F0
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF6573F6180	0_2_00007FF6573F6180
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657483150	0_2_00007FF657483150
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657486164	0_2_00007FF657486164
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657481220	0_2_00007FF657481220
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF6574971D8	0_2_00007FF6574971D8
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65749C128	0_2_00007FF65749C128
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF6574930B8	0_2_00007FF6574930B8
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF6573F70E0	0_2_00007FF6573F70E0
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65744C0F0	0_2_00007FF65744C0F0
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65748F0D8	0_2_00007FF65748F0D8
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65742BF40	0_2_00007FF65742BF40
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF6574AFFBC	0_2_00007FF6574AFFBC
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657470E90	0_2_00007FF657470E90
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657420E80	0_2_00007FF657420E80
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657427E70	0_2_00007FF657427E70
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657465EF0	0_2_00007FF657465EF0
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF6573F5DB0	0_2_00007FF6573F5DB0
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657488D50	0_2_00007FF657488D50
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657464D40	0_2_00007FF657464D40
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65742ADD0	0_2_00007FF65742ADD0
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65744BDD0	0_2_00007FF65744BDD0
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657480D14	0_2_00007FF657480D14
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657447CEB	0_2_00007FF657447CEB
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65749BB90	0_2_00007FF65749BB90
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657420A80	0_2_00007FF657420A80
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65744BAB0	0_2_00007FF65744BAB0
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657465AB0	0_2_00007FF657465AB0
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657496A68	0_2_00007FF657496A68
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657468B00	0_2_00007FF657468B00
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657450AC0	0_2_00007FF657450AC0
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657441AF0	0_2_00007FF657441AF0
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657423A30	0_2_00007FF657423A30

Source: C:\Users\user\Desktop\markiz.exe	Code function: String function: 00007FF65741BA80 appears 32 times
Source: C:\Users\user\Desktop\markiz.exe	Code function: String function: 00007FF6574386B0 appears 54 times
Source: C:\Users\user\Desktop\markiz.exe	Code function: String function: 00007FF657488254 appears 34 times
Source: C:\Users\user\Desktop\markiz.exe	Code function: String function: 00007FF657426940 appears 41 times
Source: C:\Users\user\Desktop\markiz.exe	Code function: String function: 00007FF65741E1D0 appears 33 times

Source: markiz.exe, type: SAMPLE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 0.0.markiz.exe.7ff6573f0000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 0.2.markiz.exe.7ff6573f0000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1

Source: classification engine

Classification label: mal100.troj.spyw.winEXE@1/0@1/2

Source: C:\Users\user\Desktop\markiz.exe

Code function: 0_2_00007FF65747B9B0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,

0_2_00007FF65747B9B0

Source: C:\Users\user\Desktop\markiz.exe

Code function: 0_2_00007FF65742E610 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF65742E610

Source: C:\Users\user\Desktop\markiz.exe

Code function: 0_2_00007FF657464EAC CoCreateInstance,

0_2_00007FF657464EAC

Source: C:\Users\user\Desktop\markiz.exe

Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E69638C5AE7D1

Source: markiz.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\markiz.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: markiz.exe, 00000000.00000003.2156723408.0000027B46AC0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: markiz.exe	ReversingLabs: Detection: 65%
Source: markiz.exe	Virustotal: Detection: 80%

Source: C:\Users\user\Desktop\markiz.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\markiz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\markiz.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: markiz.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: markiz.exe

Static file information: File size 1292800 > 1048576

Source: markiz.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: markiz.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: markiz.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: markiz.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: markiz.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: markiz.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: markiz.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: markiz.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: markiz.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: markiz.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: markiz.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: markiz.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: markiz.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\markiz.exe

Code function: 0_2_00007FF65742D570 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF65742D570

Source: C:\Users\user\Desktop\markiz.exe

Code function: 0_2_00007FF65743CAB2 push rdi; retf 0004h

0_2_00007FF65743CAB5

Source: C:\Users\user\Desktop\markiz.exe

Code function: 0_2_00007FF65746C600 ExitProcess,OpenMutexA,ExitProcess,CreateMutexExA,ExitProcess,ReleaseMutex,CloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF65746C600

Source: C:\Users\user\Desktop\markiz.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\markiz.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-65906

Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF6574AB5B0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		0_2_00007FF6574AB5B0
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF6574AB500 FindClose,FindFirstFileExW,GetLastError,		0_2_00007FF6574AB500

Source: C:\Users\user\Desktop\markiz.exe

Code function: 0_2_00007FF6574773F0 GetLogicalDriveStringsW,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6574773F0

Source: C:\Users\user\Desktop\markiz.exe

Code function: 0_2_00007FF657489038 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

0_2_00007FF657489038

Source: C:\Users\user\Desktop\markiz.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: markiz.exe, 00000000.00000003.2152488246.0000027B43E58000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000002.2361417714.0000027B43E58000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000002.2361417714.0000027B43DDD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: markiz.exe, 00000000.00000002.2361611375.0000027B43E8E000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2170835833.0000027B43E8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-drivers-migration-replacement.mananP\|
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: markiz.exe, 00000000.00000003.2152488246.0000027B43E58000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000002.2361417714.0000027B43E58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWB
Source: markiz.exe, 00000000.00000003.2155028613.0000027B46A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\markiz.exe

API call chain: ExitProcess graph end node

graph_0-65849

Source: C:\Users\user\Desktop\markiz.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\markiz.exe

Code function: 0_2_00007FF65747A430 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,_invalid_parameter_noinfo_noreturn,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,

0_2_00007FF65747A430

Source: C:\Users\user\Desktop\markiz.exe

Code function: 0_2_00007FF6574AD804 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF6574AD804

Source: C:\Users\user\Desktop\markiz.exe

Code function: 0_2_00007FF6574AD804 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF6574AD804

Source: C:\Users\user\Desktop\markiz.exe

0_2_00007FF65742D570

Source: C:\Users\user\Desktop\markiz.exe

Code function: 0_2_00007FF657499EEC GetProcessHeap,

0_2_00007FF657499EEC

Source: C:\Users\user\Desktop\markiz.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF657487F68 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00007FF657487F68
Source: C:\Users\user\Desktop\markiz.exe	Code function: 0_2_00007FF65749EC08 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF65749EC08

Source: C:\Users\user\Desktop\markiz.exe

Code function: 0_2_00007FF65746B420 ShellExecuteW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF65746B420

Source: C:\Users\user\Desktop\markiz.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF65749964C
Source: C:\Users\user\Desktop\markiz.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF657499468
Source: C:\Users\user\Desktop\markiz.exe	Code function: GetLocaleInfoW,	0_2_00007FF657499518
Source: C:\Users\user\Desktop\markiz.exe	Code function: GetLocaleInfoW,	0_2_00007FF657499310
Source: C:\Users\user\Desktop\markiz.exe	Code function: GetLocaleInfoEx,FormatMessageA,	0_2_00007FF6574AB170
Source: C:\Users\user\Desktop\markiz.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF6574990C8
Source: C:\Users\user\Desktop\markiz.exe	Code function: EnumSystemLocalesW,	0_2_00007FF657498F60
Source: C:\Users\user\Desktop\markiz.exe	Code function: EnumSystemLocalesW,	0_2_00007FF657499030
Source: C:\Users\user\Desktop\markiz.exe	Code function: GetLocaleInfoW,	0_2_00007FF65748E020
Source: C:\Users\user\Desktop\markiz.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF657498C04
Source: C:\Users\user\Desktop\markiz.exe	Code function: EnumSystemLocalesW,	0_2_00007FF65748DAE0

Source: C:\Users\user\Desktop\markiz.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\markiz.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\Desktop\markiz.exe

Code function: 0_2_00007FF65749F908 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF65749F908

Source: C:\Users\user\Desktop\markiz.exe

Code function: 0_2_00007FF657476150 GetUserNameW,

0_2_00007FF657476150

Source: C:\Users\user\Desktop\markiz.exe

Code function: 0_2_00007FF6574776A0 GetTimeZoneInformation,

0_2_00007FF6574776A0

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: markiz.exe PID: 3688, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: markiz.exe, type: SAMPLE
Source: Yara match	File source: 0.0.markiz.exe.7ff6573f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.markiz.exe.7ff6573f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: markiz.exe PID: 3688, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: markiz.exe, 00000000.00000002.2361417714.0000027B43DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum\wallets
Source: markiz.exe, 00000000.00000002.2361417714.0000027B43DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\wallets
Source: markiz.exe, 00000000.00000003.2177803521.0000027B48AAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "software": "Ny1aaXAgMjMuMDEgKHg2NCkgWzIzLjAxXQpNb3ppbGxhIEZpcmVmb3ggKHg2NCBlbi1VUykgWzExOC4wLjFdCk1vemlsbGEgTWFpbnRlbmFuY2UgU2VydmljZSBbMTE4LjAuMV0KTWljcm9zb2Z0IE9mZmljZSBQcm9mZXNzaW9uYWwgUGx1cyAyMDE5IC0gZW4tdXMgWzE2LjAuMTY4MjcuMjAxMzBdCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMjIgWDY0IEFkZGl0aW9uYWwgUnVudGltZSAtIDE0LjM2LjMyNTMyIFsxNC4zNi4zMjUzMl0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBMaWNlbnNpbmcgQ29tcG9uZW50IFsxNi4wLjE2ODI3LjIwMTMwXQpPZmZpY2UgMTYgQ2xpY2stdG8tUnVuIEV4dGVuc2liaWxpdHkgQ29tcG9uZW50IDY0LWJpdCBSZWdpc3RyYXRpb24gWzE2LjAuMTY4MjcuMjAwNTZdCkFkb2JlIEFjcm9iYXQgKDY0LWJpdCkgWzIzLjAwNi4yMDMyMF0KTWljcm9zb2Z0IFZpc3VhbCBDKysgMjAyMiBYNjQgTWluaW11bSBSdW50aW1lIC0gMTQuMzYuMzI1MzIgWzE0LjM2LjMyNTMyXQpHb29nbGUgQ2hyb21lIFsxMTcuMC41OTM4LjEzNF0KTWljcm9zb2Z0IEVkZ2UgWzExNy4wLjIwNDUuNTVdCk1pY3Jvc29mdCBFZGdlIFVwZGF0ZSBbMS4zLjE3Ny4xMV0KTWljcm9zb2Z0IEVkZ2UgV2ViVmlldzIgUnVudGltZSBbMTE3LjAuMjA0NS40N10KSmF2YSBBdXRvIFVwZGF0ZXIgWzIuOC4zODEuOV0KSmF2YSA4IFVwZGF0ZSAzODEgWzguMC4zODEwLjldCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMTUtMjAyMiBSZWRpc3RyaWJ1dGFibGUgKHg2NCkgLSAxNC4zNi4zMjUzMiBbMTQuMzYuMzI1MzIuMF0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBFeHRlbnNpYmlsaXR5IENvbXBvbmVudCBbMTYuMC4xNjgyNy4yMDEzMF0K",
Source: markiz.exe, 00000000.00000002.2361417714.0000027B43DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: markiz.exe, 00000000.00000002.2361417714.0000027B43DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: markiz.exe, 00000000.00000002.2361417714.0000027B43DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\markiz.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\markiz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\markiz.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\markiz.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: markiz.exe PID: 3688, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: markiz.exe, type: SAMPLE
Source: Yara match	File source: 0.0.markiz.exe.7ff6573f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.markiz.exe.7ff6573f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: markiz.exe PID: 3688, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Access Token Manipulation	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Query Registry	Remote Desktop Protocol	1 Email Collection	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	2 Obfuscated Files or Information	Security Account Manager	31 Security Software Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	2 Process Discovery	Distributed Component Object Model	2 Data from Local System	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Account Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	3 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	24 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
markiz.exe	66%	ReversingLabs	Win64.Trojan.MeduzaStealer
markiz.exe	81%	Virustotal		Browse
markiz.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.13.205	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://ac.ecosia.org/autocomplete?q=	markiz.exe, 00000000.00000003.2153560696.0000027B4699B000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2153639176.0000027B45C24000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.ipify.org/b	markiz.exe, 00000000.00000003.2152488246.0000027B43E3B000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000002.2361417714.0000027B43E20000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	markiz.exe, 00000000.00000003.2153418967.0000027B46982000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2153560696.0000027B4699B000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2153560696.0000027B46983000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	markiz.exe, 00000000.00000003.2153418967.0000027B46982000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2153560696.0000027B4699B000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2153560696.0000027B46983000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	markiz.exe, 00000000.00000003.2153560696.0000027B4699B000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2153639176.0000027B45C24000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	markiz.exe, 00000000.00000003.2160410744.0000027B46AE9000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	markiz.exe, 00000000.00000003.2160516068.0000027B46AB0000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2161154860.0000027B46AB1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	markiz.exe, 00000000.00000003.2161154860.0000027B46AB1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	markiz.exe, 00000000.00000003.2153560696.0000027B4699B000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2153639176.0000027B45C24000.00000004.00000020.00020000.00000000.sdmp	false	high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	markiz.exe, 00000000.00000003.2161154860.0000027B46AB1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	markiz.exe, 00000000.00000003.2160516068.0000027B46AB0000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2161154860.0000027B46AB1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	markiz.exe, 00000000.00000003.2153418967.0000027B46982000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2153560696.0000027B4699B000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2153560696.0000027B46983000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	markiz.exe, 00000000.00000003.2153560696.0000027B4699B000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2153639176.0000027B45C24000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org	markiz.exe, 00000000.00000003.2160516068.0000027B46A2D000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2160516068.0000027B46A35000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	markiz.exe, 00000000.00000003.2153560696.0000027B4699B000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2153639176.0000027B45C24000.00000004.00000020.00020000.00000000.sdmp	false	high
http://ns.microsoft.t/Regi	markiz.exe, 00000000.00000003.2360887292.0000027B45C70000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2151933457.0000027B45C61000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2360985704.0000027B45C74000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2360913678.0000027B45C70000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	markiz.exe, 00000000.00000003.2161154860.0000027B46AB1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	markiz.exe, 00000000.00000003.2153560696.0000027B4699B000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2153639176.0000027B45C24000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	markiz.exe, 00000000.00000003.2160410744.0000027B46AE9000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	markiz.exe, 00000000.00000003.2161154860.0000027B46AB1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	markiz.exe, 00000000.00000003.2160516068.0000027B46AB0000.00000004.00000020.00020000.00000000.sdmp, markiz.exe, 00000000.00000003.2161154860.0000027B46AB1000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
193.3.19.151	unknown	Denmark		2107	ARNES-NETAcademicandResearchNetworkofSloveniaSI	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581172
Start date and time:	2024-12-27 06:51:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	markiz.exe
Detection:	MAL
Classification:	mal100.troj.spyw.winEXE@1/0@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 92 Number of non-executed functions: 91
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.175.87.197, 20.109.210.53
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.13.205	BiXS3FRoLe.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	lEUy79aLAW.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	Simple1.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
193.3.19.151	utkin.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	iviewers.dll	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	script.ps1	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	script.hta	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	duschno.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	1Sj5F6P4nv.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	5LEXIucyEP.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	44qLDKzsfO.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	gP5rh6fa0S.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	urkOkB0BdX.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	utkin.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	https://www.canva.com/design/DAGaHpv1g1M/bVE7B2sT8b8T3P-e2xb64w/view?utm_content=DAGaHpv1g1M&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=h1ee3678e45	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	https://mandrillapp.com/track/click/30363981/app.salesforceiq.com?p=eyJzIjoiQ21jNldfVTIxTkdJZi1NQzQ1SGE3SXJFTW1RIiwidiI6MSwicCI6IntcInVcIjozMDM2Mzk4MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2FwcC5zYWxlc2ZvcmNlaXEuY29tXFxcL3I_dD1BRndoWmYwNjV0QlFRSnRiMVFmd1A1dC0tMHZnQkowaF9lYklFcTVLRlhTWHFVWmFpNUo4RlFTd1dycTkzR1FPbEFuczlLREd2VzRJQ2Z2eGo4WjVDSkQxUTlXdDVvME5XNWMwY0tIaXpVQWJ1YnBhT2dtS2pjVkxkaDFZWE8ybklsdFRlb2VQZ2dVTCZ0YXJnZXQ9NjMxZjQyMGVlZDEzY2EzYmNmNzdjMzI0JnVybD1odHRwczpcXFwvXFxcL21haW4uZDNxczBuMG9xdjNnN28uYW1wbGlmeWFwcC5jb21cIixcImlkXCI6XCI5ZTdkODJiNWQ0NzA0YWVhYTQ1ZjkxY2Y0ZTFmNGRiMFwiLFwidXJsX2lkc1wiOltcImY5ODQ5NWVhMjMyYTgzNjg1ODUxN2Y4ZTRiOTVjZjg4MWZlODExNmJcIl19In0	Get hash	malicious	Unknown	Browse	104.26.12.205
	Ref#20203216.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	tg.exe	Get hash	malicious	Babadeda	Browse	172.67.74.152
	tg.exe	Get hash	malicious	Babadeda	Browse	104.26.12.205
	setup.exe	Get hash	malicious	Babadeda	Browse	104.26.13.205
	QUOTATION#008792.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	c9toH15OT0.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	https://www.canva.com/design/DAGZxEJMIA0/pFi0b1a1Y78oAGDuII8Hjg/view?utm_content=DAGZxEJMIA0&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=hdcdec8ed4a	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ARNES-NETAcademicandResearchNetworkofSloveniaSI	utkin.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	193.3.19.151
	armv7l.elf	Get hash	malicious	Unknown	Browse	149.62.103.197
	iviewers.dll	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	193.3.19.151
	script.ps1	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	193.3.19.151
	script.hta	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	193.3.19.151
	https://img10.reactor.cc/pics/post/full/Sakimichan-artist-Iono-(Pokemon)-Pok%c3%a9mon-7823638.jpeg	Get hash	malicious	HTMLPhisher	Browse	193.3.184.24
	bot.sh4.elf	Get hash	malicious	Mirai	Browse	95.87.151.57
	duschno.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	193.3.19.151
	jade.arm.elf	Get hash	malicious	Mirai	Browse	95.87.151.72
	https://u48551708.ct.sendgrid.net/ls/click?upn=u001.ztPEaTmy8WofhPYJ48HDSCunUq5pm5yTGRhe-2B0bVSngC8hMYiy6PgMy1xJOG8JJZaOsK-2FG9SE7UmhEzeQSXDmEf7Z3nlXZDH-2BW1HSMP6c8uYUvXDTaJRyLbPDV6bI3nnDyIlM0OJKevMwAF04rpfLmQEYS641NQTMU227kkOtBQgQK-2FNlHeN6DpPMLDgH6kuMS3X_2vbC1nrAFjePip8HYuHYOlkYXiy7Z-2FrO9MQN7lNoEgxRkovUJGAEvKvTFyRmFsa9AQlcDpFhpJzgHajMOC0yWTZOc2DdmxhrlyPvteyXbl8nlhAtf2p-2FHw4RnlZ8cxDY-2BWJeBsszGnsrXuNOI8LpL5ZYI3ad04OdxC8tHHA5tO-2Be1xS3Z9Z3VrOTM-2FT5ptoYnx5N-2FTYKQ13RZ-2FookVMhAtJ6OV43Zayd1qOmHGLwUI8-3D	Get hash	malicious	Phisher	Browse	193.3.19.55
CLOUDFLARENETUS	utkin.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	0Gs0WEGB1E.dll	Get hash	malicious	Unknown	Browse	104.21.22.88
	Bootstrapper.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	NewI Upd v1.1.0.exe	Get hash	malicious	LummaC	Browse	172.67.190.223
	setup.exe	Get hash	malicious	LummaC	Browse	172.67.197.192
	exlauncher-unpadded.exe	Get hash	malicious	LummaC	Browse	172.67.218.163
	http://kxyaiaqyijjz.com	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://pdf-ezy.com/pdf-ez.exe	Get hash	malicious	Unknown	Browse	172.67.152.3
	b8ygJBG5cb.msi	Get hash	malicious	Unknown	Browse	172.67.194.29
	tBnELFfQoe.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.49.159

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	utkin.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	script.ps1	Get hash	malicious	Vidar	Browse	104.26.13.205
	libcurl.dll	Get hash	malicious	Matanbuchus	Browse	104.26.13.205
	b8ygJBG5cb.msi	Get hash	malicious	Unknown	Browse	104.26.13.205
	setup.msi	Get hash	malicious	Unknown	Browse	104.26.13.205
	installer.msi	Get hash	malicious	Unknown	Browse	104.26.13.205
	setup.msi	Get hash	malicious	Unknown	Browse	104.26.13.205
	setup.msi	Get hash	malicious	Unknown	Browse	104.26.13.205
	HVlonDQpuI.exe	Get hash	malicious	Vidar	Browse	104.26.13.205
	00000.ps1	Get hash	malicious	LummaC	Browse	104.26.13.205

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.5194700162765065
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	markiz.exe
File size:	1'292'800 bytes
MD5:	bee040fc0caf73ee0cb2e55d4c703f22
SHA1:	6bf7f1fa9dcf930190cabfba9abde2e7faab486f
SHA256:	940d413dd95bc28d5c724d814f2cd1ecca005d2cb58ed28788d9c07d962d829b
SHA512:	ec45afc4a8626dc813462a3c65b57a75f96233e9e66a0d9d60953fa2e29ec1a1c48c9ccf00f8f0e0ad3ff37e8c98c673c5b2309ff77475896ec57897d73551b2
SSDEEP:	24576:cgAMXnXkciEIMJQZo8Us9Mjemp5wx1wach0lhSMXl52T+d:93Xn0ciEIpVUs+egSx+ahp2TK
TLSH:	0E555B65195C03E9D8BE9138DEAB8A12F575380903B1E7EB1AD147921FE37E09E3E350
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.7./.d./.d./.d.W.e./.d.W.e./.d...e./.d...e./.d...e./.d...e./.d.W.e8/.d.W.e./.d.W.e./.d./.d...d.W.e./.d...e./.d..>d./.d...e./.

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x1400af220
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x673B37C9 [Mon Nov 18 12:49:13 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	0095cfee1cdfcef936c4c086b6b4fe85

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FD1C4C13F04h
dec eax
add esp, 28h
jmp 00007FD1C4C1369Fh
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007FD1C4C13832h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007FD1C4C13835h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007FD1C4C1382Dh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007FD1C4C12DD6h
int3
and dword ptr [00087639h], 00000000h
ret
dec eax
mov dword ptr [esp+08h], ebx
push ebp
dec eax
lea ebp, dword ptr [esp-000004C0h]
dec eax
sub esp, 000005C0h
mov ebx, ecx
mov ecx, 00000017h
call dword ptr [0002600Eh]
test eax, eax
je 00007FD1C4C13826h
mov ecx, ebx
int 29h
mov ecx, 00000003h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x12df68	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x13f000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x138000	0x6c18	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x140000	0xd3c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1183d0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x118580	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x118290	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xd5000	0x778	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xd3290	0xd3400	02791cb7ba7e7627bc88a6fe8fe73e90	False	0.416954049556213	zlib compressed data	6.321953964908784	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xd5000	0x5a878	0x5aa00	5be222c8447034affdfd0fa2d06d6c0d	False	0.4009321120689655	data	6.307004936091381	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x130000	0x7ce4	0x5a00	6bc2f26b443764d2872d13f9d896878b	False	0.08211805555555556	data	4.536476287471787	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x138000	0x6c18	0x6e00	c6eecc837e87b0c200a192a62ab8b009	False	0.4799715909090909	data	5.967062390694732	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x13f000	0x1e0	0x200	3bdf73d69c827b52e4eecca5ab7e253d	False	0.533203125	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x140000	0xd3c	0xe00	04965a7aa6d79975008713ed9311fed1	False	0.48604910714285715	data	5.341340137514453	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x13f060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
WS2_32.dll	closesocket, inet_pton, WSAStartup, send, socket, connect, recv, WSACleanup, htons
CRYPT32.dll	CryptUnprotectData, CryptProtectData
WININET.dll	InternetOpenW, InternetCloseHandle, InternetReadFile, InternetQueryDataAvailable, HttpQueryInfoW, InternetOpenUrlA, InternetOpenA
ntdll.dll	NtQuerySystemInformation, RtlInitUnicodeString, LdrEnumerateLoadedModules, RtlAcquirePebLock, RtlReleasePebLock, NtQueryObject, NtAllocateVirtualMemory
RstrtMgr.DLL	RmGetList, RmStartSession, RmEndSession, RmRegisterResources
bcrypt.dll	BCryptCloseAlgorithmProvider, BCryptOpenAlgorithmProvider, BCryptDecrypt, BCryptDestroyKey, BCryptGenerateSymmetricKey, BCryptSetProperty
KERNEL32.dll	GetFileInformationByHandleEx, AreFileApisANSI, FindFirstFileW, FindNextFileW, FindClose, OpenProcess, CreateToolhelp32Snapshot, Process32NextW, LoadLibraryA, Process32FirstW, CloseHandle, GetSystemInfo, GetProcAddress, LocalFree, FreeLibrary, GetLastError, ExitProcess, MultiByteToWideChar, WideCharToMultiByte, VirtualAlloc, ReadFile, WriteFile, CreateFileW, GetFileSize, GetCurrentProcess, VirtualQuery, GetStdHandle, TerminateProcess, CreateMutexA, ReleaseMutex, OpenMutexA, GetModuleFileNameA, GetVolumeInformationW, GetGeoInfoA, HeapFree, EnterCriticalSection, GetModuleFileNameW, GetProcessId, LeaveCriticalSection, SetFilePointer, InitializeCriticalSectionEx, FreeEnvironmentStringsW, GetModuleHandleA, HeapSize, GetLogicalDriveStringsW, GetFinalPathNameByHandleA, GetTimeZoneInformation, lstrcatW, HeapReAlloc, HeapAlloc, GetComputerNameW, GetProcessHeap, GlobalMemoryStatusEx, GetModuleHandleW, lstrcpyW, GetEnvironmentStringsW, SetLastError, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetSystemTimeAsFileTime, VirtualProtect, GetFileSizeEx, SetFilePointerEx, GetCurrentThreadId, GetFileType, GetStartupInfoW, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, GetTempPathW, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, InitializeCriticalSectionAndSpinCount, LoadLibraryExW, GetDateFormatW, GetTimeFormatW, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, SetEndOfFile, EnumSystemLocalesW, ReadConsoleW, RaiseException, GetModuleHandleExW, SetStdHandle, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetStringTypeW, WriteConsoleW, OutputDebugStringW, SetEnvironmentVariableW, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, WakeAllConditionVariable, SleepConditionVariableSRW, QueryPerformanceCounter, InitializeSListHead, RtlUnwindEx, RtlUnwind, RtlPcToFileHeader, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetFileAttributesExW, GetFileAttributesW, FindFirstFileExW, GetCurrentDirectoryW, GetNativeSystemInfo, LCMapStringEx, CompareStringEx, DecodePointer, DeleteCriticalSection, GetCommandLineA, GetCommandLineW, GetUserGeoID, GetUserDefaultLCID, GetLocaleInfoEx, FormatMessageA
USER32.dll	GetWindowRect, ReleaseDC, GetDesktopWindow, EnumDisplayDevicesW, GetSystemMetrics, GetDC
GDI32.dll	BitBlt, CreateCompatibleBitmap, SelectObject, CreateCompatibleDC, GetDeviceCaps, DeleteDC, GetObjectW, DeleteObject
ADVAPI32.dll	LookupPrivilegeValueW, AdjustTokenPrivileges, GetCurrentHwProfileW, RegCloseKey, RegGetValueA, RegQueryValueExA, RegOpenKeyExA, GetUserNameW, RegEnumKeyExA, RevertToSelf, ConvertSidToStringSidA, ImpersonateLoggedOnUser, OpenProcessToken, DuplicateTokenEx, GetTokenInformation, CredEnumerateA, CredFree
SHELL32.dll	SHGetKnownFolderPath, ShellExecuteW
ole32.dll	CoTaskMemFree, CoGetObject, CoCreateInstance, CoUninitialize, CoSetProxyBlanket, CoInitializeSecurity, CoInitializeEx
OLEAUT32.dll	SysStringByteLen, SysAllocStringByteLen, SysFreeString
SHLWAPI.dll
gdiplus.dll	GdipGetImageEncodersSize, GdipFree, GdipDisposeImage, GdiplusShutdown, GdiplusStartup, GdipCloneImage, GdipAlloc, GdipCreateBitmapFromScan0, GdipCreateBitmapFromHBITMAP, GdipSaveImageToStream, GdipGetImageEncoders

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T06:52:07.770868+0100	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.6	49707	193.3.19.151	15666	TCP
2024-12-27T06:52:07.770868+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.6	49707	193.3.19.151	15666	TCP
2024-12-27T06:52:07.770868+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.6	49707	193.3.19.151	15666	TCP
2024-12-27T06:52:07.890721+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.6	49707	193.3.19.151	15666	TCP
2024-12-27T06:52:07.890721+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.6	49707	193.3.19.151	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 06:52:01.876081944 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:02.364177942 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:02.364306927 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:03.125684023 CET	49708	443	192.168.2.6	104.26.13.205
Dec 27, 2024 06:52:03.125720024 CET	443	49708	104.26.13.205	192.168.2.6
Dec 27, 2024 06:52:03.125807047 CET	49708	443	192.168.2.6	104.26.13.205
Dec 27, 2024 06:52:03.164963961 CET	49708	443	192.168.2.6	104.26.13.205
Dec 27, 2024 06:52:03.165010929 CET	443	49708	104.26.13.205	192.168.2.6
Dec 27, 2024 06:52:04.427119970 CET	443	49708	104.26.13.205	192.168.2.6
Dec 27, 2024 06:52:04.427370071 CET	49708	443	192.168.2.6	104.26.13.205
Dec 27, 2024 06:52:04.503886938 CET	49708	443	192.168.2.6	104.26.13.205
Dec 27, 2024 06:52:04.503911018 CET	443	49708	104.26.13.205	192.168.2.6
Dec 27, 2024 06:52:04.504189014 CET	443	49708	104.26.13.205	192.168.2.6
Dec 27, 2024 06:52:04.504247904 CET	49708	443	192.168.2.6	104.26.13.205
Dec 27, 2024 06:52:04.505527973 CET	49708	443	192.168.2.6	104.26.13.205
Dec 27, 2024 06:52:04.551330090 CET	443	49708	104.26.13.205	192.168.2.6
Dec 27, 2024 06:52:04.875830889 CET	443	49708	104.26.13.205	192.168.2.6
Dec 27, 2024 06:52:04.875889063 CET	443	49708	104.26.13.205	192.168.2.6
Dec 27, 2024 06:52:04.875909090 CET	49708	443	192.168.2.6	104.26.13.205
Dec 27, 2024 06:52:04.875940084 CET	49708	443	192.168.2.6	104.26.13.205
Dec 27, 2024 06:52:04.876257896 CET	49708	443	192.168.2.6	104.26.13.205
Dec 27, 2024 06:52:04.876280069 CET	443	49708	104.26.13.205	192.168.2.6
Dec 27, 2024 06:52:07.770868063 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:07.890585899 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:07.890597105 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:07.890624046 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:07.890685081 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:07.890721083 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:07.890742064 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:07.890752077 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:07.890795946 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:07.890798092 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:07.890821934 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:07.890897036 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:07.890908003 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:07.890909910 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:07.891006947 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.010524988 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.010566950 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.010581017 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.010593891 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.010633945 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.010662079 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.010756969 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.010842085 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.011082888 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.011159897 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.130496025 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.130570889 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.130623102 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.130629063 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.130682945 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.130790949 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.130841017 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.130872011 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.130943060 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.131037951 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.131095886 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.131102085 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.131176949 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.131278038 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.131330967 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.131433964 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.131479979 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.131488085 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.131537914 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.131587982 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.131622076 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.131655931 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.131691933 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.131750107 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.131781101 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.131827116 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.131836891 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.131889105 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.131895065 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.131942987 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.131988049 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.132019997 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.132052898 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.132066011 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.132107973 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.132139921 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.132154942 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.132186890 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.132236004 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.132267952 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.132322073 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.132359982 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.132389069 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.132421970 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.132464886 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.250929117 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.250988007 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.250998020 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.251085043 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.251107931 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.251120090 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.251168966 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.251179934 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.251182079 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.251194000 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.251266003 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.251527071 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.251537085 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.251545906 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.251554966 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.251564026 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.251574993 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.251588106 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.251594067 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.251605034 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.251616955 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.251657963 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.251688004 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.251698017 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.251754045 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.251754999 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.251765966 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.251822948 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.251847029 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.251856089 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.251929045 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.251930952 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.251941919 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.251982927 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.278214931 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.278291941 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.278316021 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.278326035 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.278368950 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.278563976 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.278614044 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.278614044 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.278666973 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.278677940 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.278687954 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.278728008 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.278747082 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.278770924 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.278882027 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.278899908 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.278979063 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.278989077 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.279000044 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.279032946 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.279073000 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.279092073 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.279167891 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.279184103 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.279191017 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.279233932 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.279248953 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.279309034 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.279320955 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.279360056 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.279381990 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.279395103 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.279449940 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.279467106 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.279478073 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.279512882 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.279606104 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.279652119 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.279654980 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.279668093 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.279731035 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.279736042 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.279743910 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.279768944 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.279802084 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.279830933 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.279875994 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.279877901 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.279915094 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.279926062 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.279938936 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.279985905 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.280020952 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.280030966 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.280073881 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.280081034 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.280092001 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.280149937 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.280225039 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.280235052 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.280244112 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.280252934 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.280265093 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.280301094 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.280303955 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.280349970 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.280379057 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.280389071 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.280421972 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.280427933 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.280467033 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.310162067 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.312724113 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.398399115 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.398411036 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.398453951 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.398463964 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.398471117 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.398514032 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.398534060 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.398544073 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.398613930 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.398624897 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.398633957 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.398663044 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.398698092 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.398732901 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.398745060 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.398787022 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.398801088 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.398859978 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.398880005 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.398909092 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.398919106 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.398926973 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.398967028 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.398998976 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.399025917 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.399066925 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.399075031 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.399111032 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.399152040 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.399163961 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.399205923 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.399230003 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.399241924 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.399279118 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.399291992 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.399338961 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.399374962 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.399384975 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.399405003 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.399425983 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.399449110 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.399451017 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.399503946 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.399513960 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.399521112 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.399558067 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.399594069 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.399630070 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.399646997 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.399681091 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.399691105 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.399698019 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.399723053 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.399730921 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.399776936 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.399821997 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.399825096 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.399857044 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.399924994 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.399935007 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.399934053 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.399987936 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.400022984 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.400032997 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.400063038 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.400070906 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.400109053 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.400158882 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.400188923 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.400199890 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.400223970 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.400234938 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.400263071 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.400299072 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.400316954 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.400374889 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.400391102 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.400454998 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.400487900 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.400500059 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.400507927 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.400532007 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.400592089 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.400604963 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.400615931 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.400619984 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.400671959 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.429513931 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.429523945 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.429595947 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.429605961 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.429605961 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.429637909 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.429656982 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.429678917 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.429713011 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.429719925 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.429745913 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.429753065 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.429789066 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.434699059 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.434716940 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.434765100 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.434771061 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.434808969 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.434828043 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.434834957 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.434851885 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.434860945 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.434878111 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.434886932 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.434926033 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.435024977 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.435127974 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.435177088 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.435187101 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.435190916 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.435234070 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.435297966 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.435307980 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.435321093 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.435331106 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.435342073 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.435357094 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.435375929 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.435383081 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.435394049 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.435415983 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.435426950 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.435446024 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.435471058 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.435493946 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.435523987 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.435568094 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.435647964 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.435658932 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.435681105 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.435692072 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.435693979 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.435776949 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.435776949 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.435790062 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.435813904 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.435827971 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.435828924 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.435879946 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.435882092 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.435945034 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.435955048 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.436002970 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.436005116 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.436016083 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.436068058 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.436171055 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.436180115 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.436183929 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.436187029 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.436213017 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.436222076 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.436239004 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.436269999 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.436271906 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.436279058 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.436316013 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.436386108 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.436395884 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.436430931 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.436461926 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.436471939 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.436532021 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.436559916 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.436572075 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.436611891 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.436615944 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.436640978 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.436680079 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.436686993 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.436731100 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.436780930 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.436803102 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.436861038 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.436870098 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.436913967 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.437525988 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.438536882 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.517910957 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.518017054 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.518028975 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.518039942 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.518090010 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.518109083 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.518173933 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.518176079 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.518183947 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.518260956 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.518275023 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.518284082 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.518332005 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.518343925 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.518372059 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.518423080 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.518460035 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.518469095 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.518531084 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.518537045 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.518541098 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.518584013 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.518610954 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.518620968 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.518667936 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.518678904 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.518707037 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.518748999 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.518768072 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.518799067 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.518852949 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.518888950 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.518898964 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.518930912 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.518961906 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.518975973 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.519018888 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.519041061 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.519129038 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.519140959 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.519172907 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.519217014 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.519259930 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.519269943 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.519305944 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.519332886 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.519344091 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.519383907 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.519468069 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.519476891 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.519526958 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.519562960 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.519572973 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.519597054 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.519608021 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.519640923 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.519699097 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.519715071 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.519751072 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.519805908 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.519823074 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.519836903 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.519870043 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.519886017 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.519897938 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.519958973 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.519978046 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.520021915 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.520066023 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.520067930 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.520096064 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.520131111 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.520149946 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.520162106 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.520198107 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.520250082 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.520261049 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.520289898 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.520332098 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.520343065 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.520427942 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.520440102 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.520451069 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.520486116 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.520505905 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.520520926 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.520530939 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.520558119 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.520584106 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.520643950 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.520653963 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.520663023 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.520701885 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.520735025 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.520746946 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.520756960 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.520766020 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.520783901 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.520816088 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.520832062 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.520878077 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.549189091 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.549225092 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.549287081 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.549290895 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.549336910 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.549346924 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.549384117 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.549392939 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.549444914 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.549494028 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.549501896 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.549535990 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.549542904 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.549560070 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.549607038 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.554305077 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.554358959 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.554378986 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.554395914 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.554408073 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.554414034 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.554441929 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.554461956 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.554477930 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.554490089 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.554546118 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.554562092 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.554598093 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.554656029 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.554672956 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.554733038 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.554757118 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.554765940 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.554794073 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.554805040 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.554919004 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.554930925 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.554960012 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.554995060 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.555010080 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.555022001 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.555071115 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.555099964 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.555109978 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.555141926 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.555223942 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.555238962 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.555248976 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.555268049 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.555298090 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.555299997 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.555341959 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.555356026 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.555397987 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.555401087 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.555460930 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.555512905 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.555541992 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.555567026 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.555598974 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.555617094 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.555671930 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.555692911 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.555702925 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.555740118 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.555804014 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.555816889 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.555839062 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.555847883 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.555864096 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.555888891 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.555917025 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.555927038 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.556011915 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.556021929 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.556051970 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.556123018 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.556132078 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.556164026 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.556164980 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.556175947 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.556221008 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.556243896 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.556284904 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.556299925 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.556384087 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.556392908 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.556467056 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.556488991 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.556498051 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.556519032 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.556526899 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.556551933 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.556571960 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.556608915 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.556617975 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.556659937 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.556682110 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.556727886 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.556735992 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.556791067 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.556811094 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.556859016 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.556863070 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.556869984 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.556927919 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.556967974 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.556977987 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.557017088 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.557025909 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.557039022 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.557071924 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.557126999 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.557136059 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.557185888 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.557981968 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.558051109 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.637579918 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.637656927 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.637677908 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.637747049 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.637778044 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.637825966 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.637840033 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.637849092 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.637861967 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.637942076 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.637947083 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.637952089 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.638010979 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.638052940 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.638108015 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.638113976 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.638118982 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.638128042 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.638168097 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.638184071 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.638194084 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.638262033 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.638267040 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.638281107 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.638339996 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.638341904 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.638354063 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.638392925 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.638415098 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.638525009 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.638534069 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.638549089 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.638559103 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.638576984 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.638597012 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.638607979 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.638607979 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.638650894 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.638664007 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.638684988 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.638746977 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.638780117 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.638791084 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.638869047 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.638869047 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.638880014 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.638947964 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.638983965 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.638993979 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.639020920 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.639043093 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.639075994 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.639117002 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.639179945 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.639190912 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.639251947 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.639254093 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.639285088 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.639333963 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.639373064 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.639389992 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.639451981 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.639507055 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.639518976 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.639555931 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.639621019 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.639631987 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.639703989 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.639719963 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.639729977 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.639756918 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.639767885 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.639897108 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.639906883 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.639926910 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.639954090 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.639971972 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.639981031 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.639991045 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.640064001 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.640081882 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.640099049 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.640120029 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.640181065 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.640203953 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.640213013 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.640275002 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.640280962 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.640294075 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.640347958 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.640363932 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.640373945 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.640449047 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.640460968 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.640470982 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.640508890 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.640530109 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.640551090 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.640589952 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.640633106 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.640642881 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.640676022 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.640681982 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.640693903 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.640738010 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.640768051 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.640785933 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.640836000 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.640877962 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.640914917 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.640964985 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.640966892 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.640995026 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.641058922 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.641061068 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.641067982 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.641145945 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.641149044 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.641155958 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.641194105 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.641205072 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.641228914 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.641315937 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.668853045 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.668864012 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.668950081 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.668960094 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.668970108 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.668981075 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.668978930 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.669028997 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.669040918 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.669048071 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.669054031 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.669087887 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.669110060 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.669125080 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.669186115 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.669197083 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.669198036 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.669253111 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.669275045 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.672772884 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.673825026 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.673875093 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.673907042 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.673944950 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.673978090 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.674007893 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.674021959 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.674024105 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.674065113 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.674113989 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.674125910 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.674177885 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.674199104 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.674257040 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.674336910 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.674355984 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.674401999 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.674426079 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.674429893 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.674479008 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.674567938 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.674577951 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.674622059 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.674650908 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.674681902 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.674700975 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.674841881 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.674851894 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.674875975 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.674911976 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.674921036 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.674925089 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.674998999 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.675004959 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.675015926 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.675059080 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.675064087 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.675076962 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.675121069 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.675122976 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.675137043 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.675179958 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.675214052 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.675225019 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.675276041 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.675323963 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.675334930 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.675370932 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.675409079 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.675419092 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.675450087 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.675474882 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.675476074 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.675530910 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.675568104 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.675616980 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.675666094 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.675700903 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.675746918 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.675759077 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.675786972 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.675848961 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.675856113 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.675875902 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.675904989 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.675944090 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.675964117 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.675988913 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.676018953 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.676040888 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.676069021 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.676076889 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.676143885 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.676172018 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.676187992 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.676196098 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.676263094 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.676273108 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.676331043 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.676332951 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.676374912 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.676386118 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.676419973 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.676430941 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.676474094 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.676480055 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.676516056 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.676538944 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.676561117 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.676563025 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.676599979 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.676605940 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.676685095 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.676696062 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.676747084 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.676788092 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.676799059 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.676851988 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.676867962 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.676883936 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.676934004 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.676965952 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.676979065 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.677025080 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.677036047 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.677047014 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.677083969 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.677225113 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.677234888 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.677243948 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.677256107 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.677259922 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.677268982 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.677289009 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.677305937 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.682524920 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.684750080 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.757402897 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.757415056 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.757426023 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.757554054 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.757672071 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.757692099 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.757704020 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.757725000 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.757735968 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.757749081 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.757750988 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.757767916 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.757771015 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.757787943 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.757827044 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.757838011 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.757843971 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.757888079 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.757908106 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.757919073 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.757997990 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.757999897 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.758013010 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.758061886 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.758106947 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.758119106 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.758177996 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.758194923 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.758205891 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.758261919 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.758296013 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.758307934 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.758357048 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.758374929 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.758397102 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.758434057 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.758457899 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.758470058 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.758471012 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.758510113 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.758527040 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.758555889 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.758610010 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.758658886 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.758668900 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.758711100 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.758752108 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.758763075 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.758791924 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.758800983 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.758826017 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.758908987 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.758919954 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.758929968 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.759005070 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.759013891 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.759033918 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.759088993 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.759129047 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.759139061 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.759182930 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.759206057 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.759222031 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.759265900 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.759310961 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.759330988 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.759380102 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.759392977 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.759428024 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.759459972 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.759493113 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.759536982 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.759545088 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.759607077 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.759676933 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.759676933 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.759706020 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.759738922 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.759754896 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.759757042 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.759773970 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.759804964 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.759856939 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.759876013 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.759922028 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.759968042 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.759979010 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.760076046 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.760087013 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.760113001 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.760139942 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.760173082 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.760184050 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.760221958 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.760241032 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.760245085 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.760308981 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.760358095 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.760368109 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.760420084 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.760430098 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.760442972 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.760482073 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.760560036 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.760576010 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.760601997 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.760612011 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.760632992 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.760665894 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.760699987 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.760711908 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.760742903 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.760747910 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.760754108 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.760822058 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.760854959 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.760865927 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.760904074 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.760953903 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.760965109 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.761008978 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.761013985 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.761025906 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.761082888 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.761122942 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.761132956 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.761167049 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.761168957 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.761178970 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.761219025 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.761230946 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.761317015 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.761327982 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.761374950 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.761408091 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.761425972 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.761434078 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.761464119 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.761476040 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.761485100 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.761496067 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.761547089 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.788515091 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.788527012 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.788609028 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.788620949 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.788615942 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.788688898 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.788717985 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.788727999 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.788759947 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.788784027 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.788855076 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.788896084 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.789012909 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.789022923 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.789052010 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.789108038 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.789129019 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.789164066 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.789165020 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.789247036 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.792218924 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.792279005 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.794907093 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.794926882 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.794982910 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.795022964 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.795033932 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.795059919 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.795073986 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.795103073 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.795144081 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.795218945 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.795228958 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.795248032 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.795258045 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.795273066 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.795289993 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.795327902 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.795366049 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.795377970 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.795411110 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.795454025 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.795475006 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.795519114 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.795555115 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.795567989 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.795614004 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.795644045 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.796700954 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.798839092 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.798882961 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.798904896 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.798913956 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.798935890 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.799096107 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.799146891 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.799195051 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.799226999 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.799263954 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.799917936 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.799928904 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.799973965 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.800195932 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.800206900 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.800241947 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.800273895 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.800745010 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.801232100 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.801243067 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.801279068 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.801584959 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.801616907 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.801668882 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.801707029 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.801717997 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.801752090 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.801753998 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.801768064 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.801805973 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.801884890 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.801896095 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.801904917 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.801918030 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.801928043 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.801948071 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.801963091 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.801980972 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.801997900 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.802037001 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.802069902 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.802082062 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.802117109 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.802181959 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.802196980 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.802246094 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.802248001 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.802261114 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.802297115 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.802325964 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.802337885 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.802365065 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.802385092 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.802412987 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.802413940 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.802448988 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.802488089 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.802504063 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.802520990 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.802532911 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.802565098 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.802611113 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.802622080 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.802656889 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.802674055 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.802690983 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.802730083 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.802736044 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.802782059 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.802793026 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.802822113 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.802834034 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.802845001 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.802881956 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.802882910 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.802911997 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.802951097 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.803000927 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.803011894 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.803057909 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.803070068 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.803081036 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.803114891 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.803157091 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.803169966 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.803212881 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.803252935 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.803263903 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.803306103 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.803306103 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.803323984 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.803354979 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.803368092 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.803385973 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.803406954 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.803519964 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.803533077 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.803563118 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.803584099 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.803589106 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.803596020 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.803633928 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.803639889 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.803658962 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.803675890 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.803699970 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.803735018 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.803745985 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.803787947 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.803800106 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.804191113 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.804238081 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.877244949 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.877341032 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.877396107 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.877433062 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.877484083 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.877500057 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.877535105 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.877543926 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.877568960 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.877644062 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.877715111 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.877768040 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.877902985 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.877954006 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.878005981 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.878230095 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.878371954 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.878423929 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.878494024 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.878613949 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.878660917 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.878739119 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.878854990 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.878916979 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.878961086 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.879057884 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.879108906 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.879153013 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.879306078 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.879364967 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.879409075 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.879456043 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.879501104 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.879615068 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.879718065 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.879771948 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.879828930 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.879960060 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.880007982 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.880043983 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.880162954 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.880211115 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.880317926 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.880417109 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.880461931 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.880557060 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.880661964 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.880707026 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.880758047 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.880917072 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.880964994 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.881021976 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.881104946 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.881154060 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.881197929 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.881329060 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.881383896 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.881433010 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.881464958 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.881508112 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.881567955 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.881665945 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.881716013 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.881771088 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.881870031 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.881926060 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.882025003 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.882106066 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.882163048 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.882185936 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.882293940 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.882344961 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.882400036 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.882446051 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.882491112 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.882601023 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.882647038 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.882659912 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.882745981 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.882802963 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.882863998 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.882956982 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.883004904 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.908615112 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.908668995 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.908720016 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.908725977 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.908782959 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.908791065 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.908822060 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.908936977 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.908994913 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.909019947 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.911746025 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.911803007 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.914515972 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.914567947 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.914585114 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.914621115 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.914628029 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.914659023 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.914736032 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.914777040 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.914875984 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.914916039 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.914947033 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.914987087 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.915024996 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.915086985 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.915132046 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.915168047 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.916172028 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.916229963 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.918570042 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.918587923 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.918658972 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.918749094 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.919531107 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.919585943 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.919703007 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.920241117 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.920298100 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.920881987 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.921264887 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.921318054 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.921320915 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.921360016 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.921405077 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.921516895 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.921555042 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.921561003 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.921596050 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.921617985 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.921679974 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.921727896 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.921785116 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.921911955 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.921969891 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.922024012 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.922164917 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.922214985 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.922265053 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.922343016 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.922389984 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.922436953 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.922524929 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.922569990 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.922637939 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.922710896 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.922775030 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.922821999 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.922899008 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.922945976 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.922983885 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.923131943 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.923178911 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.923190117 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.923250914 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.923296928 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.923377991 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.923396111 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.923439026 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.923453093 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.923482895 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.923630953 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.923686981 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.923732996 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.923774004 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.923856020 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.923903942 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.923919916 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.924010038 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.924020052 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.924069881 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.997097969 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.997226954 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.997236967 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.997309923 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.997313976 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.997365952 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.997407913 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.997417927 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.997461081 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.997514009 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.997600079 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.997651100 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.997951984 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.998008013 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.998039961 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.998159885 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.998210907 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.998219013 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.998265028 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.998430967 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.998472929 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.998548985 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.998559952 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.998599052 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.998632908 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.998661995 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.998681068 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.998703957 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.998867035 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.998910904 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.998945951 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.998982906 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.998990059 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.999015093 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.999025106 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.999066114 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.999278069 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.999327898 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.999366045 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.999394894 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.999422073 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.999445915 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.999557018 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.999629974 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.999711990 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.999752045 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.999793053 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.999840021 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.999870062 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.999913931 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:08.999938011 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:08.999980927 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.000029087 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.000066996 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.000118017 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.000257969 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.000299931 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.000319958 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.000473022 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.000519037 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.000616074 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.000627995 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.000677109 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.000821114 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.000921011 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.000931025 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.000979900 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.001039982 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.001070023 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.001111031 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.001207113 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.001251936 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.001296043 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.001302004 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.001446962 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.001476049 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.001487017 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.001521111 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.001729012 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.001782894 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.001827002 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.001862049 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.001879930 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.001924992 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.002012014 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.002063036 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.002104044 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.002151966 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.002178907 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.002219915 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.002334118 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.002435923 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.002479076 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.002484083 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.002509117 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.002559900 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.028206110 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.028268099 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.028353930 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.028392076 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.028455973 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.028466940 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.028511047 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.028511047 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.028562069 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.028563976 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.028605938 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.028616905 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.028692007 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.031270981 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.031289101 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.031327009 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.031362057 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.034003019 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.034153938 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.034204006 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.034220934 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.034235954 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.034245968 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.034281015 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.034420013 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.034471035 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.034584999 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.034651995 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.034684896 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.034773111 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.035754919 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.035821915 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.035830975 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.035871983 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.038167000 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.038233995 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.038296938 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.038340092 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.039104939 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.039163113 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.039203882 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.039254904 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.039769888 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.039822102 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.039892912 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.039942980 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.039997101 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.040955067 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.041012049 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.041091919 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.041135073 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.041172028 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.041214943 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.041258097 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.041306973 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.041413069 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.041557074 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.041558027 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.041637897 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.041673899 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.041691065 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.041721106 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.041771889 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.041827917 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.041874886 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.041944981 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.041982889 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.042095900 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.042136908 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.042233944 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.042366982 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.042426109 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.042481899 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.042556047 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.042598963 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.042695999 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.042794943 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.042843103 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.042912006 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.042995930 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.043044090 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.043085098 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.043123960 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.043159008 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.043288946 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.043335915 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.043385029 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.043498039 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.043540955 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.043597937 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.043740034 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.043788910 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.043853998 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.043921947 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.043967009 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.044017076 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.044133902 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.044179916 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.044213057 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.044266939 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.044315100 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.044352055 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.044435978 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.044481039 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.044522047 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.044539928 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.044586897 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.044625998 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.044687986 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.044702053 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.046356916 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.117067099 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.117115974 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.117173910 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.117229939 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.117296934 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.117332935 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.117386103 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.117393017 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.117419958 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.117440939 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.117463112 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.117465019 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.117506027 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.117553949 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.117578983 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.117598057 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.117624044 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.117640972 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.117681026 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.117752075 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.117794991 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.117810011 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.117849112 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.117882013 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.117923021 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.117928982 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.117966890 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.117970943 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.118006945 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.118144989 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.118221998 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.118273973 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.118300915 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.118340969 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.118355989 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.118360043 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.118380070 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.118396997 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.118489027 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.118530035 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.118561983 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.118602991 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.118710995 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.118751049 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.118752003 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.118794918 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.118890047 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.118932962 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.119026899 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.119066954 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.119098902 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.119141102 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.119245052 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.119287968 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.119333029 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.119373083 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.119380951 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.119421959 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.119467974 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.119508028 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.119519949 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.119573116 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.119600058 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.119638920 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.119682074 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.119725943 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.119797945 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.119837999 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.119901896 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.119941950 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.120033026 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.120071888 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.120136023 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.120176077 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.120186090 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.120217085 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.120265961 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.120306969 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.120522022 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.120564938 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.120588064 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.120630980 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.120657921 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.120699883 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.120726109 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.120767117 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.120816946 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.120857000 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.120876074 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.120919943 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.120942116 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.120985985 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.121027946 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.121068001 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.121083021 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.121123075 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.121164083 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.121203899 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.121205091 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.121247053 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.121340990 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.121381044 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.121424913 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.121465921 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.121483088 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.121524096 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.121534109 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.121582031 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.122262001 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.122333050 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.147891998 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.147948980 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.147974968 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.148031950 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.148036957 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.148082018 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.148108959 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.148121119 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.148149014 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.148171902 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.148271084 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.148309946 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.148350954 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.148391962 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.150800943 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.150829077 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.150845051 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.150871038 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.151030064 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.151067972 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.153728962 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.153776884 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.153832912 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.153873920 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.153924942 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.153954983 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.153970957 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.153990984 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.154097080 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.154108047 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.154144049 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.154146910 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.154187918 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.154356003 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.154396057 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.154411077 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.154445887 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.154452085 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.154481888 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.155224085 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.155271053 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.155433893 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.155474901 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.157690048 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.157737017 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.157855034 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.157882929 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.157900095 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.157922029 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.158723116 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.158775091 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.158951998 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.159006119 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.159297943 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.159341097 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.159483910 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.159527063 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.159621000 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.159667015 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.160459995 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.160509109 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.160698891 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.160743952 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.160792112 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.160835028 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.160908937 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.160950899 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.161122084 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.161133051 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.161175013 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.161226988 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.161267042 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.161279917 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.161323071 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.161350012 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.161390066 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.161412954 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.161452055 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.161530018 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.161571980 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.161643028 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.161684990 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.161854029 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.161904097 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.162012100 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.162053108 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.162126064 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.162164927 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.162182093 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.162223101 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.162247896 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.162288904 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.162364960 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.162406921 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.162444115 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.162487984 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.162643909 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.162686110 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.162688971 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.162734985 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.162772894 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.162816048 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.162863970 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.162909985 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.162914038 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.162955046 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.163152933 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.163202047 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.163296938 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.163341999 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.163409948 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.163450956 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.163475990 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.163516998 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.163536072 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.163573027 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.163691998 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.163733959 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.163784027 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.163820982 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.163882971 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.163923979 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.163997889 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.164036036 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.164064884 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.164113045 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.164170027 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.164206028 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.164251089 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.164289951 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.164313078 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.164347887 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.164352894 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.164387941 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.164426088 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.164464951 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.165914059 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.165956974 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.208844900 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.208985090 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.237015009 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.237071991 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.237169027 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.237185955 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.237209082 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.237225056 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.237333059 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.237371922 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.237538099 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.237577915 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.237627983 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.237672091 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.237834930 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.237883091 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.237890005 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.237930059 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.237997055 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.238034010 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.238136053 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.238176107 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.238506079 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.238557100 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.238565922 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.238595963 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.238646030 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.238687038 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.238732100 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.238775015 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.238929987 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.238967896 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.239001989 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.239037037 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.239161968 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.239202023 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.239260912 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.239295959 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.239372969 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.239409924 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.239490986 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.239526033 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.239588022 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.239619970 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.239967108 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.239984989 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.240022898 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.240114927 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.240161896 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.240242004 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.240279913 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.240365982 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.240401983 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.240502119 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.240547895 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.240598917 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.240638971 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.240761995 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.240804911 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.240869999 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.240909100 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.240987062 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.241024017 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.241147041 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.241185904 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.241221905 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.241266966 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.241338015 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.241377115 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.241447926 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.241483927 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.241549969 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.241589069 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.241614103 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.241655111 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.241728067 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.241765976 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.241841078 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.241875887 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.241967916 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.242012024 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.242096901 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.242144108 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.242207050 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.242247105 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.242454052 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.242506027 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.242527008 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.242562056 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.242633104 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.242680073 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.242744923 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.242789030 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.242845058 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.242881060 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.242913008 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.242950916 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.242991924 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.243026018 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.243144035 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.243182898 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.243262053 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.243299961 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.243351936 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.243393898 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.243462086 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.243513107 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.243542910 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.243580103 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.243659019 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.243700981 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.243760109 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.243794918 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.243832111 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.243871927 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.243918896 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.243953943 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.244029999 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.244072914 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.244236946 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.244246960 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.244287968 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.244332075 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.244370937 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.244409084 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.244448900 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.267608881 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.267669916 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.267705917 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.267715931 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.267744064 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.267772913 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.267937899 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.267949104 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.267977953 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.267997026 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.268002987 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.268058062 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.270375967 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.270425081 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.270431995 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.270481110 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.270576954 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.270616055 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.273471117 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.273480892 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.273521900 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.273526907 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.273564100 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.273585081 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.273622990 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.273688078 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.273722887 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.273736000 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.273772955 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.273817062 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.273854971 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.273936987 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.273956060 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.273977995 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.273999929 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.274010897 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.274048090 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.274727106 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.274772882 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.275017023 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.275058985 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.277188063 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.277232885 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.277374983 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.277416945 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.277451992 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.277489901 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.278223991 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.278275013 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.278278112 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.278312922 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.278620958 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.278670073 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.278976917 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.279026985 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.279200077 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.279244900 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.279985905 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.280041933 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.280042887 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.280088902 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.280236959 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.280276060 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.280312061 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.280349970 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.280477047 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.280514956 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.280822039 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.280863047 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.280864000 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.280877113 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.280900002 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.280925035 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.282099009 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.282202959 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.282231092 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.282272100 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.285285950 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.285418034 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.285564899 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.285605907 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.356589079 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.356647015 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.356827021 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.356870890 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.356923103 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.356961012 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.357000113 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.357043028 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.357043028 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.357095003 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.357146978 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.357188940 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.357213020 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.357264996 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.357388973 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.357429028 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.357522964 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.357561111 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.357666016 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.357675076 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.357714891 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.357948065 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.357990026 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.358196020 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.358238935 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.358251095 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.358294010 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.358370066 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.358417034 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.358448982 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.358488083 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.358488083 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.358531952 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.358640909 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.358669043 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.358689070 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.358707905 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.358726978 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.358769894 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.358802080 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.358839035 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.358983994 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.359025955 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.359062910 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.359102964 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.359111071 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.359138966 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.359257936 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.359266996 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.359303951 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.359307051 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.359352112 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.359603882 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.359659910 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.359786987 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.359798908 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.359824896 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.359848976 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.359882116 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.359905005 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.359922886 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.359942913 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.360006094 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.360047102 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.360100031 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.360140085 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.360152960 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.360196114 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.360234976 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.360270977 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.360297918 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.360337019 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.360375881 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.360413074 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.360548019 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.360590935 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.360599041 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.360640049 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.360724926 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.360768080 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.360841990 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.360887051 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.360949993 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.360977888 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.361004114 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.361021996 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.361095905 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.361136913 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.361219883 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.361265898 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.361320019 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.361361980 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.361474991 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.361484051 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.361495018 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.361532927 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.361552000 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.361609936 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.361653090 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.361715078 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.361762047 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.362046957 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.362128019 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.362145901 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.362190008 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.362343073 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.362353086 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.362385988 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.362391949 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.362426043 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.362442017 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.362483978 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.362543106 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.362579107 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.362612009 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.362659931 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.362699032 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.362709045 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.362735987 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.362752914 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.362840891 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.362879038 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.362884998 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.362915039 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.362962008 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.363003969 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.363032103 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.363078117 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.363267899 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.363276005 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.363286018 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.363322973 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.363348007 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.363390923 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.363430977 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.363435030 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.363472939 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.363598108 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.363640070 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.363643885 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.363677979 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.363831043 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.363874912 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.363876104 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.363907099 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.363914967 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.363940001 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.364017963 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.364059925 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.364176035 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.364224911 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.387262106 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.387271881 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.387321949 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.387365103 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.387411118 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.387505054 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.387550116 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.387557983 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.387602091 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.387656927 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.387697935 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.387744904 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.387784004 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.387847900 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.387887955 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.389842033 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.389893055 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.390144110 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.390155077 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.390182972 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.390187979 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.390207052 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.390227079 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.392997026 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.393054962 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.393059969 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.393100023 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.393275976 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.393285990 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.393295050 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.393306971 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.393318892 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.393346071 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.393354893 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.393357992 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.393394947 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.393397093 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.393430948 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.393465042 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.393506050 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.393663883 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.393702984 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.393709898 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.393747091 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.394352913 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.394402981 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.394484997 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.394526958 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.394546032 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.394593000 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.396800041 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.396866083 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.396980047 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.396991014 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.397015095 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.397042990 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.397758007 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.397802114 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.398055077 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.398103952 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.398196936 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.398236036 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.398463964 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.398503065 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.398678064 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.398716927 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.399591923 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.399642944 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.399661064 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.399693966 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.399705887 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.399729013 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.399844885 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.399889946 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.399909973 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.399951935 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.399962902 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.400001049 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.400399923 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.400446892 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.400448084 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.400501013 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.400527000 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.400568962 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.401813984 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.401863098 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.401905060 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.401937008 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.401946068 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.401976109 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.402184010 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.402194977 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.402204037 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.402213097 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.402225018 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.402234077 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.402257919 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.402276039 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.402297974 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.402299881 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.402323961 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.402343035 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.402354002 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.402394056 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.402395010 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.402436018 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.402481079 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.402523041 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.402525902 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.402560949 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.402586937 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.402633905 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.416054964 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.416101933 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.416105032 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.416112900 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.416141987 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.416157961 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.416177988 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.416219950 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.416229963 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.416239977 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.416274071 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.416290998 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.416292906 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.416331053 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.416357994 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.416399956 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.416404009 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.416419983 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.416449070 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.416465044 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.416491032 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.416507959 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.416563034 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.416595936 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.416609049 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.416661024 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.416666031 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.416683912 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.416717052 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.416742086 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.416754961 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.416953087 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.416966915 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.416975975 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.416996002 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.417002916 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.417015076 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.417026043 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.417047024 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.417059898 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.417124987 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.417136908 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.417145967 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.417181969 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.417190075 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.727730989 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.947648048 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.947746992 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.950015068 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.950025082 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.950095892 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.950109959 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.950120926 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.950133085 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.950155020 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.950165033 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.950176001 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.950212002 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.950213909 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.950272083 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.950280905 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.950326920 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.950335979 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.950377941 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.950393915 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.950442076 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.950454950 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.950495005 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.950495005 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.950531960 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.950534105 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.950582027 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.950644970 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.950663090 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.950671911 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.950687885 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.950716972 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.950746059 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.950783014 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.950784922 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.950824976 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.950855017 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.950892925 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.950917006 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.950953007 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.951035976 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.951046944 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.951086998 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.951114893 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.951127052 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.951143980 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.951164007 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.951179981 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.951236963 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.951265097 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.951282978 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.951304913 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.951421976 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.951464891 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.951464891 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.951505899 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.951581955 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.951622963 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.951627016 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.951643944 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.951666117 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.951683044 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.951724052 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.951762915 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.951782942 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.951823950 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.951837063 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.951883078 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.951914072 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.951952934 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.952002048 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.952042103 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.952107906 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.952152967 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.952155113 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.952198029 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.952265024 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.952301979 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.952305079 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.952312946 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.952357054 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.952452898 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.952464104 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.952471972 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.952482939 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.952507019 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.952528954 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.952552080 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.952579021 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.952594042 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.952608109 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.952637911 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.952682972 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.952709913 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.952754974 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.952775002 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.952814102 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.952822924 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.952853918 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.952869892 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.952891111 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.952904940 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.952944040 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.952944040 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.952982903 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.952999115 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.953037977 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.953058004 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.953099966 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.953114033 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.953155994 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.953171968 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.953205109 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.953212023 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.953253031 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.953330040 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.953340054 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.953356028 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.953373909 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.953397036 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.953435898 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.953478098 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.953481913 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.953495026 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.953522921 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.953542948 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.953584909 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.953622103 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.953624964 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.953665972 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.953671932 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.953712940 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.953715086 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.953759909 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.953790903 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.953829050 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.953839064 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.953875065 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.953881979 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.953924894 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.954330921 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.954341888 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.954427958 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.954457998 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.954495907 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.954518080 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.954534054 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.954539061 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.954581976 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.954596043 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.954606056 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.954644918 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.954716921 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.954727888 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.954735994 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.954767942 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.954781055 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.954816103 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.954917908 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.954933882 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.954943895 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.954963923 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.954981089 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.954989910 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.954999924 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.955044031 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.955107927 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.955142021 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.955153942 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.955187082 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.955209017 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.955257893 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.955260038 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.955307007 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.955317974 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.955358028 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.955363035 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.955401897 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.955403090 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.955450058 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.955460072 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.955507994 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.955543041 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.955590010 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.955643892 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.955681086 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.955713034 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.955770969 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.955811024 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.955852985 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.955905914 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.955949068 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.956013918 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.956054926 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.956130028 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.956171036 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.956187010 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.956229925 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.956264019 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.956305981 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.956329107 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.956372976 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.956374884 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.956427097 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.956434965 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.956474066 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.956475973 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.956516027 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.956533909 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.956579924 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.956592083 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.956631899 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.956633091 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.956662893 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.956672907 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.956718922 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.956732035 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.956777096 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.956810951 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.956820965 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.956861973 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.956868887 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.956908941 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.956933975 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.956974983 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.956979036 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.957020044 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.957052946 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.957082033 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.957096100 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.957118988 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.957128048 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.957165956 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.957170963 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.957215071 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.957240105 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.957273960 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.957282066 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.957312107 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.957314014 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.957355022 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.957384109 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.957423925 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.957546949 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.957590103 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.957591057 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.957629919 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.957699060 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.957741022 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.957811117 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.957858086 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.957882881 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.957922935 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.958039999 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.958050013 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.958086014 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.958162069 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.958203077 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.958211899 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.958252907 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.958288908 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.958328009 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.958436012 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.958482981 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.962688923 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.962747097 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.962836027 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.962846041 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.962853909 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.962878942 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.962903976 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.962968111 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.962980032 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.963006973 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.963023901 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.963073015 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.963118076 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.963135958 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.963145971 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.963162899 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.963174105 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.963298082 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.963337898 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.963382959 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.963419914 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.963429928 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.963469982 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.963474989 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.963512897 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.964606047 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.964647055 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.964680910 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.964715004 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.964752913 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.964790106 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.964833021 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.964868069 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.966687918 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.966730118 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.966737986 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.966768980 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.966773033 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.966800928 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.966814041 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.966840982 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.967010975 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.967048883 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.967245102 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.967287064 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.967323065 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.967364073 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.967365980 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.967405081 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.967483997 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:09.967530012 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:09.978038073 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.067358971 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.067512035 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.067517042 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.067589998 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.069597006 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.069698095 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.069861889 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.069871902 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.069916964 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.070058107 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.070070028 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.070111990 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.070187092 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.070223093 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.070236921 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.070313931 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.070383072 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.070422888 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.070427895 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.070487022 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.070538044 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.070565939 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.070600986 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.070636034 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.070683956 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.070699930 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.070749044 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.070775986 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.070816994 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.070911884 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.070954084 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.070990086 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.071054935 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.071095943 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.071135044 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.071161985 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.071201086 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.071261883 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.071322918 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.071405888 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.071446896 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.071660042 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.071702957 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.071810007 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.071851969 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.071918011 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.071959972 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.072144032 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.072185040 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.072221994 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.072268009 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.072340965 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.072381020 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.072437048 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.072479010 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.072519064 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.072557926 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.072633982 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.072644949 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.072689056 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.072722912 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.072766066 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.072865009 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.072911024 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.072999954 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.073040009 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.073092937 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.073102951 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.073137999 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.073162079 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.073203087 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.073227882 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.073268890 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.073347092 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.073384047 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.073394060 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.073436022 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.073554993 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.073565006 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.073573112 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.073602915 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.073605061 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.073647022 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.073667049 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.073707104 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.073709011 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.073754072 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.073767900 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.073807001 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.073843002 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.073883057 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.073910952 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.073952913 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.074019909 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.074064970 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.074130058 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.074172974 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.074184895 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.074225903 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.074232101 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.074271917 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.074393988 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.074404001 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.074440956 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.074578047 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.074631929 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.074645042 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.074682951 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.074744940 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.074754953 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.074790955 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.075032949 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.075073957 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.075088978 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.075098038 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.075126886 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.075141907 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.075771093 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.075782061 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.075860977 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.075917006 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.075933933 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.075958014 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.075970888 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.076030016 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.076076984 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.076117039 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.076157093 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.076205969 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.076245070 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.076318979 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.076359034 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.076400042 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.076440096 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.076476097 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.076518059 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.076589108 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.076615095 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.076633930 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.076653004 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.076813936 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.076823950 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.076863050 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.076869011 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.076906919 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.076977968 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.077018023 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.077018976 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.077058077 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.077136993 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.077177048 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.077205896 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.077250004 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.077291012 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.077296972 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.077332020 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.077388048 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.077425003 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.077435970 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.077449083 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.077461958 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.077488899 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.077533007 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.077573061 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.077702045 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.077712059 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.077722073 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.077747107 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.077764988 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.077785015 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.077826977 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.077832937 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.077873945 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.077924967 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.077972889 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.077987909 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.078052998 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.078062057 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.078099012 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.078104973 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.078138113 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.078141928 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.078177929 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.078217983 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.078258991 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.078263044 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.078304052 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.078345060 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.078361988 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.078412056 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.078442097 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.078461885 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.078556061 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.078566074 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.078574896 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.078607082 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.078608990 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.078638077 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.078654051 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.078675032 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.078680992 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.078718901 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.078831911 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.078841925 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.078881025 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.078887939 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.078900099 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.078927040 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.078943968 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.078957081 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.078998089 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.079022884 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.079066038 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.079109907 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.079149008 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.079176903 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.079219103 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.079256058 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.079297066 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.079305887 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.079349995 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.079451084 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.079461098 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.079498053 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.079500914 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.079539061 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.079596043 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.079607010 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.079641104 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.079669952 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.079679966 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.079719067 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.079732895 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.079773903 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.079891920 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.079931974 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.079938889 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.079977989 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.080025911 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.080064058 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.080075979 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.080096006 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.080115080 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.080132961 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.080163002 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.080203056 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.080353975 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.080364943 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.080373049 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.080385923 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.080403090 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.080421925 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.080430984 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.082233906 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.082351923 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.082673073 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.082720041 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.082879066 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.082923889 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.082967997 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.083010912 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.083095074 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.083108902 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.083148003 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.083209038 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.083254099 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.083255053 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.083292007 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.083409071 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.083424091 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.083451033 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.083471060 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.084287882 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.084336996 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.084589005 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.084630966 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.084635973 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.084673882 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.084846973 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.084888935 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.086363077 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.086414099 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.086446047 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.086487055 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.086522102 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.086533070 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.086565971 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.086585999 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.086596012 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.086641073 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.086986065 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.087029934 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.087251902 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.087310076 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.187393904 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.187452078 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.189212084 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.189295053 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.189399958 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.189444065 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.189625978 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.189636946 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.189671040 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.189677954 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.189732075 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.189831972 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.189842939 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.189878941 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.189893961 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.189987898 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.189999104 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.190028906 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.190190077 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.190200090 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.190231085 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.190232992 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.190288067 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.190300941 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.190356970 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.190361977 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.190368891 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.190406084 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.190555096 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.190566063 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.190589905 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.190593958 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.190601110 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.190627098 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.190650940 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.190684080 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.190694094 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.190721989 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.190727949 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.190767050 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.190784931 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.190851927 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.201045036 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.201057911 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.201066971 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.201086044 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.201095104 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.201103926 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.201107025 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.201123953 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.201126099 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.201149940 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.201179028 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.201189041 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.201194048 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.201225042 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.201227903 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.201258898 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.201272964 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.201313019 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.201320887 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.201322079 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.201358080 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.201365948 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.201387882 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.201411009 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.201433897 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.201497078 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.201508045 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.201519012 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.201544046 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.201591015 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.201687098 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.201698065 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.201708078 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.201718092 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.201729059 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.201739073 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.201744080 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.201750040 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.201762915 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.201791048 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.203948021 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.203967094 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204018116 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204018116 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.204036951 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204071045 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.204087019 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204121113 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204160929 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.204196930 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204206944 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204235077 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204235077 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.204246044 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204282045 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.204328060 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204338074 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204375982 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.204437971 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.204473019 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204483986 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204519987 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204520941 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.204540014 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.204566956 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.204567909 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204610109 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.204617977 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204668045 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.204691887 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204701900 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204724073 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204730988 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.204735041 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204745054 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204763889 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.204802036 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204812050 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204826117 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.204858065 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.204858065 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204885960 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204914093 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.204929113 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.204941988 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204953909 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.204993963 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.205106020 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.205116034 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.205125093 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.205135107 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.205147982 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.205152035 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.205157995 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.205176115 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.205220938 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.205244064 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.205254078 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.205282927 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.205343962 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.205440044 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.205454111 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.205463886 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.205492020 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.205636978 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.205651999 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.205662966 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.205672026 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.205682993 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.205688000 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.205699921 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.205718040 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.205723047 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.205729961 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.205740929 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.205751896 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.205759048 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.205790997 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.206439972 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.206450939 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.206480026 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.206480026 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.206492901 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.206522942 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.206561089 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.206571102 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.206578016 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.206610918 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.206649065 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.206660032 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.206671000 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.206686020 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.206693888 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.206717968 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.206751108 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.206763029 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.206811905 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.206866026 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.206876993 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.206893921 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.206908941 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.206932068 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.206988096 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.207037926 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.207047939 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.207073927 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.208612919 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.208682060 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.208697081 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.208707094 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.208748102 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.208762884 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.208858013 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.208870888 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.208879948 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.208889961 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.208904982 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.208916903 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.208925009 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.208937883 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.208950996 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.208957911 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.208972931 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.208987951 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.209026098 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.209028959 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.209084988 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.209089994 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.209112883 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.209136963 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.209178925 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.209204912 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.209217072 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.209244013 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.209258080 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.209403038 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.209414005 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.209450960 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.209456921 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.209469080 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.209508896 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.209544897 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.209554911 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.209595919 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.209640026 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.209650040 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.209683895 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.209777117 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.209788084 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.209819078 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.209856033 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.209880114 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.209907055 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.209920883 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.210021973 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.210031986 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.210067034 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.210068941 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.210081100 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.210108995 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.210149050 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.210218906 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.210231066 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.210264921 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.210273027 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.210283995 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.210306883 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.210328102 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.210355043 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.210360050 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.210375071 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.210417986 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.210445881 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.210457087 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.210473061 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.210481882 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.210489035 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.210503101 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.210520983 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.210562944 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.210573912 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.210603952 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.210768938 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.210778952 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.210788965 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.210793018 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.210797071 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.210822105 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.210882902 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.210957050 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.210968018 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.211005926 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.213304996 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.213355064 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.213388920 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.213411093 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.213531017 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.213582039 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.213592052 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.213608027 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.213617086 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.213625908 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.213659048 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.213682890 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.213699102 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.213784933 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.213784933 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.213797092 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.213820934 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.213821888 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.213831902 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.213840008 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.213879108 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.213913918 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.213928938 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.213956118 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.213956118 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.213972092 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.213999987 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.214003086 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214014053 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214045048 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.214492083 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214503050 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214513063 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214523077 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214531898 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214536905 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.214541912 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214553118 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214565039 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214572906 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.214575052 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214586020 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214591980 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.214596987 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214607954 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214618921 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214618921 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.214628935 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214634895 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.214638948 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214649916 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214656115 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.214660883 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214670897 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214682102 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214689970 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.214705944 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.214705944 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214716911 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214725018 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.214725971 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214737892 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214751959 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.214766979 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.214785099 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214786053 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.214796066 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214804888 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214814901 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214824915 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214828968 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.214838028 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.214854002 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.214884996 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214895010 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214915991 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214925051 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.214951992 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.214967966 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.214994907 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.215002060 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.215081930 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.215086937 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.215131044 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.215135098 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.215190887 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.215207100 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.215219021 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.215240955 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.215281010 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.215373039 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.215384007 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.215395927 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.215405941 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.215416908 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.215419054 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.215435982 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.215460062 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.215461016 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.215502024 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.215558052 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.215569973 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.215605974 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.215635061 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.215689898 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.215701103 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.215715885 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.215733051 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.215743065 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.215760946 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.215771914 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.215801954 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.215909004 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.215919018 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.215955019 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.215972900 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.215982914 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.216018915 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.217489958 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.217509031 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.217550039 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.217561007 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.217580080 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.217612028 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.217629910 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.217645884 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.217658997 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.217699051 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.217724085 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.217734098 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.217767000 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.217813969 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.217824936 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.217835903 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.217855930 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.217869043 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.217895031 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.217912912 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.217983961 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.218003035 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.218013048 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.218028069 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.218049049 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.218059063 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.218070030 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.218079090 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.218080997 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.218100071 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.218127012 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.218162060 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.218172073 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.218203068 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.218220949 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.218246937 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.218274117 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.218277931 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.218306065 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.218333006 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.218336105 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.218343019 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.218354940 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.218374968 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.218386889 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.218660116 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.218669891 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.218704939 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.218724012 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.218738079 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.218782902 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.218894958 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.218904972 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.218914032 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.218924046 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.218935966 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.218941927 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.218955040 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.218962908 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.218976974 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.218992949 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.218997002 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219022989 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.219031096 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.219038963 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219049931 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219080925 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.219136000 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219146967 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219171047 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219182968 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219182968 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.219208956 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.219219923 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219230890 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219264030 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.219357014 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219367981 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219377041 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219386101 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219399929 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.219414949 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.219500065 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219510078 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219518900 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219527960 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219537020 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219541073 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.219559908 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.219580889 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.219583035 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219594955 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219604015 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219613075 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219628096 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.219649076 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.219741106 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219752073 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219762087 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219773054 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219783068 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.219783068 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219796896 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219808102 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219814062 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.219824076 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219834089 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219840050 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.219845057 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219856024 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219882011 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.219926119 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.219938040 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219948053 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219964981 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219974041 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.219980001 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.219985962 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.220010042 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.220038891 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.222371101 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.222431898 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.222476006 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.222487926 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.222517967 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.222628117 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.222641945 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.222687006 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.222718954 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.222738028 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.222763062 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.222820997 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.222831011 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.222836971 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.222867012 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.222908020 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.222934961 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.222965002 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.222994089 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.223005056 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223054886 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223058939 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.223104000 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.223129988 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223140955 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223176003 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.223282099 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223293066 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223300934 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223316908 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223325968 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.223336935 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223344088 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.223347902 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223367929 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.223387003 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.223408937 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223419905 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223455906 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.223459959 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223472118 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223514080 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.223560095 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223571062 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223582983 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223592997 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223603010 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.223628998 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.223649025 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.223656893 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223669052 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223701000 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223706007 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.223715067 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223731041 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.223747015 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223747969 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.223788977 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223788977 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.223844051 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.223870039 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223880053 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223891973 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223901033 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.223917007 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.223934889 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.223948956 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.307013035 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.307168007 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.307169914 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.307231903 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.308769941 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.308859110 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.308893919 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.308996916 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.309093952 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.309164047 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.309216976 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.309236050 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.309278011 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.309573889 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.309604883 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.309642076 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.309700012 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.309704065 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.309736967 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.309767008 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.309847116 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.309968948 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.309978962 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.309988022 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.309999943 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.310014009 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.310030937 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.310044050 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.310056925 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.310066938 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.310092926 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.310096025 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.310106993 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.310122967 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.310148001 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.310229063 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.310240984 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.310278893 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.310328960 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.310403109 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.310435057 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.310477018 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.320652962 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.320729017 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.320796013 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.320842028 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.320849895 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.320884943 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.320918083 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.320957899 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.320974112 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.321010113 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.321069956 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.321079969 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.321109056 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.321111917 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.321160078 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.321219921 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.321305037 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.321327925 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.321367979 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.321469069 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.321511030 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.323441982 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.323496103 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.323651075 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.323688984 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.323776960 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.323813915 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.323857069 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.323894024 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.323915958 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.323954105 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.323981047 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.324018955 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.324063063 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.324099064 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.324134111 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.324173927 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.324198008 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.324232101 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.324350119 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.324388027 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.324498892 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.324536085 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.324553967 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.324593067 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.324773073 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.324784040 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.324832916 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.324903011 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.324935913 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.324943066 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.324975967 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.325016022 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.325026035 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.325059891 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.325328112 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.325385094 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.325419903 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.325457096 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.325459957 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.325510025 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.325612068 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.325658083 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.325984955 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.326023102 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.326121092 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.326159000 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.326234102 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.326272011 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.326366901 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.326378107 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.326415062 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.326474905 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.326514006 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.326647997 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.326752901 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.328174114 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.328232050 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.328459024 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.328501940 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.328502893 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.328541040 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.328548908 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.328584909 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.328973055 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.329010963 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.329037905 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.329083920 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.329160929 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.329196930 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.329227924 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.329265118 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.329377890 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.329418898 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.329498053 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.329538107 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.329977036 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.329987049 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.329996109 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.330007076 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.330027103 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.330060005 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.330122948 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.330174923 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.330395937 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.330440998 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.330452919 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.330492020 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.330842018 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.330852032 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.330868959 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.330878973 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.330888033 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.330893993 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.330904961 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.330924034 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.330946922 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.333267927 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.333339930 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.333383083 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.333435059 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.333699942 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.333750010 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.333935976 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.333992004 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.334342957 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.334383011 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.334666014 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.334705114 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.334738016 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.334799051 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.334857941 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.334882021 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.334903955 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.334923983 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.335027933 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.335037947 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.335046053 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.335067034 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.335068941 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.335086107 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.335108995 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.335119963 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.335155964 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.335180998 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.335217953 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.335251093 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.335274935 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.335284948 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.335324049 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.335614920 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.335624933 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.335633993 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.335643053 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.335650921 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.335654974 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.335673094 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.335691929 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.337217093 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.337376118 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.337488890 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.337498903 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.337544918 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.337574005 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.337584019 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.337591887 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.337601900 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.337620020 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.337632895 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.337656021 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.337658882 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.337683916 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.337699890 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.337718010 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.337735891 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.337785959 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.337790012 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.337826967 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.337939978 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.337981939 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.338116884 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.338159084 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.338462114 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.338471889 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.338480949 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.338509083 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.338529110 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.338548899 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.338587999 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.338591099 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.338630915 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.338641882 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.338685036 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.338690042 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.338726997 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.338783979 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.338830948 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.338957071 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.338967085 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.338974953 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.338987112 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.339001894 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.339020014 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.339030027 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.339071035 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.339113951 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.339426994 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.339437008 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.339445114 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.339454889 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.339468002 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.339478016 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.339481115 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.339497089 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.339498043 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.339510918 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.339520931 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.339529037 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.339538097 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.339562893 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.339569092 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.339607954 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.339627981 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.339668036 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.339670897 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.339708090 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.341902971 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.341960907 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.342252016 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.342262030 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.342312098 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.342348099 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.342389107 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.342541933 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.342583895 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.342675924 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.342717886 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.343393087 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.343431950 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.343449116 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.343472958 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.343518972 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.343560934 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.343610048 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.343648911 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.343736887 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.343777895 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.343813896 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.343852997 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.343853951 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.343890905 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.344221115 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.344230890 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.344239950 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.344278097 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.344331980 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.344373941 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.388942003 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.389062881 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.427031994 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.427186966 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.428786993 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.428842068 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.429040909 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.429084063 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.429250002 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.429297924 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.429440975 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.429481983 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.429533958 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.429577112 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.429624081 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.429663897 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.429745913 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.429785013 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.429860115 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.429903984 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.430140972 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.430186033 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.430253983 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.430294991 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.430360079 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.430402994 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.440680027 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.440754890 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.441160917 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.441236019 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.441344023 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.441385031 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.443592072 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.443655014 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.443928957 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.443974972 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.444226980 CET	15666	49707	193.3.19.151	192.168.2.6
Dec 27, 2024 06:52:10.444273949 CET	49707	15666	192.168.2.6	193.3.19.151
Dec 27, 2024 06:52:10.444406986 CET	15666	49707	193.3.19.151	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 06:52:02.904994965 CET	192.168.2.6	1.1.1.1	0x10de	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 06:52:03.042290926 CET	1.1.1.1	192.168.2.6	0x10de	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Dec 27, 2024 06:52:03.042290926 CET	1.1.1.1	192.168.2.6	0x10de	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Dec 27, 2024 06:52:03.042290926 CET	1.1.1.1	192.168.2.6	0x10de	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49708	104.26.13.205	443	3688	C:\Users\user\Desktop\markiz.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 05:52:04 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2024-12-27 05:52:04 UTC	424	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 05:52:04 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8f870add6db97cf6-EWR server-timing: cfL4;desc="?proto=TCP&rtt=2025&min_rtt=2010&rtt_var=765&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=738&delivery_rate=1452736&cwnd=193&unsent_bytes=0&cid=06df10b618dc9da2&ts=459&x=0"
2024-12-27 05:52:04 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Target ID:	0
Start time:	00:52:00
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\markiz.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\markiz.exe"
Imagebase:	0x7ff6573f0000
File size:	1'292'800 bytes
MD5 hash:	BEE040FC0CAF73EE0CB2E55D4C703F22
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	24%
Total number of Nodes:	1526
Total number of Limit Nodes:	66

Executed Functions

Function 00007FF657478330 Relevance: 50.4, APIs: 19, Strings: 9, Instructions: 1376
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF657476540: EnumDisplayDevicesW.USER32 ref: 00007FF657476657
Part of subcall function 00007FF657476540: EnumDisplayDevicesW.USER32 ref: 00007FF6574766FB

Part of subcall function 00007FF657476460: RegGetValueA.KERNEL32 ref: 00007FF6574764C9

Part of subcall function 00007FF657476150: GetUserNameW.ADVAPI32 ref: 00007FF657476195

Part of subcall function 00007FF6574761F0: GetComputerNameW.KERNEL32 ref: 00007FF657476235

Part of subcall function 00007FF657431900: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574319D4

Part of subcall function 00007FF657433FF0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65743447D

GlobalMemoryStatusEx.KERNEL32 ref: 00007FF6574787BC
wcsftime.LIBCMT ref: 00007FF657478FB2
GetModuleFileNameA.KERNEL32 ref: 00007FF657479146
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657479B09
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657479B0F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657479B15
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657479B1B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657479B21
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657479B27
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657479B2D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657479B33
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657479B39
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657479B3F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657479B45
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657479B4B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657479B51
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657479B57
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657479B5D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657479B63

Strings

timezone, xrefs: 00007FF657479454
user_name, xrefs: 00007FF65747846F
cpu, xrefs: 00007FF657478658
system, xrefs: 00007FF657478424, 00007FF657478513, 00007FF657478609, 00007FF657478703, 00007FF65747884B, 00007FF657478945, 00007FF657478A38, 00007FF657478BBF, 00007FF657478DB0, 00007FF657479031, 00007FF6574791F4, 00007FF65747940E, 00007FF6574795AD, 00007FF657479757, 00007FF65747981D
time, xrefs: 00007FF657479081
%d-%m-%Y, %H:%M:%S, xrefs: 00007FF657478F9F
ram, xrefs: 00007FF65747889B
computer_name, xrefs: 00007FF657478994
gpu, xrefs: 00007FF657478562

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Name$DevicesDisplayEnum$ComputerFileGlobalMemoryModuleStatusUserValuewcsftime
String ID: %d-%m-%Y, %H:%M:%S$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 4122120932-1182675529
Opcode ID: d136dd3b171e80c30b784e322e85d7d04d1ad3723570f0ed816fc7b26f7a59e6
Instruction ID: bdb108cfafa9f1cdcc7409949cd324263f4e997a2451ae80e5bc8139fa3aa837
Opcode Fuzzy Hash: d136dd3b171e80c30b784e322e85d7d04d1ad3723570f0ed816fc7b26f7a59e6
Instruction Fuzzy Hash: 4CE2A533A18BC585DB21CF35D8802ED77A1FB99798F449225EA9D57BA9DF38D280C700

Function 00007FF657424B70 Relevance: 46.8, APIs: 21, Strings: 5, Instructions: 1343registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF65742509B
RegQueryValueExA.ADVAPI32 ref: 00007FF6574250E9
RegCloseKey.ADVAPI32 ref: 00007FF657425186
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657426384
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574263A5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574263AB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574263B1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574263B7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574263BD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574263C3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574263C9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574263F0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574263F6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657426420
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657426426
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742642C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742644E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657426454
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742645A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657426466
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657426487

Strings

directory_iterator::directory_iterator, xrefs: 00007FF657426441
status, xrefs: 00007FF657426403, 00007FF657426413
filename, xrefs: 00007FF65742549A, 00007FF657425A28, 00007FF657425F59
content, xrefs: 00007FF6574255A3, 00007FF657425BF6, 00007FF657426120
exists, xrefs: 00007FF657426398, 00007FF6574263E3, 00007FF65742647A

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseOpenQueryValue
String ID: content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 1254564140-3429737954
Opcode ID: 0484900fd803400efa757a0dfc92e51f0ae5aa9f089a5afcf519a4fc0bf0611f
Instruction ID: b750e3315db13c7cf29c0f575542212b84130ad116daba89505caf5d1a1424f5
Opcode Fuzzy Hash: 0484900fd803400efa757a0dfc92e51f0ae5aa9f089a5afcf519a4fc0bf0611f
Instruction Fuzzy Hash: CFE2A172A18BC58AEB21CF35D8803ED7365FB85798F544225EB5C9BA99DF78D680C300

Function 00007FF657456350 Relevance: 46.6, APIs: 20, Strings: 6, Instructions: 1136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

directory_iterator::directory_iterator, xrefs: 00007FF65745A853, 00007FF65745A875, 00007FF65745A8AD
status, xrefs: 00007FF65745A600, 00007FF65745A6D9, 00007FF65745A790, 00007FF65745A863, 00007FF65745A885, 00007FF65745A89B, 00007FF65745A8BD
cannot use push_back() with , xrefs: 00007FF65745A625, 00007FF65745A6FE, 00007FF65745A7B5
recursive_directory_iterator::recursive_directory_iterator, xrefs: 00007FF65745A68F, 00007FF65745A6C9, 00007FF65745A81F
recursive_directory_iterator::operator++, xrefs: 00007FF65745A678, 00007FF65745A745, 00007FF65745A808
exists, xrefs: 00007FF65745A5DE, 00007FF65745A6AC, 00007FF65745A76E, 00007FF65745A83C

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: __std_fs_convert_wide_to_narrow$__std_fs_code_page
String ID: cannot use push_back() with $directory_iterator::directory_iterator$exists$recursive_directory_iterator::operator++$recursive_directory_iterator::recursive_directory_iterator$status
API String ID: 3645842244-1862120484
Opcode ID: de5a621f2f067d1123de94e788919e3c44fbe91b6b887da37095cf4d544f4034
Instruction ID: 7e63b3faa6e3d89730085064bef47a034c54e0a894dd3038a02e7655128e56b7
Opcode Fuzzy Hash: de5a621f2f067d1123de94e788919e3c44fbe91b6b887da37095cf4d544f4034
Instruction Fuzzy Hash: 76D2377291DBC985D6718B19F8812ABB3A0FBD9784F405225EACC93B59EF7CD254CB00

Function 00007FF657475B70 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 225
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00007FF657475BB1
GetSystemMetrics.USER32 ref: 00007FF657475BBF
GetSystemMetrics.USER32 ref: 00007FF657475BCD
GetSystemMetrics.USER32 ref: 00007FF657475BDB
GetDC.USER32 ref: 00007FF657475BE5
GetDeviceCaps.GDI32 ref: 00007FF657475BFB
GetDeviceCaps.GDI32 ref: 00007FF657475C0B
CreateCompatibleDC.GDI32 ref: 00007FF657475C18
CreateCompatibleBitmap.GDI32 ref: 00007FF657475C30
SelectObject.GDI32 ref: 00007FF657475C46
BitBlt.GDI32 ref: 00007FF657475C7C
SHCreateMemStream.SHLWAPI ref: 00007FF657475CB2
SelectObject.GDI32 ref: 00007FF657475CC8
DeleteDC.GDI32 ref: 00007FF657475CD1
ReleaseDC.USER32 ref: 00007FF657475CDC
DeleteObject.GDI32 ref: 00007FF657475CE5
EnterCriticalSection.KERNEL32 ref: 00007FF657475DDC
LeaveCriticalSection.KERNEL32 ref: 00007FF657475DEE
IStream_Size.SHLWAPI ref: 00007FF657475E25
IStream_Reset.SHLWAPI ref: 00007FF657475E36
IStream_Read.SHLWAPI ref: 00007FF657475EBB
SelectObject.GDI32 ref: 00007FF657475F15
DeleteDC.GDI32 ref: 00007FF657475F1E
ReleaseDC.USER32 ref: 00007FF657475F2B
DeleteObject.GDI32 ref: 00007FF657475F34

Strings

, xrefs: 00007FF657475C51

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Object$DeleteMetricsSystem$CreateSelectStream_$CapsCompatibleCriticalDeviceReleaseSection$BitmapEnterLeaveReadResetSizeStream
String ID:
API String ID: 3214587331-3916222277
Opcode ID: 312cd4efce3d3f241b15748fa518ee44aaca86f0cd571cabb29f5cbe721ad1f9
Instruction ID: 7a5aea4066504ead30eb18cb9db57f20b60d781454648bd50b0eea0a6d4860ec
Opcode Fuzzy Hash: 312cd4efce3d3f241b15748fa518ee44aaca86f0cd571cabb29f5cbe721ad1f9
Instruction Fuzzy Hash: AEB1663261CBC586E760DB22E8543AEB3A5FB89B80F548535DA8D93B59DF3CD049CB40

Function 00007FF65742D570 Relevance: 35.9, APIs: 17, Strings: 3, Instructions: 862
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00007FF65742D65C
GetProcAddress.KERNEL32 ref: 00007FF65742D767
GetProcAddress.KERNEL32 ref: 00007FF65742D829
GetProcAddress.KERNEL32 ref: 00007FF65742D8A3
GetProcAddress.KERNEL32 ref: 00007FF65742D925
GetProcAddress.KERNEL32 ref: 00007FF65742D99F
GetProcAddress.KERNEL32 ref: 00007FF65742DA23
FreeLibrary.KERNEL32 ref: 00007FF65742E551
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742E587
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742E5DB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742E5E1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742E5E7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742E5ED
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742E5F3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742E5F9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742E5FF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742E605

Strings

system, xrefs: 00007FF65742E35D
cannot use push_back() with , xrefs: 00007FF65742E59F
vault, xrefs: 00007FF65742E3B3

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$AddressProc$Library$FreeLoad
String ID: cannot use push_back() with $system$vault
API String ID: 2463004387-1741236777
Opcode ID: a6a59c18af7670b59bc8db2d804e6280ee695d707ca462872864001bed366d0c
Instruction ID: 5760072916cdad4fb99c0df1fa556a3daf91bad94b5ff6537a9e1ba3d2c4c574
Opcode Fuzzy Hash: a6a59c18af7670b59bc8db2d804e6280ee695d707ca462872864001bed366d0c
Instruction Fuzzy Hash: 82927E32615BC589DB60CF65E8843ED73A4FB49798F144225EB9C9BB99EF38D294C300

Function 00007FF657422CA0 Relevance: 32.3, APIs: 13, Strings: 5, Instructions: 789
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF657423022
RegQueryValueExA.ADVAPI32 ref: 00007FF65742306A
RegCloseKey.ADVAPI32 ref: 00007FF6574230F7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574239B0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574239CB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574239D1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574239EA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574239F0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657423A06
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657423A0C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657423A12
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657423A1E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657423A24

Strings

directory_iterator::directory_iterator, xrefs: 00007FF6574239DD
status, xrefs: 00007FF6574239F9
filename, xrefs: 00007FF657423500
content, xrefs: 00007FF657423694
exists, xrefs: 00007FF6574239BE

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseOpenQueryValue
String ID: content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 1254564140-3429737954
Opcode ID: 55073c4a13a67988c7fb6af169c0152cbc15cb834cd16cf16a3eff097d2b603e
Instruction ID: 885adee14472309f90fb8e5a0125e8c724dacbe7d11c2d51df0be6ec5c1d8298
Opcode Fuzzy Hash: 55073c4a13a67988c7fb6af169c0152cbc15cb834cd16cf16a3eff097d2b603e
Instruction Fuzzy Hash: B182A072A15BC989EB608F35DC403ED73A1FB89798F145221EA9DA7B99DF38D580C340

Function 00007FF6574220B0 Relevance: 28.7, APIs: 12, Strings: 4, Instructions: 684
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF657422409
RegQueryValueExA.ADVAPI32 ref: 00007FF65742244E
RegCloseKey.ADVAPI32 ref: 00007FF6574224F7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657422C2E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657422C4F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657422C55
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657422C71
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657422C77
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657422C7D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657422C83
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657422C8F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657422C95

Strings

directory_iterator::directory_iterator, xrefs: 00007FF657422C64
filename, xrefs: 00007FF657422787
content, xrefs: 00007FF657422915
exists, xrefs: 00007FF657422C42

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseOpenQueryValue
String ID: content$directory_iterator::directory_iterator$exists$filename
API String ID: 1254564140-1400943384
Opcode ID: 9af67377f11925a663454ec8dce1b67dae90635e141cdde338698ccf40839e8a
Instruction ID: 4e57cff1b94fd2fca72d341e381c15b77e331135c6349e71badec2d737d1ebc7
Opcode Fuzzy Hash: 9af67377f11925a663454ec8dce1b67dae90635e141cdde338698ccf40839e8a
Instruction Fuzzy Hash: 5A727473A15BC98ADB108F35D8803ED77A0FB89798F149225EA9C97B99DF38D590C340

Function 00007FF65745D080 Relevance: 28.6, APIs: 11, Strings: 5, Instructions: 599
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

directory_iterator::directory_iterator, xrefs: 00007FF65745DE23, 00007FF65745F4A4
status, xrefs: 00007FF65745DE11, 00007FF65745DE33, 00007FF65745DE5B, 00007FF65745DE83
cannot use push_back() with , xrefs: 00007FF65745DDD5
prefs.js, xrefs: 00007FF65745E5E2
exists, xrefs: 00007FF65745F48D

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID: cannot use push_back() with $directory_iterator::directory_iterator$exists$prefs.js$status
API String ID: 0-2713369562
Opcode ID: 4324af8ba447e6921d6eb0824aaa090a46b9a75f2e01d13aa1301f67cdf98709
Instruction ID: d0f4c466a9a56f4e29ef5ab28f97182877abb6c3a70e7801a8ea92333fd9764f
Opcode Fuzzy Hash: 4324af8ba447e6921d6eb0824aaa090a46b9a75f2e01d13aa1301f67cdf98709
Instruction Fuzzy Hash: 68524672909FC985E6B19B14F8813EAB3A4FBC9784F545225DACC92B59EF3CD194CB00

Function 00007FF6574AB5B0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32 ref: 00007FF6574AB65D
GetLastError.KERNEL32 ref: 00007FF6574AB667
FindFirstFileW.KERNEL32 ref: 00007FF6574AB67E
GetLastError.KERNEL32 ref: 00007FF6574AB68A
FindClose.KERNEL32 ref: 00007FF6574AB698
__std_fs_open_handle.LIBCPMT ref: 00007FF6574AB72B
CloseHandle.KERNEL32 ref: 00007FF6574AB741
CloseHandle.KERNEL32 ref: 00007FF6574AB8B4

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: ae06ef96b620ec177ea6819a3a1ac38214177ad565b87e13f1ccf53398ca1eb7
Instruction ID: e42198ad764afb21e756c4432ad9fb4d42bdbd0e76ed1692003af00d3dcaa144
Opcode Fuzzy Hash: ae06ef96b620ec177ea6819a3a1ac38214177ad565b87e13f1ccf53398ca1eb7
Instruction Fuzzy Hash: 66919331B08A4A46F7748B2AA8086796392AF457B4F5C4738D9BEE76D4DF3CE405C740

Function 00007FF65742CA10 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 671
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CredEnumerateA.ADVAPI32 ref: 00007FF65742CA72
CredFree.ADVAPI32 ref: 00007FF65742D496
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742D4CC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742D520
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742D526
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742D52C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742D532
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742D538
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742D53E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742D544
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742D54A

Strings

cannot use push_back() with , xrefs: 00007FF65742D4E4

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Cred$EnumerateFree
String ID: cannot use push_back() with
API String ID: 1347986415-4122110429
Opcode ID: 275b72974d5a0cb4b812445be63748dfb7004025d706ee1fc87d418026cb14af
Instruction ID: 0e0f4afe77c77ab8ad59dbe3d6116378a85f4528eb0fbf2aa40dd680cf094118
Opcode Fuzzy Hash: 275b72974d5a0cb4b812445be63748dfb7004025d706ee1fc87d418026cb14af
Instruction Fuzzy Hash: 1F629272A14BC589EB20CF25E8803ED7761F789798F544325EAAC97B99DF38D294C700

Function 00007FF657439F80 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 417
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF65743A134
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF65743A142
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF65743A3C5
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF65743A3D3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65743A570
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65743A576
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65743A599
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65743A59F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65743A5A5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65743A5C8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65743A5CE

Strings

value, xrefs: 00007FF65743A05A, 00007FF65743A2F3

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: 1ec0bf771c0b68ca24b6e45f7a102435d3da6e528fde54be765326c3527b2b7c
Instruction ID: 261cad06a2c009192c16bfd7348fbe5730f976ae9f1344bcb07fa310b1873a0e
Opcode Fuzzy Hash: 1ec0bf771c0b68ca24b6e45f7a102435d3da6e528fde54be765326c3527b2b7c
Instruction Fuzzy Hash: 1A029262A68BC985EB00CB74D4403BD6761EB957A4F145232FA9DA2BDADF3CD1C5C700

Function 00007FF65746C600 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF65746F820: GetCurrentProcess.KERNEL32 ref: 00007FF65746F85B
Part of subcall function 00007FF65746F820: OpenProcessToken.ADVAPI32 ref: 00007FF65746F86E
Part of subcall function 00007FF65746F820: GetTokenInformation.KERNELBASE ref: 00007FF65746F8AA
Part of subcall function 00007FF65746F820: CloseHandle.KERNEL32 ref: 00007FF65746F8CB

ExitProcess.KERNEL32 ref: 00007FF65746C647
OpenMutexA.KERNEL32 ref: 00007FF65746C762
ExitProcess.KERNEL32 ref: 00007FF65746C772

Part of subcall function 00007FF65746FB60: GetModuleFileNameW.KERNEL32 ref: 00007FF65746FBAA

Part of subcall function 00007FF65747A780: CoInitializeEx.OLE32 ref: 00007FF65747A7EA

Strings

SeImpersonatePrivilege, xrefs: 00007FF65746C65A
SeDebugPrivilege, xrefs: 00007FF65746C64E

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Process$ExitOpenToken$CloseCurrentFileHandleInformationInitializeModuleMutexName
String ID: SeDebugPrivilege$SeImpersonatePrivilege
API String ID: 3348294976-3768118664
Opcode ID: e8bf1daaaefda9d852adcb0abd1cfab001f1450a76a9ecba07eb59928d84f095
Instruction ID: 8e18fe92a126db42ffe8ff7ec1cea2c9cd93eee7f51912f348ae39c2bab3e4d8
Opcode Fuzzy Hash: e8bf1daaaefda9d852adcb0abd1cfab001f1450a76a9ecba07eb59928d84f095
Instruction Fuzzy Hash: 6061C362E1CB8F81FA20AB65E8453BEA350FF85780F585531E68DE26D7DF2CE1458B40

Function 00007FF657455970 Relevance: 17.8, Strings: 14, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

chrome_key, xrefs: 00007FF65745C851, 00007FF65745C97F
directory_iterator::directory_iterator, xrefs: 00007FF65745A5A5, 00007FF65745A853, 00007FF65745A875, 00007FF65745A8AD, 00007FF65745CA83, 00007FF65745DE23, 00007FF65745F4A4, 00007FF65745F78C
status, xrefs: 00007FF65745A5B5, 00007FF65745A600, 00007FF65745A6D9, 00007FF65745A790, 00007FF65745A863, 00007FF65745A885, 00007FF65745A89B, 00007FF65745A8BD, 00007FF65745CA99, 00007FF65745DE11, 00007FF65745DE33, 00007FF65745DE5B, 00007FF65745DE83, 00007FF65745F764
recursive_directory_iterator::recursive_directory_iterator, xrefs: 00007FF65745A68F, 00007FF65745A6C9, 00007FF65745A81F
recursive_directory_iterator::operator++, xrefs: 00007FF65745A678, 00007FF65745A745, 00007FF65745A808
@, xrefs: 00007FF65745A32B
., xrefs: 00007FF657455C70
exists, xrefs: 00007FF657455F90, 00007FF65745A58E, 00007FF65745A5DE, 00007FF65745A6AC, 00007FF65745A76E, 00007FF65745A83C, 00007FF65745CA70, 00007FF65745D060, 00007FF65745F48D, 00007FF65745F779
key, xrefs: 00007FF65745C60E, 00007FF65745C740
cannot use push_back() with , xrefs: 00007FF65745A625, 00007FF65745A6FE, 00007FF65745A7B5, 00007FF65745DDD5
filename, xrefs: 00007FF657456D9C, 00007FF6574578E3, 00007FF657458376, 00007FF657458E23, 00007FF657459793, 00007FF657459F35, 00007FF65745D5FC, 00007FF65745DAE0
prefs.js, xrefs: 00007FF65745E5E2
content, xrefs: 00007FF657456EB7, 00007FF6574579CA, 00007FF65745845D, 00007FF657458F0A, 00007FF6574598AE, 00007FF65745A03E, 00007FF65745D6B3, 00007FF65745DB94
@, xrefs: 00007FF657459B9B

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID: .$@$@$cannot use push_back() with $chrome_key$content$directory_iterator::directory_iterator$exists$filename$key$prefs.js$recursive_directory_iterator::operator++$recursive_directory_iterator::recursive_directory_iterator$status
API String ID: 0-4287193513
Opcode ID: 8adc91dd6644a2bfb7387dc78b72df08f999bd5353c1b7ff9b33895fcf5abe12
Instruction ID: 51fd86f0c0c876335e907caaeb994a5e6681e0c010f07c47e828defb26105497
Opcode Fuzzy Hash: 8adc91dd6644a2bfb7387dc78b72df08f999bd5353c1b7ff9b33895fcf5abe12
Instruction Fuzzy Hash: 66C19632A08BCA86EB60DF26E44417DA3A2FB45794F594231EB9DA3794DF7CE841C740

Function 00007FF657475240 Relevance: 16.9, APIs: 11, Instructions: 408networkfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET ref: 00007FF65747540B
InternetOpenUrlA.WININET ref: 00007FF6574754E8
HttpQueryInfoW.WININET ref: 00007FF657475549
HttpQueryInfoW.WININET ref: 00007FF6574755E2
InternetQueryDataAvailable.WININET ref: 00007FF657475626
InternetReadFile.WININET ref: 00007FF6574756E9
InternetQueryDataAvailable.WININET ref: 00007FF6574757B4
InternetCloseHandle.WININET ref: 00007FF65747585E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574758AF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574758B5
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6574758BB

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Internet$Query$AvailableDataHttpInfoOpen_invalid_parameter_noinfo_noreturn$CloseConcurrency::cancel_current_taskFileHandleRead
String ID:
API String ID: 1352168858-0
Opcode ID: ef6e7d4f95dddb1cb3c0e321d1feb2c90d8b961ed0750ffe4496b9a970b0c3ae
Instruction ID: 3b0138bf2fd85ed85fe8b5ab6212ec7daaafc119d8c4b0966933a034874863ea
Opcode Fuzzy Hash: ef6e7d4f95dddb1cb3c0e321d1feb2c90d8b961ed0750ffe4496b9a970b0c3ae
Instruction Fuzzy Hash: 5902A532A18B9986E710CB6AE84036EB7B5FB95794F144225EF9C67B98DF3CD081C740

Function 00007FF65742E610 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 328processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF65742E65A
Process32FirstW.KERNEL32 ref: 00007FF65742E69C
Process32NextW.KERNEL32 ref: 00007FF65742E893
CloseHandle.KERNEL32 ref: 00007FF65742EB0A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742EBA3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742EBA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742EBAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742EBB5

Strings

[PID: , xrefs: 00007FF65742E6DE

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 1946380282-2210602247
Opcode ID: 144d5edde50ff663e48a7222faab92e9bc3350a17fd4ea8b8e75c71c1e4ac4de
Instruction ID: 41c7b5e9c86b8622d1cf72d3768001d04d3f0cc6aa78f96ae7caaa2d5b8d48b8
Opcode Fuzzy Hash: 144d5edde50ff663e48a7222faab92e9bc3350a17fd4ea8b8e75c71c1e4ac4de
Instruction Fuzzy Hash: 0CE1F633A18BC585EB20CF25E8843ED77A5FB89794F544225EA9D97B99DF38D280C700

Function 00007FF65742ECB0 Relevance: 15.7, APIs: 10, Instructions: 715COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742F9A1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742F9A7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742F9AD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742F9B3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742F9B9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742F9BF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742F9C5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742F9CB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742F9D1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742F9D7

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 8caf2f907e486ab25cfc440f8e0b470af06a6288497146a4c084e291fbf1930d
Instruction ID: 613d3f727fa08ff81a5fd92d8b19e198534d56393e0e8847607dc417a8def15b
Opcode Fuzzy Hash: 8caf2f907e486ab25cfc440f8e0b470af06a6288497146a4c084e291fbf1930d
Instruction Fuzzy Hash: 8B725F72A19BC989EB20CB65E8403AD73A1F789798F544325EEDCA7B99DF38D150C700

Function 00007FF65746F020 Relevance: 14.5, APIs: 4, Strings: 4, Instructions: 451fileCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32 ref: 00007FF65746F261
SetFilePointer.KERNEL32 ref: 00007FF65746F314
ReadFile.KERNEL32 ref: 00007FF65746F343
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65746F7D7

Strings

ios_base::failbit set, xrefs: 00007FF65746F77D
ios_base::eofbit set, xrefs: 00007FF65746F784
ios_base::badbit set, xrefs: 00007FF65746F771, 00007FF65746F7EF
exists, xrefs: 00007FF65746F7CA

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: File$PointerReadSize_invalid_parameter_noinfo_noreturn
String ID: exists$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2478245620-15404121
Opcode ID: 8cdf98b74691f3bd8b70ec143bc6e60ee69bb8cc810ea23612f5f3421e56b4bf
Instruction ID: ae9c275deb37e5b0a868dc2bd866e9ba6cdaded8716c5bfdc0c7a80ce63cdcc0
Opcode Fuzzy Hash: 8cdf98b74691f3bd8b70ec143bc6e60ee69bb8cc810ea23612f5f3421e56b4bf
Instruction Fuzzy Hash: EB32F972A14BC989EB20CF24D8807ED37A1FB45788F548236DA8DA7B59EF78D645C700

Function 00007FF657492E3C Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF657492E81

Part of subcall function 00007FF6574924E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6574924FC

Part of subcall function 00007FF65748D3C8: RtlFreeHeap.NTDLL ref: 00007FF65748D3DE
Part of subcall function 00007FF65748D3C8: GetLastError.KERNEL32 ref: 00007FF65748D3E8

Part of subcall function 00007FF657488284: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF657488233,?,?,?,?,-2723E8D8DEBC5093,00007FF65748811E), ref: 00007FF65748828D
Part of subcall function 00007FF657488284: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF657488233,?,?,?,?,-2723E8D8DEBC5093,00007FF65748811E), ref: 00007FF6574882B2

Part of subcall function 00007FF65749BA84: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65749B9CF

_get_daylight.LIBCMT ref: 00007FF657492E70

Part of subcall function 00007FF657492548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65749255C

_get_daylight.LIBCMT ref: 00007FF6574930E6
_get_daylight.LIBCMT ref: 00007FF6574930F7
_get_daylight.LIBCMT ref: 00007FF657493108
GetTimeZoneInformation.KERNEL32(00007FF6574933F8), ref: 00007FF65749312F

Strings

Eastern Summer Time, xrefs: 00007FF6574931ED
Eastern Standard Time, xrefs: 00007FF6574931D5

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: d27e707e32a7a668b79f18f39980f86f66c1361dc0c94ac41fd5faca01788e5a
Instruction ID: e26410583c8652792c8a90bbd3d2ecf38af60ed1f2011c21aab6755ca5b2b4cd
Opcode Fuzzy Hash: d27e707e32a7a668b79f18f39980f86f66c1361dc0c94ac41fd5faca01788e5a
Instruction Fuzzy Hash: 25D1D122F1825A86EB20DF25DA415B96761FFA4B94F4C8135EE0DE7A86DF3CE441C780

Function 00007FF6574B0658 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6574B023C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6574B027D
Part of subcall function 00007FF6574B023C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6574B02FB
Part of subcall function 00007FF6574B023C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6574B034C

CreateFileW.KERNEL32 ref: 00007FF6574B075E
CreateFileW.KERNEL32 ref: 00007FF6574B07AE
GetLastError.KERNEL32 ref: 00007FF6574B07DE
GetFileType.KERNEL32 ref: 00007FF6574B07F3
GetLastError.KERNEL32 ref: 00007FF6574B07FD
CloseHandle.KERNEL32 ref: 00007FF6574B0830
CloseHandle.KERNEL32 ref: 00007FF6574B0993
CreateFileW.KERNEL32 ref: 00007FF6574B09C8
GetLastError.KERNEL32 ref: 00007FF6574B09D7

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 9219a76bbf5b0a68fd8075754a2c2160bfaa822f6e476498c8a23ea95eed312f
Instruction ID: ec28f4672858e380810cad32e7c00f64c054080cb8c0e531e976b2d399a9a305
Opcode Fuzzy Hash: 9219a76bbf5b0a68fd8075754a2c2160bfaa822f6e476498c8a23ea95eed312f
Instruction Fuzzy Hash: FFC1B136B24A498AEB10CF69C4906BC3761FB49B98F195335DE1EA73A4CF38E555C340

Function 00007FF6574930B8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6574930E6

Part of subcall function 00007FF657492548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65749255C

_get_daylight.LIBCMT ref: 00007FF6574930F7

Part of subcall function 00007FF6574924E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6574924FC

_get_daylight.LIBCMT ref: 00007FF657493108

Part of subcall function 00007FF657492518: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65749252C

Part of subcall function 00007FF65748D3C8: RtlFreeHeap.NTDLL ref: 00007FF65748D3DE
Part of subcall function 00007FF65748D3C8: GetLastError.KERNEL32 ref: 00007FF65748D3E8

GetTimeZoneInformation.KERNEL32(00007FF6574933F8), ref: 00007FF65749312F

Strings

Eastern Summer Time, xrefs: 00007FF6574931ED
Eastern Standard Time, xrefs: 00007FF6574931D5

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: a0b2f147c5ed72e73a9ba99eccd64d774068bd057930b9dd808764ab5dc4e304
Instruction ID: dbb2115926e8023962db329352a232b5536ef994d22d60bc4509c83aff4c1e2a
Opcode Fuzzy Hash: a0b2f147c5ed72e73a9ba99eccd64d774068bd057930b9dd808764ab5dc4e304
Instruction Fuzzy Hash: 21519132B1864A86E720DF21E9815B97760FF99B84F4C5135EA4DE3A96DF3CF4008780

Function 00007FF65748918C Relevance: 9.2, APIs: 6, Instructions: 227COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6574891AE
_get_daylight.LIBCMT ref: 00007FF65748920E
_get_daylight.LIBCMT ref: 00007FF65748921F
_get_daylight.LIBCMT ref: 00007FF657489230
_isindst.LIBCMT ref: 00007FF657489281
_isindst.LIBCMT ref: 00007FF6574892D4

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _get_daylight$_isindst$_invalid_parameter_noinfo
String ID:
API String ID: 1405656091-0
Opcode ID: cd6fea744430340711cd49b3e9bdbfdb1b852b0eb5a7692198664b91c055b650
Instruction ID: ba376dbb9008af944c586a3c09b76bbbeacc61b48cc2110fd5d9d5a9f36733a5
Opcode Fuzzy Hash: cd6fea744430340711cd49b3e9bdbfdb1b852b0eb5a7692198664b91c055b650
Instruction Fuzzy Hash: FC81C6B2F0864E4BEB588F25C9457BC63A5EB54B88F0C9135DA0DDA789EF3CE5418780

Function 00007FF657476860 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 268COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657476C4B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657476C51
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657476C57
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657476C5D

Strings

cores, xrefs: 00007FF657476ABE

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: cores
API String ID: 3668304517-2370456839
Opcode ID: fe515266003fe55dfc7e8ae5ee8a2d40e19cf9c944be5782509e409a5110e389
Instruction ID: 8bd7fae0c156374eb7a275a2f3f82fad9063889dcd2a796dce6cf956fdb00ecd
Opcode Fuzzy Hash: fe515266003fe55dfc7e8ae5ee8a2d40e19cf9c944be5782509e409a5110e389
Instruction Fuzzy Hash: 2CC1F763E18B858AF710CF78D4403AD7762F7997A8F145325EAAC62A9ADF38D185C340

Function 00007FF65747B9B0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF65747B9FE
OpenProcessToken.ADVAPI32 ref: 00007FF65747BA11
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF65747BA32
AdjustTokenPrivileges.KERNELBASE ref: 00007FF65747BA78
CloseHandle.KERNEL32 ref: 00007FF65747BA98

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3038321057-0
Opcode ID: d2de06470b4ed8e39d37734a47601b9eff7cf65b32299141bc4bcc42cf026e17
Instruction ID: 6df4838acf1c0d3073c0c7477c608c1c8a9a8869378fe45d18dfcfbfc89a7afc
Opcode Fuzzy Hash: d2de06470b4ed8e39d37734a47601b9eff7cf65b32299141bc4bcc42cf026e17
Instruction Fuzzy Hash: E9219E32618B8486E720CF22F44436AB3A4FB88B84F598135EA8DA3B58DF7CD445CB40

Function 00007FF65741F730 Relevance: 4.8, APIs: 3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36858761d405c8643adca0cf25a5f486efcbae373011479bc70ee2842979bacb
Instruction ID: 822c838a20f9a0716272525d77e5e610fd4057cb714758b09e1af1e0dbcd3bc6
Opcode Fuzzy Hash: 36858761d405c8643adca0cf25a5f486efcbae373011479bc70ee2842979bacb
Instruction Fuzzy Hash: 2CF16172A19F888AEB20CB69E44136D77A4F788798F144325EEDC57B99EF3CD1918700

Function 00007FF657420450 Relevance: 4.8, APIs: 3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4f4003e368775a12f3e26b8bcd7a19ab426d4c5a44f7e389710894b07600909
Instruction ID: 1db5b59c67311b55473e270570d3778702cbd64cdd8eccf9a25003db38b826a8
Opcode Fuzzy Hash: a4f4003e368775a12f3e26b8bcd7a19ab426d4c5a44f7e389710894b07600909
Instruction Fuzzy Hash: 7EF15372A15F8889EB608B69E84036D77A4F788798F104325EEDD97B99EF3CD1908740

Function 00007FF65741FE20 Relevance: 4.8, APIs: 3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5c8e505c1d7a2333d561fde428fcf7b6707646c04ef95b1d6c81df208e18fc9
Instruction ID: c4b0bd206011d71ec485d7e9a292572f0e74e880742cd5b9c20b67ef01a6a91f
Opcode Fuzzy Hash: d5c8e505c1d7a2333d561fde428fcf7b6707646c04ef95b1d6c81df208e18fc9
Instruction Fuzzy Hash: 29F16572A19F8889E7608B69E84036DB7A4F788798F104325EEDD97B99DF3CD190C740

Function 00007FF6574776A0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 217timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 00007FF6574779D0

Strings

[UTC, xrefs: 00007FF6574779A3

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: InformationTimeZone
String ID: [UTC
API String ID: 565725191-1715286942
Opcode ID: 227df7f9fc515862566a01e59866b53c9bfa63972a69ca4c12e822ae5807cade
Instruction ID: 609c9f72cc1fcc6e504f6577d71ff3c3400d26cd2dfb4da3137dd5ef77f5de9e
Opcode Fuzzy Hash: 227df7f9fc515862566a01e59866b53c9bfa63972a69ca4c12e822ae5807cade
Instruction Fuzzy Hash: 62B14D32A09FC88AD7318F29E84129AB7A4F79D788F145325EACC57B59DF78D250CB40

Function 00007FF6574773F0 Relevance: 3.1, APIs: 2, Instructions: 137COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32 ref: 00007FF657477461

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: 8e3b062baa65b3adcedbfaa3c8c3a2baafa25a4fda972cf0885935351d305318
Instruction ID: bb2932e0921d6594e596c033e1405138be5b542cee7632f52a54d86d1054b260
Opcode Fuzzy Hash: 8e3b062baa65b3adcedbfaa3c8c3a2baafa25a4fda972cf0885935351d305318
Instruction Fuzzy Hash: 9651D532E18B8486E710CF24E4803AE7775FB84798F545225EB9C63AA9DF7CE591C740

Function 00007FF657467BA0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 00007FF657467BF8
LocalFree.KERNEL32 ref: 00007FF657467C8A

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 3f0d2640eba4d0f7871c2ec703edcb503dbe0d7ea7d03094cd3af9045bbe76bf
Instruction ID: 98bbe1f4e9da6cbcd3a7941503c89f96e7ec2cb3fb117d8fe02cb1d1b23fdbd4
Opcode Fuzzy Hash: 3f0d2640eba4d0f7871c2ec703edcb503dbe0d7ea7d03094cd3af9045bbe76bf
Instruction Fuzzy Hash: D1412932A18B85CEE3208F74D4403AD77A4FB5874CF484235EA8D56E4ADF79D664C744

Function 00007FF657421B90 Relevance: 1.8, APIs: 1, Instructions: 283COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657421FD2

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: d12017943797bcc216a0679c74680cc699fdba263cc3b3351d69ab3b0d2667b8
Instruction ID: 44c61180e22422a9357b27d618298707575ef1bbb2da47fa8c90e8248be3bf7a
Opcode Fuzzy Hash: d12017943797bcc216a0679c74680cc699fdba263cc3b3351d69ab3b0d2667b8
Instruction Fuzzy Hash: 55D17162F18B8999F711CB74D8403EC37B2EB5578CF055235EA5CA6B99DF38A1A0C384

Function 00007FF657476150 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00007FF657476195

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 543acbdf146a9e7b635a600a3cba3d05f3b2ef6cd278b1f660c9ea2185c3ff0f
Instruction ID: ef7c6004a50e2c471199765c097d08aaf26dad51714f839762c43b8afa5ee462
Opcode Fuzzy Hash: 543acbdf146a9e7b635a600a3cba3d05f3b2ef6cd278b1f660c9ea2185c3ff0f
Instruction Fuzzy Hash: 5701843291878586E721CF21E8403AEB3A4FB98788F584231E68D92659DFBCD194CB40

Function 00007FF65747D050 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

\u%04x, xrefs: 00007FF65747D242

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID: \u%04x
API String ID: 0-2916071157
Opcode ID: 9ac3e7affe24433a80f30ef63aa62ecbe97607ee0ab98c7cb77dcaf1733d29dc
Instruction ID: df801f15b6274b45a2d40d08deb92e2be1a79da86a74d305ee7b7af5a2bad4fb
Opcode Fuzzy Hash: 9ac3e7affe24433a80f30ef63aa62ecbe97607ee0ab98c7cb77dcaf1733d29dc
Instruction Fuzzy Hash: EB812822B286AA82EA50DF25D5506BE6760FB85B84F4C8032DF4EA3795DF3CE517C700

Function 00007FF65747C5CB Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

": , xrefs: 00007FF65747C6B1, 00007FF65747C75E

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID: ":
API String ID: 0-3662656813
Opcode ID: 660d6f00807016dc76b74e4b7695fc7a76c9fcf9ec0793cee634f5a0be15179d
Instruction ID: b554d25ce5d266bf1406b0038f5032a98646cda5a18d84974ff82ed090c69ff1
Opcode Fuzzy Hash: 660d6f00807016dc76b74e4b7695fc7a76c9fcf9ec0793cee634f5a0be15179d
Instruction Fuzzy Hash: 8D914876708A8A81DB20DF2AD1946AD73A1FB89FC8F489022CF5E57B64CF39D459C700

Function 00007FF657435310 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 00007FF657435399

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
API String ID: 0-1713319389
Opcode ID: a7242879f608aa47813c865fc74e262a7c273f84777ad565790803f492419e94
Instruction ID: 65d027e842c102b8822ab4ebdf78ea62211dbe7560c3cddcca5a49826a6c579b
Opcode Fuzzy Hash: a7242879f608aa47813c865fc74e262a7c273f84777ad565790803f492419e94
Instruction Fuzzy Hash: 4641066361D6E44AD702CB39841127DBFB2E366B89F2CC162D7D897746CA2DD206CB10

Function 00007FF65746EBF0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 194
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF65746E970: InitializeCriticalSectionEx.KERNEL32 ref: 00007FF65746E9C1
Part of subcall function 00007FF65746E970: GetLastError.KERNEL32 ref: 00007FF65746E9CB

EnterCriticalSection.KERNEL32 ref: 00007FF65746EC31
GdiplusStartup.GDIPLUS ref: 00007FF65746EC58
LeaveCriticalSection.KERNEL32 ref: 00007FF65746EC66
LeaveCriticalSection.KERNEL32 ref: 00007FF65746EC94
GdipGetImageEncodersSize.GDIPLUS ref: 00007FF65746ECA2
GdipGetImageEncoders.GDIPLUS ref: 00007FF65746ED36
GdipCreateBitmapFromScan0.GDIPLUS ref: 00007FF65746EE00
GdipSaveImageToStream.GDIPLUS ref: 00007FF65746EE1E
GdipDisposeImage.GDIPLUS ref: 00007FF65746EE83
GdipDisposeImage.GDIPLUS ref: 00007FF65746EE97

Strings

&, xrefs: 00007FF65746EDFA

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream
String ID: &
API String ID: 1703174404-3042966939
Opcode ID: dd964381881d80bb3d13f7f21f812b9ad7ab8c9b9795b3d442a88d8ae0dd4017
Instruction ID: 844adfa6bf0f8adbe7569aad9f7cccbda74777e9fae88bfa59299485084c18b2
Opcode Fuzzy Hash: dd964381881d80bb3d13f7f21f812b9ad7ab8c9b9795b3d442a88d8ae0dd4017
Instruction Fuzzy Hash: BA91A432A04B9ACAEB20CF61D8005A977E4FB54798F5C8535DA0DA7B94DF3CE655C340

Function 00007FF65746FCA0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 226
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6574758D0: GetUserGeoID.KERNEL32 ref: 00007FF6574758F7
Part of subcall function 00007FF6574758D0: GetGeoInfoA.KERNEL32 ref: 00007FF657475911
Part of subcall function 00007FF6574758D0: GetGeoInfoA.KERNEL32 ref: 00007FF657475961

Part of subcall function 00007FF657431900: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574319D4

WSAStartup.WS2_32 ref: 00007FF65746FDBE
socket.WS2_32 ref: 00007FF65746FDDB
htons.WS2_32 ref: 00007FF65746FE00
inet_pton.WS2_32 ref: 00007FF65746FE42
connect.WS2_32 ref: 00007FF65746FE5C
closesocket.WS2_32 ref: 00007FF65746FE7B
WSACleanup.WS2_32 ref: 00007FF65746FE81
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657470025
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65747002B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657470031

Strings

system, xrefs: 00007FF65746FD2A
geo, xrefs: 00007FF65746FD6B

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Info$CleanupStartupUserclosesocketconnecthtonsinet_ptonsocket
String ID: geo$system
API String ID: 2440148987-2364779556
Opcode ID: e8271e983705af4b2aa253081ecfa30201b307be6f0b7d1d62185bed54f030f7
Instruction ID: 374b962b7b9ae38ca56d90a62a5e2c837941254f4ee7e2a318c98b9c2f3b94be
Opcode Fuzzy Hash: e8271e983705af4b2aa253081ecfa30201b307be6f0b7d1d62185bed54f030f7
Instruction Fuzzy Hash: 45B1B262F19A8A85FB00CBB4D8402BC3372AF54798F495236DA6DB76E9DE3CD546C340

Function 00007FF657474A30 Relevance: 19.9, APIs: 13, Instructions: 417
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

recv.WS2_32 ref: 00007FF657474C0C
recv.WS2_32 ref: 00007FF6574750EC
closesocket.WS2_32 ref: 00007FF6574750FE
WSACleanup.WS2_32 ref: 00007FF657475104
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574751FC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657475202
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657475208
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65747520E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657475214
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65747521A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657475226
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65747522C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657475232

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$recv$Cleanupclosesocket
String ID:
API String ID: 3402187201-0
Opcode ID: c00457efa61fc2d610e2d38ef845e853f42a4f57b555c559ada75c36dd3cd7b1
Instruction ID: 70ce6d2bc59bc526c45822675f78728c2d5da9f8b60844dacbf86cb3a11eb436
Opcode Fuzzy Hash: c00457efa61fc2d610e2d38ef845e853f42a4f57b555c559ada75c36dd3cd7b1
Instruction Fuzzy Hash: E612A172A1CBC981EA20DB15E4443EEA361FBC9790F144631EAAD97ADADF7CD481C740

Function 00007FF657477A84 Relevance: 16.9, APIs: 11, Instructions: 356COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657477FE0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657477FE6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657477FEC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657477FF2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657477FF8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657477FFE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657478004
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65747800A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657478010
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657478016
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65747801C

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: e10eb60b09ac83542fdacc07b71fa8c5cad471d1c77b60b8b411063cfbae12ae
Instruction ID: e786eeedd4b72f81484832485eae9edbb08420a8314c57f4b54bf83499a8c209
Opcode Fuzzy Hash: e10eb60b09ac83542fdacc07b71fa8c5cad471d1c77b60b8b411063cfbae12ae
Instruction Fuzzy Hash: 9BE1F563E28BC989EB118B74C4403FD6711EB997A8F145721EA7C66ADADF78D1C1C340

Function 00007FF65749092C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF657490D59

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f3fc50aa6c1617f97820c214b6f357f8593fa625a947542fe4ec2dfdbb2d532b
Instruction ID: 26ac49ccf2ff31c502aeeb316908ab7ea30a0658e3874bff95613cb4f97bd5dd
Opcode Fuzzy Hash: f3fc50aa6c1617f97820c214b6f357f8593fa625a947542fe4ec2dfdbb2d532b
Instruction Fuzzy Hash: B1C1E022A0CB8F92E7608B5595043BE7BA5FBA1B84F5D0131EA4DA77A1DF7CE845C340

Function 00007FF657477151 Relevance: 9.2, APIs: 6, Instructions: 163registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF657477169
RegEnumKeyExA.KERNEL32 ref: 00007FF6574771AE
RegCloseKey.ADVAPI32 ref: 00007FF6574773A4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574773D7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574773E3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574773E9

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseEnumOpen
String ID:
API String ID: 2177193445-0
Opcode ID: 8e5eb19068908a0246fe692763bd47c61a41966e209536983c2467e7175155ec
Instruction ID: d9150a91c5a98702feddf2256acd4a1847765e07e260b044a899da44b6585abe
Opcode Fuzzy Hash: 8e5eb19068908a0246fe692763bd47c61a41966e209536983c2467e7175155ec
Instruction Fuzzy Hash: 9771A372A08B8986FB11CB65E44436E6760FB857A8F544225EFAC63AD9DF7CE0C1C740

Function 00007FF65746EA50 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF65746EA93
EnterCriticalSection.KERNEL32 ref: 00007FF65746EAA5
EnterCriticalSection.KERNEL32 ref: 00007FF65746EAB5
GdiplusShutdown.GDIPLUS ref: 00007FF65746EAC3
LeaveCriticalSection.KERNEL32 ref: 00007FF65746EAD0
LeaveCriticalSection.KERNEL32 ref: 00007FF65746EADA

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: f5a1ecfcc53808b035d0d15b7c47fae7049546fa7d089acffeffd9e0bb2d86bb
Instruction ID: b7120f749d84f57349ea423b476a67a2a7992ff34e567df55b161a3b68387d9b
Opcode Fuzzy Hash: f5a1ecfcc53808b035d0d15b7c47fae7049546fa7d089acffeffd9e0bb2d86bb
Instruction Fuzzy Hash: 93116D32515B95C1EB108F66E84402CB3B8FB48FA97688635D65D922A4DF38D99AC740

Function 00007FF65745F7A0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65745FB09
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65745FB0F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65745FB15
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65745FB1B

Strings

exists, xrefs: 00007FF65745FAE7, 00007FF65745FAFC

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: exists
API String ID: 3668304517-2996790960
Opcode ID: e0ca86984dcd63806b142e340e89520d029b4b1e41b0c09aa18580b05522bf4e
Instruction ID: fe6b4e08aa832d1ceb47a2b12f589db7f670503a971cb7282452b42ed13411bc
Opcode Fuzzy Hash: e0ca86984dcd63806b142e340e89520d029b4b1e41b0c09aa18580b05522bf4e
Instruction Fuzzy Hash: E4A1D9B3E14B8A95EB10DF28E8402AD7371FB84798F145635EA9DA7AD8DF38D581C700

Function 00007FF65745CAB0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65745CE19
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65745CE1F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65745CE25
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65745CE2B

Strings

exists, xrefs: 00007FF65745CDF7, 00007FF65745CE0C

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: exists
API String ID: 3668304517-2996790960
Opcode ID: e207551f326048aa0344b556460f67db7219f5dab07e3a915515719821886c2f
Instruction ID: b92e9c16c16bda76b226907a381d8f79353aa5196b3143994b9762e9e6b753a2
Opcode Fuzzy Hash: e207551f326048aa0344b556460f67db7219f5dab07e3a915515719821886c2f
Instruction Fuzzy Hash: 2DA1D973E15B8A86EB10DF28E8403AD7361FB44798F145635EA6DA7AA8DF3CD581C340

Function 00007FF6574770E0 Relevance: 7.6, APIs: 5, Instructions: 96registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF657477169
RegEnumKeyExA.KERNEL32 ref: 00007FF6574771AE

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: EnumOpen
String ID:
API String ID: 3231578192-0
Opcode ID: d80f14cf87453080268adb68deae75d6ba4fc3d7dfc0e44dc0fd8621660a0c44
Instruction ID: 08d0244ca78d3860b8fab2590960644b02d7c707065b2acd42039fad26c76d95
Opcode Fuzzy Hash: d80f14cf87453080268adb68deae75d6ba4fc3d7dfc0e44dc0fd8621660a0c44
Instruction Fuzzy Hash: 7431A332A14B898AF721CF62E8446AE7364FB84798F640235EE9D67B54DF3CD196C700

Function 00007FF657470040 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 333COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65747064D

Strings

ios_base::badbit set, xrefs: 00007FF657470685, 00007FF6574706BC, 00007FF6574706FA
exists, xrefs: 00007FF657470663

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: exists$ios_base::badbit set
API String ID: 3668304517-2074760687
Opcode ID: 251402e7420da2ead8ba1bd0c3dccd2602787270a5690e69df45a2fd1f47fa14
Instruction ID: 7ba918fd6d6302f6d2dc653b1a20518f7e0b05a03d887afafb627d36425af311
Opcode Fuzzy Hash: 251402e7420da2ead8ba1bd0c3dccd2602787270a5690e69df45a2fd1f47fa14
Instruction Fuzzy Hash: 9FF16172A1DBCA95EA60DB14E4843EEB360FBC5744F844132DA8DA3AA9DF3CD545CB00

Function 00007FF657470730 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 325COMMON

Download Yara Rule

Strings

ios_base::badbit set, xrefs: 00007FF657470D5D, 00007FF657470D94, 00007FF657470DD2
exists, xrefs: 00007FF657470D3B

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID: exists$ios_base::badbit set
API String ID: 0-2074760687
Opcode ID: 5b977293777dbd88c53bfc92784d430d9a86450b18bc35ff0c7de3bd3942fd7d
Instruction ID: 539c79659fab3da869e32af3396305fa3ad0a26ff78a28c65fcdcbbed7bdf15d
Opcode Fuzzy Hash: 5b977293777dbd88c53bfc92784d430d9a86450b18bc35ff0c7de3bd3942fd7d
Instruction Fuzzy Hash: 70F16172A1DBCA91EA20DB14E4843FEA360FBC4784F444136DA8DA3AA9DF7CD545CB40

Function 00007FF657427AA0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6574773F0: GetLogicalDriveStringsW.KERNEL32 ref: 00007FF657477461

Part of subcall function 00007FF657427AA0: FindFirstFileW.KERNEL32 ref: 00007FF657426E8F

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657427C0F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657427C15

Strings

filename, xrefs: 00007FF65742746A
content, xrefs: 00007FF65742755F

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$DriveFileFindFirstLogicalStrings
String ID: content$filename
API String ID: 3820383557-474635906
Opcode ID: 5759cf5791bbef19b166654cfecfeb3d70103c7644ab92b3732b32d31796e4f3
Instruction ID: 2d922168c2002cac59ac2ab1e50e218e9838ae0fcef59c325afaf0ea63c6759b
Opcode Fuzzy Hash: 5759cf5791bbef19b166654cfecfeb3d70103c7644ab92b3732b32d31796e4f3
Instruction Fuzzy Hash: 0741D962F1868945EE219B25E44026EA751EFD4BF4F1C4331EBAD97BEADE3CD0808700

Function 00007FF657438560 Relevance: 6.2, APIs: 4, Instructions: 192COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6574386A0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574386A6
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65743879F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574387A5

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 7fca86447ee1d230acec48cf6a23f374ccc41a9072cbfa91234735f0df5d3f73
Instruction ID: 4c181ef8291954dacd68d018ce2cf48c47a7305b6ae18309dd204448b249379d
Opcode Fuzzy Hash: 7fca86447ee1d230acec48cf6a23f374ccc41a9072cbfa91234735f0df5d3f73
Instruction Fuzzy Hash: B0512762B0978A85FE249B11E9403B9E259AB04BE4F5C0631DE6D9B7D6DF3CE4D28310

Function 00007FF65746F820 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF65746F85B
OpenProcessToken.ADVAPI32 ref: 00007FF65746F86E
GetTokenInformation.KERNELBASE ref: 00007FF65746F8AA
CloseHandle.KERNEL32 ref: 00007FF65746F8CB

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 1c225c442ed3ae12c114120d81f2afce391d37106ff629cfd40a7a8c2f449ed4
Instruction ID: ebbd3d8a87e0964d22fa89872716cc044967fef5048ef5cc4c483e5d3ffd7524
Opcode Fuzzy Hash: 1c225c442ed3ae12c114120d81f2afce391d37106ff629cfd40a7a8c2f449ed4
Instruction Fuzzy Hash: AD112B72A18B8582E7509F12F84435BB3A4FB88B80F589135EB9DA7B68DF3CD505CB40

Function 00007FF657431EB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65743209C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574320A2

Strings

, xrefs: 00007FF657431F33

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-3916222277
Opcode ID: 718b71e87ed0eb21c52b1e9dd9691f054ba2569142a645f7ec990b3cb1444c3b
Instruction ID: 6e06a581b9121f136ee5c1aee36e60b7847ed429011f73639539992a23690980
Opcode Fuzzy Hash: 718b71e87ed0eb21c52b1e9dd9691f054ba2569142a645f7ec990b3cb1444c3b
Instruction Fuzzy Hash: 07517D72B08B4996EB158F2AD15026C73A0FB48B94F588632CF5D97BA4CF7DE0A5C340

Function 00007FF657476460 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegGetValueA.KERNEL32 ref: 00007FF6574764C9

Strings

ProductName, xrefs: 00007FF6574764B4
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF6574764BB

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Value
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-1787575317
Opcode ID: ca02e5c3ed8e0fc6be14c1ad152ff79eaac3ff22c286f7938fb5c96ca43ff221
Instruction ID: 23ae70b6f2e537b7bb3a248b157642fd257377894b81c17c14e5cbb9bb5d9c09
Opcode Fuzzy Hash: ca02e5c3ed8e0fc6be14c1ad152ff79eaac3ff22c286f7938fb5c96ca43ff221
Instruction Fuzzy Hash: B6117F32608B8582EB208F21F4453AAB3A4FB88788F544635EA9C93B58DF7CD155CB40

Function 00007FF657474DB7 Relevance: 4.7, APIs: 3, Instructions: 182networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF6574750EC
closesocket.WS2_32 ref: 00007FF6574750FE
WSACleanup.WS2_32 ref: 00007FF657475104
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65747521A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657475226
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65747522C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657475232

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Cleanupclosesocketrecv
String ID:
API String ID: 1729841683-0
Opcode ID: 39ba7bd44c988ccdf47745703130a92e6f0b44c7c76c31c31fae91176c0073be
Instruction ID: 9261c8c12cca9079776f87b3ef55515c2e00c79421ff2f8b32f0e0e3516acccc
Opcode Fuzzy Hash: 39ba7bd44c988ccdf47745703130a92e6f0b44c7c76c31c31fae91176c0073be
Instruction Fuzzy Hash: A6919563E18BC981EE20CB29E4443AEA361EB957A0F144331DAAD97AD9DF7CD481C740

Function 00007FF65741E2A0 Relevance: 4.7, APIs: 3, Instructions: 175COMMON

Download Yara Rule

APIs

__std_fs_directory_iterator_open.LIBCPMT ref: 00007FF65741E3D3

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: __std_fs_directory_iterator_open
String ID:
API String ID: 4007087469-0
Opcode ID: d4604204593d342e570c4926b62fada30b6957409627625e7c2239f99d44b0cf
Instruction ID: 73374e103144ddfa5f971d5c5efa2b88756b9d22f5cfebe3c5627bd4b6eb01cc
Opcode Fuzzy Hash: d4604204593d342e570c4926b62fada30b6957409627625e7c2239f99d44b0cf
Instruction Fuzzy Hash: 5F61B466F54A6A85FB10EF75D4803BC23A1EF447A8F088631DE1DA76D5DE3CD4A58340

Function 00007FF65746EED0 Relevance: 4.6, APIs: 3, Instructions: 87COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 00007FF65746EF29
CoTaskMemFree.OLE32 ref: 00007FF65746EFEA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65746F012

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: FolderFreeKnownPathTask_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2444108017-0
Opcode ID: ae204a587ab0ef826eab955bf18b5cfd079d10c08874d19813b769850f893d30
Instruction ID: 9e66dd130455c6f1602ebac18aafaa37bb3b5c52db102fb0b2e886d47468b3e1
Opcode Fuzzy Hash: ae204a587ab0ef826eab955bf18b5cfd079d10c08874d19813b769850f893d30
Instruction Fuzzy Hash: B2319572918B8582E720CF65E44022EB361FB997F4F645335FAAC53A99DF7CD1818B40

Function 00007FF65749E244 Relevance: 4.6, APIs: 3, Instructions: 78COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF65749D34F), ref: 00007FF65749E25D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF65749D34F), ref: 00007FF65749E2CF

Part of subcall function 00007FF65748E8BC: HeapAlloc.KERNEL32 ref: 00007FF65748E8FA

FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF65749D34F), ref: 00007FF65749E32E

Part of subcall function 00007FF65748D3C8: RtlFreeHeap.NTDLL ref: 00007FF65748D3DE
Part of subcall function 00007FF65748D3C8: GetLastError.KERNEL32 ref: 00007FF65748D3E8

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: EnvironmentFreeStrings$Heap$AllocErrorLast
String ID:
API String ID: 3331406755-0
Opcode ID: f79ec361922fc1fde17e438abd9a0df1426056f3875ee8e29d5efadf54f3a626
Instruction ID: 22272c93141177aaf6d34bdcc9cc72f807b058f1755a9f2662067eef1131b918
Opcode Fuzzy Hash: f79ec361922fc1fde17e438abd9a0df1426056f3875ee8e29d5efadf54f3a626
Instruction Fuzzy Hash: 1C319522A0876A81EB249F26A54107E7694FB54FD4F4C9239EA5EA3BD5DF3CE4418700

Function 00007FF657476E1B Relevance: 4.6, APIs: 3, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF657476E37
RegQueryValueExA.KERNEL32 ref: 00007FF657476E76
RegCloseKey.ADVAPI32 ref: 00007FF657476F14

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 8656d0007ab639087827527d9889e82898aae9a570ea373c7e4ee7fdbf52c9ac
Instruction ID: 5d3d3d388cca073c9406d92e3fcf55e653e6e1b7ade24120477653f898d3afd7
Opcode Fuzzy Hash: 8656d0007ab639087827527d9889e82898aae9a570ea373c7e4ee7fdbf52c9ac
Instruction Fuzzy Hash: 5121E572E18B8A81EB50CF26E44037EA761FFC57D4F145231FA8D92A99DE2CD085CB00

Function 00007FF6574758D0 Relevance: 4.6, APIs: 3, Instructions: 50COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32 ref: 00007FF6574758F7
GetGeoInfoA.KERNEL32 ref: 00007FF657475911
GetGeoInfoA.KERNEL32 ref: 00007FF657475961

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: 877c1b4e073b3a87c3d7ac6068cbd316133fc0437c9f32c249d117db553f0db1
Instruction ID: 919369ebdf080d15184e9099c7892a97330447d58e3b91f9b8ab6395e1a0ee38
Opcode Fuzzy Hash: 877c1b4e073b3a87c3d7ac6068cbd316133fc0437c9f32c249d117db553f0db1
Instruction Fuzzy Hash: 7211D032A1878583D7108F22E41471EB361FB80BC8F185234EB8957B49CF7CD4948B44

Function 00007FF657494F60 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF657494F5C), ref: 00007FF657494F71
TerminateProcess.KERNEL32(?,?,?,00007FF657494F5C), ref: 00007FF657494F7C
ExitProcess.KERNEL32 ref: 00007FF657494F8B

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 38c7b4f83e553420579c8e330882a64258dcf8d372290847a19fb81a50e45df1
Instruction ID: 77be82365417e92415079c7f4d03b7ca2f65443a33b15c9732de2f6ed3e610fd
Opcode Fuzzy Hash: 38c7b4f83e553420579c8e330882a64258dcf8d372290847a19fb81a50e45df1
Instruction Fuzzy Hash: 05D09E10F0874B56EB142B75999D07D52695FA9742F5C1438D80FA6397DD2DA44D4300

Function 00007FF657476C70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32 ref: 00007FF657476CAC

Strings

Unknown, xrefs: 00007FF657476D66

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: 22e8dba5ae4e86c0326f8be6cf605145216d5eee1111140a83b2067be56ce9ba
Instruction ID: 7f56a70739541a24315f557ed3a08243295b3db76ecac8ab199ec4d330d97c4b
Opcode Fuzzy Hash: 22e8dba5ae4e86c0326f8be6cf605145216d5eee1111140a83b2067be56ce9ba
Instruction Fuzzy Hash: 1931F223A2CBC5C6E710CF21E4402AAA360FBD9B44F585235EBCD62A06DF7CD595CB00

Function 00007FF65747C190 Relevance: 3.3, APIs: 2, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aa6985b9853aef8a3d3393e8d1cb7a0f2bd345dcf9c294186223a99de6f5cd3
Instruction ID: 6c580619b083171bd64f4a8ea87190263d05a106c379a03bbcc7b7d4c0f0379c
Opcode Fuzzy Hash: 8aa6985b9853aef8a3d3393e8d1cb7a0f2bd345dcf9c294186223a99de6f5cd3
Instruction Fuzzy Hash: F4A1A073A08B8586EB10CF25E8843AD77A4FB99B98F188135EA4D97799DF3CD481C740

Function 00007FF65747F150 Relevance: 3.2, APIs: 2, Instructions: 189COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65747F394
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65747F3A0

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 80c2a26bc4b9ff3df1eb50506cb4297f4c4b4e8c8e9ae7a9d3bf2db40af65ec6
Instruction ID: 014c5f2c982fa1c69b6f7644ec0201f29117101a42ff3251506a38f883ae6a68
Opcode Fuzzy Hash: 80c2a26bc4b9ff3df1eb50506cb4297f4c4b4e8c8e9ae7a9d3bf2db40af65ec6
Instruction Fuzzy Hash: 8D6199A6B08A8985EB14DB66D15427C23A1EB04FD8F588531CE6DAB7D5DF3DE887C300

Function 00007FF65746D260 Relevance: 3.2, APIs: 2, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65746D510: RegOpenKeyExA.KERNEL32 ref: 00007FF65746D561
Part of subcall function 00007FF65746D510: RegCloseKey.ADVAPI32 ref: 00007FF65746D573

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65746D4F8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65746D4FE

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseOpen
String ID:
API String ID: 3087652857-0
Opcode ID: 46d4de75baac43f26121c3ff3c440e157bc24cd3c6e32593cc6b3db9afb2c3fe
Instruction ID: 7f6385a3f00b2340a1dab46efb1aee37434a28d50bc680d9cf479f119b9768db
Opcode Fuzzy Hash: 46d4de75baac43f26121c3ff3c440e157bc24cd3c6e32593cc6b3db9afb2c3fe
Instruction Fuzzy Hash: B571C672A18BD985EB10CB65E8403AD77A1F788794F544232EA9C97B99DF3CD580CB00

Function 00007FF657438E80 Relevance: 3.1, APIs: 2, Instructions: 129COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF657439015
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65743901B

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 5b0288b0d9082027d2d3551a4fb834cdde27bd521c2fdfcfefbd0ae97258a914
Instruction ID: 9247aece85d293b0b11bb573d3843f7392e7e7a5f6770007d35c77af1da21d44
Opcode Fuzzy Hash: 5b0288b0d9082027d2d3551a4fb834cdde27bd521c2fdfcfefbd0ae97258a914
Instruction Fuzzy Hash: ED41B062B08B8A81EE109F11E5442ADA366FB58BD4F5C4635DF6D9B786DF3CE4928300

Function 00007FF657440790 Relevance: 3.1, APIs: 2, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6574408F4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657440900

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 63cffe88c9993b74fcc9911e590dc7bdd762ce85ad49ccb70f5840a77ab716ad
Instruction ID: 0b9cc450bd7e96a3a8259aa2eda7b8546871dbf99edcd460af847f17ba050421
Opcode Fuzzy Hash: 63cffe88c9993b74fcc9911e590dc7bdd762ce85ad49ccb70f5840a77ab716ad
Instruction Fuzzy Hash: 23313762B18B8941FD14DF66A50017A6351FB44BE4F984A35DEBDA3BE4CE3CE052E340

Function 00007FF657439030 Relevance: 3.1, APIs: 2, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6574391AC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574391B2

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 666b6452f1c6d9744dcc2b96b6cf4bfb9dabd7d98e38264a0061b3d8a209470b
Instruction ID: 4bbae6fd468005b9e2203119ad4884ca826398fb27e3e9c66256f3c4dcb773e3
Opcode Fuzzy Hash: 666b6452f1c6d9744dcc2b96b6cf4bfb9dabd7d98e38264a0061b3d8a209470b
Instruction Fuzzy Hash: 87410562B0874A86FE10AB16A5483BDA251BB04FD8F5C4631DF6D6B7C6DE3CE4828340

Function 00007FF657434600 Relevance: 3.1, APIs: 2, Instructions: 116COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657434745
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF657434751

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 458adef9927b8986c2aa59cf803beb6517952851373c0165048fe3a01ac84435
Instruction ID: eb8910dd234fec0af3ea3b6c94b5e809b9dd54812758b27dff58ee68a6faf605
Opcode Fuzzy Hash: 458adef9927b8986c2aa59cf803beb6517952851373c0165048fe3a01ac84435
Instruction Fuzzy Hash: 44311462B09A8A44FE15AF5AE6403FC52819B05FE5F5C4631DE2DA7BC6DE3CE4C28340

Function 00007FF657476290 Relevance: 3.1, APIs: 2, Instructions: 107COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32 ref: 00007FF657476320
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657476457

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: InformationVolume_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 4269842375-0
Opcode ID: 22ab62d864ba811694e333a7f29a8d108af9b402be55f82f8009cb3de707e93e
Instruction ID: 3a783289f22b60ea87ee305fa4962eb54a30fe2afd262bb712cb0effaca94d0e
Opcode Fuzzy Hash: 22ab62d864ba811694e333a7f29a8d108af9b402be55f82f8009cb3de707e93e
Instruction Fuzzy Hash: 2C51B233E18B858AE710CF74D4403AD7365FB94788F544221EB9CA3A99DF78D585C740

Function 00007FF6574329B0 Relevance: 3.1, APIs: 2, Instructions: 93COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657432AB2
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF657432AB8

Part of subcall function 00007FF65741B820: __std_exception_copy.LIBVCRUNTIME ref: 00007FF65741B868

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2371198981-0
Opcode ID: 471fef003da3bef1a2a5014a6f988b70e9b407be2ea8603870b5e1f80d60c4d7
Instruction ID: 6047658fc5f0880a8a2326bba4486960cad13e1ca479913e899396f61c75ad03
Opcode Fuzzy Hash: 471fef003da3bef1a2a5014a6f988b70e9b407be2ea8603870b5e1f80d60c4d7
Instruction Fuzzy Hash: 2E21D622F05B4A43EA28AB55A5403797290AB54BB4F284631DA7C63BD1EE7CE4D3C340

Function 00007FF657484648 Relevance: 3.1, APIs: 2, Instructions: 77COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65748466F

Part of subcall function 00007FF657484604: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65748461B

_invalid_parameter_noinfo.LIBCMT ref: 00007FF657484723

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 77ff38050bbf038ec147631c291faae903e00292372ea36fba1d268a897535c6
Instruction ID: d8667f915897ddeb5637105de2a602342dc93b0bdd87f6d5a0b77fb4a3ff99d6
Opcode Fuzzy Hash: 77ff38050bbf038ec147631c291faae903e00292372ea36fba1d268a897535c6
Instruction Fuzzy Hash: CB31C172A19A4E81EA54EF18D8505BD2361EFA5B90F9D0131E60EE73D2EF3CE501C380

Function 00007FF65746D510 Relevance: 3.1, APIs: 2, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF65746D561
RegCloseKey.ADVAPI32 ref: 00007FF65746D573

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: 1a64ac96ffafbd9bf205c43160686ecd2fbbda4846f4ad75e4a512c060860e71
Instruction ID: b64a5bdf4feeec0649dc4079b40e37b63d56d31677611e99d7b8479757de4beb
Opcode Fuzzy Hash: 1a64ac96ffafbd9bf205c43160686ecd2fbbda4846f4ad75e4a512c060860e71
Instruction Fuzzy Hash: 30212E21B18A9945FE50DB26E8403BAA350FF58BD4F1D4131FA4D93B99DF2CD141CB00

Function 00007FF65746C7CC Relevance: 3.1, APIs: 2, Instructions: 58synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65742E610: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF65742E65A
Part of subcall function 00007FF65742E610: Process32FirstW.KERNEL32 ref: 00007FF65742E69C

Part of subcall function 00007FF65742CA10: CredEnumerateA.ADVAPI32 ref: 00007FF65742CA72

Part of subcall function 00007FF657474A30: recv.WS2_32 ref: 00007FF657474C0C

ReleaseMutex.KERNEL32 ref: 00007FF65746C83B
CloseHandle.KERNEL32 ref: 00007FF65746C844

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: CloseCreateCredEnumerateFirstHandleMutexProcess32ReleaseSnapshotToolhelp32recv
String ID:
API String ID: 420082584-0
Opcode ID: bece3b694530cfbeca66faa9e7e0d6adff72bc4c5de40ce38d1c4fa0504811a1
Instruction ID: 6d608293f047e967355ef58e2c468807bf30ad4c03607563887ced2fab54b11c
Opcode Fuzzy Hash: bece3b694530cfbeca66faa9e7e0d6adff72bc4c5de40ce38d1c4fa0504811a1
Instruction Fuzzy Hash: 1721B152E1C68F81FA21B7B5A80B3BD6200AF85B51F5C5A30E95EF25D7DE1CB1408711

Function 00007FF65746C7FD Relevance: 3.0, APIs: 2, Instructions: 47synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF657474A30: recv.WS2_32 ref: 00007FF657474C0C

ReleaseMutex.KERNEL32 ref: 00007FF65746C83B
CloseHandle.KERNEL32 ref: 00007FF65746C844

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: CloseHandleMutexReleaserecv
String ID:
API String ID: 2659716615-0
Opcode ID: dd2cc705cdbd18044620e585c3dda16eabb8828c2173ec8563691370528ef67d
Instruction ID: 6a4a4cea17c30c8c6f636e167edd7af3853f22b5161aa254536c50889b738674
Opcode Fuzzy Hash: dd2cc705cdbd18044620e585c3dda16eabb8828c2173ec8563691370528ef67d
Instruction Fuzzy Hash: 8511C652E0C6CF81FA21B779A40A3BD5250AF85B51F1C5630EA9DE15D7DF2CB1418700

Function 00007FF657490E9C Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF657490E88,?,?,?,?,00000000,00007FF657490F91), ref: 00007FF657490EE8
GetLastError.KERNEL32(?,?,?,?,?,00007FF657490E88,?,?,?,?,00000000,00007FF657490F91), ref: 00007FF657490EF2

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 85342b8448b5f83962e520861b5040a532baca975cc467821ece28218af4e603
Instruction ID: 68fe0f185506d0e45012111d18514694fa6063424bcaaeb5243d341ebec4d74b
Opcode Fuzzy Hash: 85342b8448b5f83962e520861b5040a532baca975cc467821ece28218af4e603
Instruction Fuzzy Hash: 1F11EF62A18B8A82DE108B26A504079A3A1EB50BF4F684331EA7DA77E8CE7CD4118700

Function 00007FF65749E888 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65749E8B8

Part of subcall function 00007FF65749F8DC: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF65749F8E5

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65749E8BE

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: ad7fb39d7d0572768195cdb96d88edf57c93c5d00d8eaa663e4c704e5b7bea2c
Instruction ID: 0f8ce18f5de0c8379e09f739f1577027fcd258858ff6762b0f744f3e1f0b19f2
Opcode Fuzzy Hash: ad7fb39d7d0572768195cdb96d88edf57c93c5d00d8eaa663e4c704e5b7bea2c
Instruction Fuzzy Hash: 1AE0E242E1925F09FD68A3A2170A0B981800FA9770E1C5B30D97DEA6C3EE2CA4A18390

Function 00007FF65748D3C8 Relevance: 3.0, APIs: 2, Instructions: 18memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF65748D3DE
GetLastError.KERNEL32 ref: 00007FF65748D3E8

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: b7253a55b1276d1b57d670979138b52c86c30a15e8b70f9b8b054cc625f4c6ce
Instruction ID: b2601aefebb205131a463aa7bd9996ed1d64a74ff9097ba561a34ccb9f464497
Opcode Fuzzy Hash: b7253a55b1276d1b57d670979138b52c86c30a15e8b70f9b8b054cc625f4c6ce
Instruction Fuzzy Hash: A2E01251F1B64E92FF586BF3984913952D59F98741F5C4434C81DF2252ED2C68898740

Function 00007FF657433FF0 Relevance: 1.8, APIs: 1, Instructions: 320COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF657440610: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF657440778
Part of subcall function 00007FF657440610: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657440784

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65743447D

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID:
API String ID: 3936042273-0
Opcode ID: 8b63aff671ea4424fcc8d86e58390cf3b414aa6dd3dbafb3b21bf28b59b76f5e
Instruction ID: 97601773a657e1dee5f1be39b85829ba743cba920c20d93119f3aa211d9bf3f3
Opcode Fuzzy Hash: 8b63aff671ea4424fcc8d86e58390cf3b414aa6dd3dbafb3b21bf28b59b76f5e
Instruction Fuzzy Hash: A2E15722B18A4985FB10CBA9E4402FD3771FB54B98F598536CE5DA7B9ADF38E4D08340

Function 00007FF657430CA0 Relevance: 1.7, APIs: 1, Instructions: 234COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657430FA7

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 2dcc6b820f7f2333df6521c243a5d19818f7b2d7156da96d2a5246399316cb4d
Instruction ID: ba87cf66b374007667d473a105f6535a82234ba5be28c8d1fbf2f2f5285864dd
Opcode Fuzzy Hash: 2dcc6b820f7f2333df6521c243a5d19818f7b2d7156da96d2a5246399316cb4d
Instruction Fuzzy Hash: 96B16D73705A89CADF20CF25D0902AD73A1FB48B58F585632EA6D97BA9DF38D495C300

Function 00007FF65747D640 Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65747D829

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 7e7f4a0975ce12a370147af02dae87945938562f497badccff8603b604800ab9
Instruction ID: 0a53257c587f4b6061a2d3a682fda142a311e7157fc704dbb7cb9adbb8ee30b4
Opcode Fuzzy Hash: 7e7f4a0975ce12a370147af02dae87945938562f497badccff8603b604800ab9
Instruction Fuzzy Hash: 2651E022F18A998AFB118F78D5003BC7371AF58748F089631DF8D76A95DF38A5968344

Function 00007FF65748D8C8 Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65748D8F0

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 506399ceb7efd258d9ee9312528a7fb0108d3bcc24f039aa6e7519c78468f3b6
Instruction ID: ce992cb232dbf94f4a17ddff146f3231c7e43c7f80c677880d0fb1c634f61060
Opcode Fuzzy Hash: 506399ceb7efd258d9ee9312528a7fb0108d3bcc24f039aa6e7519c78468f3b6
Instruction Fuzzy Hash: 4141E332A0A65D87EB749B18E54127D73A4EB5BB90F180130DA9EE7791CF3CE402CB91

Function 00007FF657475FC0 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657476147

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 628995f3d736e6fe205b56917886d3c942a5986b6e31f38ab9cf072db7499d6c
Instruction ID: e3a44cc015b66830d4cfc0441ec173975784d4f19e30ccf896b8f31dd5aa8372
Opcode Fuzzy Hash: 628995f3d736e6fe205b56917886d3c942a5986b6e31f38ab9cf072db7499d6c
Instruction Fuzzy Hash: 73415872B15F488EEB008FB9D4403AC73B6E78C79CF004625EE9C66B89EF3491648394

Function 00007FF65749080C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF657490892

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a24f7c79d48368e33d7deb9d4eeecb52ce7ec7a6106812cc151fd4020b53ad0d
Instruction ID: 1680f014019d66a34ece0f7c500c2e62d1405fecdee5cc57b9b6d2f3197c7267
Opcode Fuzzy Hash: a24f7c79d48368e33d7deb9d4eeecb52ce7ec7a6106812cc151fd4020b53ad0d
Instruction Fuzzy Hash: B131C122E1860E85F751AF5A884137C6690EFA0BA0F5A0236EA1DA33E2DF7CE441C751

Function 00007FF6574320B0 Relevance: 1.6, APIs: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574321A7

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: b4325394841097dc207bbc729bbf94e901fe83a4d13f313c93b63ae7a0871957
Instruction ID: 281e554352c8e24c3651461e3ac67b1551de4de7673bbff43be050ba8a2c72d3
Opcode Fuzzy Hash: b4325394841097dc207bbc729bbf94e901fe83a4d13f313c93b63ae7a0871957
Instruction Fuzzy Hash: FC310276B09B4982EF098F69E49026C7365EB88F99F588432CF4D5B768DF38D485C340

Function 00007FF657494E91 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF657494EBF

Part of subcall function 00007FF657494FB8: GetModuleHandleExW.KERNEL32 ref: 00007FF657494FDD
Part of subcall function 00007FF657494FB8: GetProcAddress.KERNEL32 ref: 00007FF657494FF3
Part of subcall function 00007FF657494FB8: FreeLibrary.KERNEL32 ref: 00007FF65749501A

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 9e03c0276b42d0bae273c9ceb8b8abd1e24865752fa8da44abca3c0ffcb1668a
Instruction ID: b7c72b9c6216f0fac10bf817bbdf05eba36d5addb48a00c809eda20fd8774d52
Opcode Fuzzy Hash: 9e03c0276b42d0bae273c9ceb8b8abd1e24865752fa8da44abca3c0ffcb1668a
Instruction Fuzzy Hash: 5D215E32A0474A8AEB648F68D4442FD37E0EB5471CF580639E72DA6AD9EF78D584CB40

Function 00007FF6574AE200 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6574AE15D

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 277766cc613ac521deff1262cc5973a4c6dda0ce244441028124d0478fb53980
Instruction ID: 96c5f38bf119fe44ebe1a2f85e5a2ac64b83f2a7f1c5a028bd0162df108dea98
Opcode Fuzzy Hash: 277766cc613ac521deff1262cc5973a4c6dda0ce244441028124d0478fb53980
Instruction Fuzzy Hash: 24118432A1D66D81EA609F55940117EA365BF89B80F4C8071EB8CF7796DF3CD8418740

Function 00007FF6574AFEF8 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6574AFF1B

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 4bdd7c7df9abbb715da046ae302baf4d590079e7e30464498c50f0bf6b7ea38d
Instruction ID: 125127df8f4c1f080eee89e96a42639481458c54c74159f5149182d5d7af6b0f
Opcode Fuzzy Hash: 4bdd7c7df9abbb715da046ae302baf4d590079e7e30464498c50f0bf6b7ea38d
Instruction Fuzzy Hash: 7621D172A18A8A87EB618F28D44037972A1EB95B94F684235FB5DD76D9DF3CD8008B00

Function 00007FF65741F380 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65741F3E3

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: c98089154d41e91aef4fb596ab2a74aafa6efc439ad7e522330d1ce16319ce63
Instruction ID: ff21ff11e1d424a1ffeca374c7635398332117539a54b95f57c0b88b471dbc67
Opcode Fuzzy Hash: c98089154d41e91aef4fb596ab2a74aafa6efc439ad7e522330d1ce16319ce63
Instruction Fuzzy Hash: 47F062F2A16A8D81EB049B24E05436C6351EB54F88F584431D69C5A696EF7DD4A6C340

Function 00007FF657470E00 Relevance: 1.5, APIs: 1, Instructions: 38networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF657470E48

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 10723b900c3d3fb221c2729e0f2ab508e71a113b43aaaf7fd55bda6ca2804ccb
Instruction ID: 4f67f0d14ad992c1a60792f1a7d1a6e8764fb424740393d6f3afc81d6ee63970
Opcode Fuzzy Hash: 10723b900c3d3fb221c2729e0f2ab508e71a113b43aaaf7fd55bda6ca2804ccb
Instruction Fuzzy Hash: A301A221B19A8985DB508F16B980529A7A0FB88FD4F5C5130EE5D93B58DF28D8828700

Function 00007FF657427633 Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE ref: 00007FF657427676

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 752fe5805e453647425062ce64daa4e53c54a82ad0d646f83825288564bb7983
Instruction ID: 6b1ab080e5a9e6366f638df7f51878a7754c229361122fecd1233e420c1c631f
Opcode Fuzzy Hash: 752fe5805e453647425062ce64daa4e53c54a82ad0d646f83825288564bb7983
Instruction Fuzzy Hash: D001442660C9C580EA70CF52F4442AAA364FBC8B94F444032DE8D93B59DE3DD446CB00

Function 00007FF657487374 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF657487393

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 68ea0e6e30933e9dd76abf56f21314c638998a57c534cc3687c594a1fb5b02e7
Instruction ID: b51918a38cd809ddb49ea1105999adea9349d34bd85bfca2766301c67e3b9300
Opcode Fuzzy Hash: 68ea0e6e30933e9dd76abf56f21314c638998a57c534cc3687c594a1fb5b02e7
Instruction Fuzzy Hash: 81E02231A2DA0E86EB626BA8D28117D61506F447F0F184331FA3CA22C6DE3C94508302

Function 00007FF6574AB4C0 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,?,?,?,00007FF65741E409), ref: 00007FF6574AB4C4

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 4104833be8186ecfced91f05a1dc286f8d4e1ac7fad94ea37a2bf5d234dce428
Instruction ID: a057b74bd80030ae13f8875ffa23f32d43a8d23f51ca4968a8b6dbefbdde0b3a
Opcode Fuzzy Hash: 4104833be8186ecfced91f05a1dc286f8d4e1ac7fad94ea37a2bf5d234dce428
Instruction Fuzzy Hash: F4C09B15F5D587D2E7541B735C8E16653E49F54712F5C0030C50CD0150DD1C95DBC711

Function 00007FF6574AD0B4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 00007FF6574AD0BD

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: ebb3c2d15c06801dfe805b6087078b0f501a5fe9f8c446694f4975735c5f9cad
Instruction ID: 829fc9b32d3bdbe6b8ac11595c9b2c00e34e0131c214cfff7e35071a134c17b5
Opcode Fuzzy Hash: ebb3c2d15c06801dfe805b6087078b0f501a5fe9f8c446694f4975735c5f9cad
Instruction Fuzzy Hash: 9EB09236A18CC0C3C611EB04EC46019B331FB94B0BFE00020E28E82624CE2CDA2A8F08

Function 00007FF65748E8BC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF65748E8FA

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: eba47d0c810211a009f984e3ce810decee2d7cb9fb39a7e87e15bbee8ef19542
Instruction ID: 1a6c641194954afa6812b36da880048b036d12acacb2bdf436ea74cbd2668676
Opcode Fuzzy Hash: eba47d0c810211a009f984e3ce810decee2d7cb9fb39a7e87e15bbee8ef19542
Instruction Fuzzy Hash: 70F01C11F0929F45FEA46B72994567952809F997B4F4C8634DC2EE62C2EE6CF4808360

Non-executed Functions

Function 00007FF657481220 Relevance: 49.1, APIs: 25, Strings: 2, Instructions: 1888COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF657481557
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6574817BA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF657481A7D
_invalid_parameter_noinfo.LIBCMT ref: 00007FF657481D1D
memcpy_s.LIBCPMT ref: 00007FF657481F2A
memcpy_s.LIBCPMT ref: 00007FF657481FC6
memcpy_s.LIBCPMT ref: 00007FF65748247E
memcpy_s.LIBCPMT ref: 00007FF6574824B9
memcpy_s.LIBCPMT ref: 00007FF6574825E5
memcpy_s.LIBCPMT ref: 00007FF65748270C
memcpy_s.LIBCPMT ref: 00007FF6574827B7
memcpy_s.LIBCPMT ref: 00007FF6574827FF
memcpy_s.LIBCPMT ref: 00007FF657482829
memcpy_s.LIBCPMT ref: 00007FF6574828DA
memcpy_s.LIBCPMT ref: 00007FF657482ADA
memcpy_s.LIBCPMT ref: 00007FF657482B1F
memcpy_s.LIBCPMT ref: 00007FF657482BD6
memcpy_s.LIBCPMT ref: 00007FF657482D03
memcpy_s.LIBCPMT ref: 00007FF6574823CE

Part of subcall function 00007FF657483664: _invalid_parameter_noinfo.LIBCMT ref: 00007FF657483696

memcpy_s.LIBCPMT ref: 00007FF657482449
memcpy_s.LIBCPMT ref: 00007FF657482EBD

Strings

, xrefs: 00007FF657482C83
, xrefs: 00007FF657482DB0

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: memcpy_s$_invalid_parameter_noinfo
String ID: $
API String ID: 2880407647-227171996
Opcode ID: 49a4e64996860ac975e7d62cf44a3f3077f64a100a8fbd3398d3c45755aa41bf
Instruction ID: cfe7b257dd83ad2e41fd137f1750019abd1f864b256e5e2444234e679f63a6c8
Opcode Fuzzy Hash: 49a4e64996860ac975e7d62cf44a3f3077f64a100a8fbd3398d3c45755aa41bf
Instruction Fuzzy Hash: 7103A772A246C98FE7758F25D950BFD3791FB54788F08513ADA0AA7B44DF39AA00CB40

Function 00007FF65747A430 Relevance: 36.0, APIs: 19, Strings: 1, Instructions: 1015stringmemorynativeCOMMON

Download Yara Rule

APIs

RtlAcquirePebLock.NTDLL ref: 00007FF65747A473
NtAllocateVirtualMemory.NTDLL ref: 00007FF65747A4AB
lstrcpyW.KERNEL32 ref: 00007FF65747A50D
lstrcatW.KERNEL32 ref: 00007FF65747A5C2
NtAllocateVirtualMemory.NTDLL ref: 00007FF65747A649
lstrcpyW.KERNEL32 ref: 00007FF65747A6FC
RtlInitUnicodeString.NTDLL ref: 00007FF65747A711
RtlInitUnicodeString.NTDLL ref: 00007FF65747A726
LdrEnumerateLoadedModules.NTDLL ref: 00007FF65747A739
RtlReleasePebLock.NTDLL ref: 00007FF65747A73F

Part of subcall function 00007FF65746EED0: SHGetKnownFolderPath.SHELL32 ref: 00007FF65746EF29
Part of subcall function 00007FF65746EED0: CoTaskMemFree.OLE32 ref: 00007FF65746EFEA

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65747A777
CoInitializeEx.OLE32 ref: 00007FF65747A7EA
lstrcpyW.KERNEL32 ref: 00007FF65747A9C9
lstrcatW.KERNEL32 ref: 00007FF65747ABCE
CoGetObject.OLE32 ref: 00007FF65747ABEC
lstrcpyW.KERNEL32 ref: 00007FF65747B269
lstrcatW.KERNEL32 ref: 00007FF65747B48C
CoGetObject.OLE32 ref: 00007FF65747B4AA
CoUninitialize.OLE32 ref: 00007FF65747B972

Strings

0, xrefs: 00007FF65747B0AA

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: lstrcpy$lstrcat$AllocateInitLockMemoryObjectStringUnicodeVirtual$AcquireEnumerateFolderFreeInitializeKnownLoadedModulesPathReleaseTaskUninitialize_invalid_parameter_noinfo_noreturn
String ID: 0
API String ID: 2979746431-4108050209
Opcode ID: be3c9c5b6b29e4456c2bc1c511291065cd00b5f8cb3857b0f644a8fdea2a94a5
Instruction ID: e77c490657ea0d0c054580f59182ed059fb930291d01859061ed0d9f9381aedb
Opcode Fuzzy Hash: be3c9c5b6b29e4456c2bc1c511291065cd00b5f8cb3857b0f644a8fdea2a94a5
Instruction Fuzzy Hash: 25C2B836626F988AD7908F69E88165EB3B5F788B88B105225FFCD57B18EF38C154C740

Function 00007FF6574298CD Relevance: 34.4, APIs: 14, Strings: 5, Instructions: 1142COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742AD5E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742AD74
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742AD7A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742AD80
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742AD86
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742AD8C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742AD92
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742AD98
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742AD9E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742ADA4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742ADAA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742ADB0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742ADB6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742ADBC

Strings

config, xrefs: 00007FF657429CDD
users, xrefs: 00007FF65742A262
status, xrefs: 00007FF65742AD67
filename, xrefs: 00007FF657429B46, 00007FF657429ECE, 00007FF65742A762
content, xrefs: 00007FF657429B9F, 00007FF657429F27, 00007FF65742A844

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: config$content$filename$status$users
API String ID: 3668304517-2677590375
Opcode ID: b09ba9ff25e35858eb0f974763f3fef50f5d398f0031d588dc4208684fe6d119
Instruction ID: eaf886980949810863ccbfce2179c41791b8afe271395af9f2960716b278ef15
Opcode Fuzzy Hash: b09ba9ff25e35858eb0f974763f3fef50f5d398f0031d588dc4208684fe6d119
Instruction Fuzzy Hash: D2C26F62A15BCA89DB30DF34D8803ED6361FB85798F445232DA5D9BB99EF38D684C340

Function 00007FF65746B420 Relevance: 33.7, APIs: 8, Strings: 11, Instructions: 465COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32 ref: 00007FF65746B9A7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65746BB92
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65746BB98
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65746BB9E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65746BBA4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65746BBAA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65746BBB0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65746BC05

Strings

.ps1, xrefs: 00007FF65746B4B4
.cmd, xrefs: 00007FF65746B4E3
ios_base::failbit set, xrefs: 00007FF65746BBC5
open, xrefs: 00007FF65746B91D
.exe, xrefs: 00007FF65746B56D
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;', xrefs: 00007FF65746B5B4
runas, xrefs: 00007FF65746B926
ios_base::eofbit set, xrefs: 00007FF65746BBCC
.vbs, xrefs: 00007FF65746B512
.exe, xrefs: 00007FF65746B485
ios_base::badbit set, xrefs: 00007FF65746BBBA

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ExecuteShell
String ID: .cmd$.exe$.exe$.ps1$.vbs$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;'$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$open$runas
API String ID: 4120902618-4093014531
Opcode ID: e255bb091f066e33d92ae9f9e12096af217a94a33ddb2620c1bef78a8b929f69
Instruction ID: 5a12097d2361983d65218c42f6e6f6b6c11f69af9d045abe9ed0be83e344cdf4
Opcode Fuzzy Hash: e255bb091f066e33d92ae9f9e12096af217a94a33ddb2620c1bef78a8b929f69
Instruction Fuzzy Hash: E122D372E14B8989EB10DF34D8803ED77A1FB84798F545236EA5C93AA9DF78D184C340

Function 00007FF6573F6180 Relevance: 30.2, Strings: 24, Instructions: 238COMMON

Download Yara Rule

Strings

winsipolicy.p7b, xrefs: 00007FF6573F62B8
bootsect.bak, xrefs: 00007FF6573F6246
boot.ini, xrefs: 00007FF6573F61D1
autorun.inf, xrefs: 00007FF6573F61A8
indexervolumeguid, xrefs: 00007FF6573F6473
desktop.ini, xrefs: 00007FF6573F626C
winre.wim, xrefs: 00007FF6573F6500
ntuser.dat, xrefs: 00007FF6573F6304
bootmgfw.efi, xrefs: 00007FF6573F61F9
d3d9caps.dat, xrefs: 00007FF6573F63E6
ntuser.ini, xrefs: 00007FF6573F6359
bootfont.bin, xrefs: 00007FF6573F6220
wpsettings.dat, xrefs: 00007FF6573F64A2
ntuser.dat.log, xrefs: 00007FF6573F632D
bootstat.dat, xrefs: 00007FF6573F6415
thumbs.db, xrefs: 00007FF6573F6388
mib.bin, xrefs: 00007FF6573F6444
bootmgr, xrefs: 00007FF6573F655E
boot.sdi, xrefs: 00007FF6573F64D1
BOOTNXT, xrefs: 00007FF6573F658D
iconcache.db, xrefs: 00007FF6573F62DE
reagent.xml, xrefs: 00007FF6573F652F
gdipfontcachev1.dat, xrefs: 00007FF6573F63B7
ntldr, xrefs: 00007FF6573F6292

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: BOOTNXT$autorun.inf$boot.ini$boot.sdi$bootfont.bin$bootmgfw.efi$bootmgr$bootsect.bak$bootstat.dat$d3d9caps.dat$desktop.ini$gdipfontcachev1.dat$iconcache.db$indexervolumeguid$mib.bin$ntldr$ntuser.dat$ntuser.dat.log$ntuser.ini$reagent.xml$thumbs.db$winre.wim$winsipolicy.p7b$wpsettings.dat
API String ID: 73155330-850610325
Opcode ID: 22dcfd16a23274500c0631d97ecb7b22965bfb45e38d580db89ddce6ecc7947a
Instruction ID: 530e8f6d5b6bcbccf378191bba13912fa2b1968c0536a7c975e4f53d461634a9
Opcode Fuzzy Hash: 22dcfd16a23274500c0631d97ecb7b22965bfb45e38d580db89ddce6ecc7947a
Instruction Fuzzy Hash: 50C14252D64BCA84E721DB35CC823F55361FBEB348F646326E948B5856EF68A3D4C340

Function 00007FF65742BF40 Relevance: 21.6, APIs: 8, Strings: 4, Instructions: 609COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742C9A3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742C9C4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742C9E0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742C9E6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742C9EC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742C9F2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742C9F8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742C9FE

Strings

directory_iterator::directory_iterator, xrefs: 00007FF65742C9D3
filename, xrefs: 00007FF65742C4F9
content, xrefs: 00007FF65742C69F
exists, xrefs: 00007FF65742C9B7

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: content$directory_iterator::directory_iterator$exists$filename
API String ID: 3668304517-1400943384
Opcode ID: 5f6feac985df97f664e961bd309ef5164d1a04855bcabb9aac5799a11916a07f
Instruction ID: 1aa1ee00ed9389e9bbe5323f1b73fb9a7db8fb6c896ae8c572fdfe75636b7411
Opcode Fuzzy Hash: 5f6feac985df97f664e961bd309ef5164d1a04855bcabb9aac5799a11916a07f
Instruction Fuzzy Hash: 0152A273A18BC989EB608F25D8403ED73A1FB89798F145631EA9DA7B99DF38D140C340

Function 00007FF6574602C0 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 410COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF657460474
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF657460482
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF657460705
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF657460713
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574608B0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574608B6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574608D9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574608DF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574608E5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657460908
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65746090E

Strings

value, xrefs: 00007FF65746039A, 00007FF657460633

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: 511af92176d0d56c842782619670e3dc0150464c4714b1fd08fb3d325657f112
Instruction ID: 4bdbabc46fed6b8197967b9f8ac1fb521820f771c6c398081256db659c153aea
Opcode Fuzzy Hash: 511af92176d0d56c842782619670e3dc0150464c4714b1fd08fb3d325657f112
Instruction Fuzzy Hash: C102B323A28BC985EB00CB74D4807BD6761EB957A4F145231FA9DA3AEADF3CD185C740

Function 00007FF65749A3C8 Relevance: 20.4, APIs: 8, Strings: 3, Instructions: 1156COMMON

Download Yara Rule

Strings

s, xrefs: 00007FF65749B4D2
W$, xrefs: 00007FF65749A530
s, xrefs: 00007FF65749B3F1

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: s$s$W$
API String ID: 3215553584-4165748295
Opcode ID: 9b1f272bfafe38334aa377421cf6210804c5f9af34e63209d09ff03d43a97708
Instruction ID: 6308afea9f7174c5c1e3314cc72df7507b48c8917f107785842ac625c496e508
Opcode Fuzzy Hash: 9b1f272bfafe38334aa377421cf6210804c5f9af34e63209d09ff03d43a97708
Instruction Fuzzy Hash: 0AA2E472F1829A8BE7658F64D644BFD77A1FB64388F485135DA0DA7A84DF38E900CB40

Function 00007FF65747A780 Relevance: 16.6, APIs: 8, Strings: 1, Instructions: 839stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65747A430: RtlAcquirePebLock.NTDLL ref: 00007FF65747A473
Part of subcall function 00007FF65747A430: NtAllocateVirtualMemory.NTDLL ref: 00007FF65747A4AB
Part of subcall function 00007FF65747A430: lstrcpyW.KERNEL32 ref: 00007FF65747A50D
Part of subcall function 00007FF65747A430: lstrcatW.KERNEL32 ref: 00007FF65747A5C2

CoInitializeEx.OLE32 ref: 00007FF65747A7EA
lstrcpyW.KERNEL32 ref: 00007FF65747A9C9
lstrcatW.KERNEL32 ref: 00007FF65747ABCE
CoGetObject.OLE32 ref: 00007FF65747ABEC
lstrcpyW.KERNEL32 ref: 00007FF65747B269
lstrcatW.KERNEL32 ref: 00007FF65747B48C
CoGetObject.OLE32 ref: 00007FF65747B4AA
CoUninitialize.OLE32 ref: 00007FF65747B972

Strings

0, xrefs: 00007FF65747B0AA

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: lstrcatlstrcpy$Object$AcquireAllocateInitializeLockMemoryUninitializeVirtual
String ID: 0
API String ID: 3636535045-4108050209
Opcode ID: 256d7544adc4c5c9ea952a558105b7fb008bcdf57b8585116dd0ba0e073c8c51
Instruction ID: 5debfe9fa61ddc0895d50436e32c064dfadab0704a2d46f8f3f69887977d47b9
Opcode Fuzzy Hash: 256d7544adc4c5c9ea952a558105b7fb008bcdf57b8585116dd0ba0e073c8c51
Instruction Fuzzy Hash: 23B2893662AF988AD7808F69E88155EB3B5F788B88B106215FFCD57B18EF38C154C740

Function 00007FF657468440 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 188COMMON

Download Yara Rule

APIs

BCryptOpenAlgorithmProvider.BCRYPT ref: 00007FF6574684D8
BCryptSetProperty.BCRYPT ref: 00007FF657468502
BCryptGenerateSymmetricKey.BCRYPT ref: 00007FF65746853B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657468557
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65746865B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF657468661

Strings

AES, xrefs: 00007FF6574684CD
ChainingMode, xrefs: 00007FF6574684F7
ChainingModeGCM, xrefs: 00007FF6574684F0

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Crypt$_invalid_parameter_noinfo_noreturn$AlgorithmConcurrency::cancel_current_taskGenerateOpenPropertyProviderSymmetric
String ID: AES$ChainingMode$ChainingModeGCM
API String ID: 2556340343-1213888626
Opcode ID: 28cc97041431c2835ffbe229117bc67f1e7d44d093227bd7db572c48a0eee0c8
Instruction ID: 8ff43273d195336bf98799bb4b399850e5857131d65faf8aa42e62ac07b48e38
Opcode Fuzzy Hash: 28cc97041431c2835ffbe229117bc67f1e7d44d093227bd7db572c48a0eee0c8
Instruction Fuzzy Hash: C361F562B0878A86FB109F65E4403696364EB94BE8F184731EF6C97BD6DF3CE5918300

Function 00007FF6574663A6 Relevance: 11.2, APIs: 3, Strings: 3, Instructions: 653COMMON

Download Yara Rule

Strings

R0LdeIbKBox+mCyUdCA3Xt3YT280AXSvzrUoXsV9DPo=, xrefs: 00007FF657466449
port, xrefs: 00007FF65746705F
PVH7HYwUJT4=, xrefs: 00007FF6574664D1

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID: PVH7HYwUJT4=$R0LdeIbKBox+mCyUdCA3Xt3YT280AXSvzrUoXsV9DPo=$port
API String ID: 0-1107162665
Opcode ID: 15a63e351df6b6f9f382889964d3ddedb7750c94691e1ee735c9bda413106dca
Instruction ID: 326cbce3c8daa1e67d2909662e36df26af2ae0363275a593077d929688060170
Opcode Fuzzy Hash: 15a63e351df6b6f9f382889964d3ddedb7750c94691e1ee735c9bda413106dca
Instruction Fuzzy Hash: B0725F72A29BC981E760CB25E4403AAB3A4FBD9784F145225EBCD63B59DF3CD195CB00

Function 00007FF65749964C Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF657489EEC: GetLastError.KERNEL32 ref: 00007FF657489EFB
Part of subcall function 00007FF657489EEC: FlsGetValue.KERNEL32 ref: 00007FF657489F10
Part of subcall function 00007FF657489EEC: SetLastError.KERNEL32 ref: 00007FF657489F9B

Part of subcall function 00007FF657489EEC: FlsSetValue.KERNEL32 ref: 00007FF657489F31

GetUserDefaultLCID.KERNEL32 ref: 00007FF6574997BC

Part of subcall function 00007FF657489EEC: FlsSetValue.KERNEL32 ref: 00007FF657489F5E
Part of subcall function 00007FF657489EEC: FlsSetValue.KERNEL32 ref: 00007FF657489F6F
Part of subcall function 00007FF657489EEC: FlsSetValue.KERNEL32 ref: 00007FF657489F80

EnumSystemLocalesW.KERNEL32 ref: 00007FF6574997A3
ProcessCodePage.LIBCMT ref: 00007FF6574997E6
IsValidCodePage.KERNEL32 ref: 00007FF6574997F8
IsValidLocale.KERNEL32 ref: 00007FF65749980E
GetLocaleInfoW.KERNEL32 ref: 00007FF65749986A
GetLocaleInfoW.KERNEL32 ref: 00007FF657499886

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 35311c5f5cbb088db9cafc063da405a92d1dac0a49a1e36eea51d3b328654a2c
Instruction ID: 5a1c9d3bf796c37bc162feda577d5dc8ddebfeb5eb7518870fee2f9fa6131efb
Opcode Fuzzy Hash: 35311c5f5cbb088db9cafc063da405a92d1dac0a49a1e36eea51d3b328654a2c
Instruction Fuzzy Hash: 69717822F1860A8AFB509F61D9586FC63A4BFA8B48F4C4435CA1DE3695EF3CE845C350

Function 00007FF657487F68 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF657487FE1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF657487FF9
RtlVirtualUnwind.KERNEL32 ref: 00007FF657488034
IsDebuggerPresent.KERNEL32 ref: 00007FF65748806D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF657488077
UnhandledExceptionFilter.KERNEL32 ref: 00007FF657488082

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 518a55c6435702555d938cb12e0853557d9473da796008457dbc6bc20602c87e
Instruction ID: d74ccb33fc5368e0d89666fb6eb05bbe5f032bb3f8b4c2c0fb92f9fb1e20d79d
Opcode Fuzzy Hash: 518a55c6435702555d938cb12e0853557d9473da796008457dbc6bc20602c87e
Instruction Fuzzy Hash: 1631A036618B8586EB20CF25E8402AE73A4FB88794F580135EB9D93B98DF3CD545CB00

Function 00007FF6573F70E0 Relevance: 8.7, Strings: 2, Instructions: 6192COMMON

Download Yara Rule

Strings

\| , xrefs: 00007FF6573FC52D
0| , xrefs: 00007FF6573FA83D

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID: 0| $\|
API String ID: 0-2050777373
Opcode ID: ad8b8a06ee8e7dbd9eb0ed87f328e0d9eefed4ef2557dac10ab3baeca558fbf1
Instruction ID: 7aa0b159e8ea1e1c0f2b370a35262c5bb2c9415899eea2ab8fecfa1c457a679c
Opcode Fuzzy Hash: ad8b8a06ee8e7dbd9eb0ed87f328e0d9eefed4ef2557dac10ab3baeca558fbf1
Instruction Fuzzy Hash: 3904F332915FC889D7759F39EC852D977A4F79978CF006215EB8C6AB29EF3493A08301

Function 00007FF65746C8E0 Relevance: 7.9, APIs: 5, Instructions: 391COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF65746C943
ShellExecuteW.SHELL32 ref: 00007FF65746CF8A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65746D013
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65746D019
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65746D01F

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ExecuteFileModuleNameShell
String ID:
API String ID: 3435646932-0
Opcode ID: a7338904e57405cb7424316b332a1e38ca99d4c22208ccb12818e04892214995
Instruction ID: ad2b9aa97d62cd115fad3bcf2e32ec57fd9fb2d9128c75050febec8bd91550f0
Opcode Fuzzy Hash: a7338904e57405cb7424316b332a1e38ca99d4c22208ccb12818e04892214995
Instruction Fuzzy Hash: 04122A72A29FC88ADB408F29E88069EB3A4F788794F505225FEDD57B59EF38D150C740

Function 00007FF6574AD804 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6574AD865
IsDebuggerPresent.KERNEL32 ref: 00007FF6574AD87D
OutputDebugStringW.KERNEL32 ref: 00007FF6574AD88E

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF6574AD887

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: 9ee4415ca50324c33a3d5a57874f9cc99ad178eb9645fb895110d63af1d9e2c1
Instruction ID: dabee08c0a428b9659cf5131666d979b4c7c17a77e4a6dbc15d523bfdc7778dd
Opcode Fuzzy Hash: 9ee4415ca50324c33a3d5a57874f9cc99ad178eb9645fb895110d63af1d9e2c1
Instruction Fuzzy Hash: 33118F32A14B56A7F7049B26D64837933A5FF44345F584034C64DD3A54EF7CE468CB00

Function 00007FF65749A44F Relevance: 6.4, Strings: 5, Instructions: 198COMMON

Download Yara Rule

Strings

1#SNAN, xrefs: 00007FF65749A4C2
1#QNAN, xrefs: 00007FF65749A4CB
1#IND, xrefs: 00007FF65749A49F
W$, xrefs: 00007FF65749A530
1#INF, xrefs: 00007FF65749A4DB

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 1#IND$1#INF$1#QNAN$1#SNAN$W$
API String ID: 3215553584-4287779413
Opcode ID: e914ef83dae64b72f50003c00f300a4745ddd1fbbdf1c541f482026cce5ebf66
Instruction ID: 8f6d460e46f003032be6bdc077ae4494c497f1a3cf888f22e3899a7c142b343d
Opcode Fuzzy Hash: e914ef83dae64b72f50003c00f300a4745ddd1fbbdf1c541f482026cce5ebf66
Instruction Fuzzy Hash: 1B710663F1824A4BE7208F78D6447B97691ABA0794F085635DA1DEAAC5DE3CF944CB00

Function 00007FF657489038 Relevance: 6.1, APIs: 4, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FF65748908F
GetSystemInfo.KERNEL32 ref: 00007FF6574890A8
VirtualAlloc.KERNEL32 ref: 00007FF657489116
VirtualProtect.KERNEL32 ref: 00007FF657489131

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: 6131e7ac5c004b666fb02de1823fa69e50ababb2f1d6eff18536aed83fe204ab
Instruction ID: 8b3fa6d698c55e60c3280d5b2f3d3b0201968c66885aff55f9e9915ba4cc75f2
Opcode Fuzzy Hash: 6131e7ac5c004b666fb02de1823fa69e50ababb2f1d6eff18536aed83fe204ab
Instruction Fuzzy Hash: 75314F32714A899EEB20CF32D8487ED63A5FB48B88F584035EA4D97B58DF38D645C740

Function 00007FF65749F908 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF65749F934
GetCurrentThreadId.KERNEL32 ref: 00007FF65749F942
GetCurrentProcessId.KERNEL32 ref: 00007FF65749F94E
QueryPerformanceCounter.KERNEL32 ref: 00007FF65749F95E

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 4ffc0ff1ccd2cf120a16052376350404e0c91ed7b37e0d63ec5629fc76b72274
Instruction ID: dd5b8582d4a146555c7b8c7b58905c2be309d6956b90ef895c70753b3c162d3a
Opcode Fuzzy Hash: 4ffc0ff1ccd2cf120a16052376350404e0c91ed7b37e0d63ec5629fc76b72274
Instruction Fuzzy Hash: 4D117C22B14F068AEB00CF61E8442B973A4FB19769F480E31DA2D967A4DF78D1988340

Function 00007FF6574936A8 Relevance: 5.5, APIs: 3, Instructions: 1005COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF657493ADE
_get_daylight.LIBCMT ref: 00007FF657493B79
_get_daylight.LIBCMT ref: 00007FF657493B92

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: 91154ea289c3556cf103cf6e37fc2ba0624cd5322ab1aec8ddf48183395d8b30
Instruction ID: dec32e69a862944d51dc1ea2068147839c1217bb719909351316e9bfe5c2a7a0
Opcode Fuzzy Hash: 91154ea289c3556cf103cf6e37fc2ba0624cd5322ab1aec8ddf48183395d8b30
Instruction Fuzzy Hash: 5792E332A0868A86EB648F24D65417E37A5FFA6B84F1C8135DB8D97B94DF3DE914C300

Function 00007FF6574AB170 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,?,?,?,?,?,00000000,00007FF65741C419), ref: 00007FF6574AB196
FormatMessageA.KERNEL32 ref: 00007FF6574AB1C9

Strings

!x-sys-default-locale, xrefs: 00007FF6574AB189

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: e9313e5009c165bfc27bb14f9f63cf4f23352891cc12b2974ad7925588fd8796
Instruction ID: b9cb2889f01e5ee2264d10c57baf533366eabdd620c1ec20c82037b06582b8b0
Opcode Fuzzy Hash: e9313e5009c165bfc27bb14f9f63cf4f23352891cc12b2974ad7925588fd8796
Instruction Fuzzy Hash: 7201D272B1878A82F7118B22F84477AA7A3FB847C5F588135DA49A7A98CF3CE505C700

Function 00007FF657483150 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF6574831B6
memcpy_s.LIBCPMT ref: 00007FF6574831E1

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: eb07a1fe8bff8429000d82fc6708e1dd14e73367c47fa60bb37c8b50ad77a0f3
Instruction ID: 6c9d1173410306e9a3bbd6acb739233d74f74dd09c38d1284f512c0224790fe9
Opcode Fuzzy Hash: eb07a1fe8bff8429000d82fc6708e1dd14e73367c47fa60bb37c8b50ad77a0f3
Instruction Fuzzy Hash: D2C1C472B1968D87E724CF19A04466EBB91F794B84F499235DB4AA3744DF3DF801CB80

Function 00007FF657468020 Relevance: 4.7, APIs: 3, Instructions: 248COMMON

Download Yara Rule

APIs

BCryptDecrypt.BCRYPT ref: 00007FF6574681E0

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: CryptDecrypt
String ID:
API String ID: 2620231605-0
Opcode ID: 41a4e3b263d86430587555ea87b064efdc892d4a8246d1996e2cb04c2cb418fc
Instruction ID: 94b32e500255e0615563241e52f319420748a49ab4e6b20752d531c9c1550e50
Opcode Fuzzy Hash: 41a4e3b263d86430587555ea87b064efdc892d4a8246d1996e2cb04c2cb418fc
Instruction Fuzzy Hash: 75B17B72F08B899AEB10CB61E4503AD37B5F754788F088226DE4C67B99DF79D699C300

Function 00007FF657476540 Relevance: 4.7, APIs: 3, Instructions: 187COMMON

Download Yara Rule

APIs

EnumDisplayDevicesW.USER32 ref: 00007FF657476657
EnumDisplayDevicesW.USER32 ref: 00007FF6574766FB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65747684F

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: DevicesDisplayEnum$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2655931952-0
Opcode ID: f507a30d70ee057908b22546e2470796b9c3370cd71b1d2e03abf081ab0b41f6
Instruction ID: d51eea63ab89d68aa37ce8d8d921a5f33e3285b489d0553515c06f54a3247d99
Opcode Fuzzy Hash: f507a30d70ee057908b22546e2470796b9c3370cd71b1d2e03abf081ab0b41f6
Instruction Fuzzy Hash: 1781F432A18B8986E710CF21E8443AE77A5F788798F545235EE9C67B98DF3CD181CB00

Function 00007FF6574990C8 Relevance: 4.7, APIs: 3, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF657489EEC: GetLastError.KERNEL32 ref: 00007FF657489EFB
Part of subcall function 00007FF657489EEC: FlsGetValue.KERNEL32 ref: 00007FF657489F10
Part of subcall function 00007FF657489EEC: SetLastError.KERNEL32 ref: 00007FF657489F9B

Part of subcall function 00007FF657489EEC: FlsSetValue.KERNEL32 ref: 00007FF657489F31

GetLocaleInfoW.KERNEL32 ref: 00007FF657499134

Part of subcall function 00007FF65747FBA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65747FBBD

GetLocaleInfoW.KERNEL32 ref: 00007FF65749917D

Part of subcall function 00007FF65747FBA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65747FC16

GetLocaleInfoW.KERNEL32 ref: 00007FF657499245

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
String ID:
API String ID: 1791019856-0
Opcode ID: 8cdfe7f1b5fd9999da327c4f4609675d5690c7bae2d768c40d9912784c01383a
Instruction ID: bb2dae5db24723a200faa60b4a938c7987a135b4e71c8eae026fb48f886e935c
Opcode Fuzzy Hash: 8cdfe7f1b5fd9999da327c4f4609675d5690c7bae2d768c40d9912784c01383a
Instruction Fuzzy Hash: 2C61AC32A0864A8AEB348F21E6496BD73A5FBA4744F498135CB8EE36D1DF3CE451C700

Function 00007FF65748F0D8 Relevance: 3.9, Strings: 3, Instructions: 144COMMON

Download Yara Rule

Strings

-, xrefs: 00007FF65748F237
e+000, xrefs: 00007FF65748F1E5
gfff, xrefs: 00007FF65748F262

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID: -$e+000$gfff
API String ID: 0-2620144452
Opcode ID: c7e19593615f5b016f33edca04d76eabfb088503034d3aa1c419b3a715446e94
Instruction ID: d3fa685671ea82add9e920b79c406dffeea5f153709ed68fa76c76b325e8b15d
Opcode Fuzzy Hash: c7e19593615f5b016f33edca04d76eabfb088503034d3aa1c419b3a715446e94
Instruction Fuzzy Hash: 465158A6B186CD46E7258F35E840769BB91F744B94F4C8231CBA8DBAD6CF3EE4408740

Function 00007FF65748E020 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF65748E094

Strings

GetLocaleInfoEx, xrefs: 00007FF65748E03C, 00007FF65748E04D

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 099550578a3a416ea78b7fa52ed638fc0f733537aeae7f3447c0ea0cdfd8c17a
Instruction ID: 3210d012bd181263c0c3b17f87bd43b18d6766de26be1618e831d844b45ac46d
Opcode Fuzzy Hash: 099550578a3a416ea78b7fa52ed638fc0f733537aeae7f3447c0ea0cdfd8c17a
Instruction Fuzzy Hash: 1B01A720B08699CAEB409B57B4401AAA764FF85BC0F5C8035DE4DA3759CE3CD5458380

Function 00007FF6574914E4 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF657491733
RaiseException.KERNEL32 ref: 00007FF657491744

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 7fa2203b5ce5cf4252278981a869295bf258e597fb1a3e488d01a74adacce12a
Instruction ID: e5c62c850d136fb0c09a8c997f50c064dce8ac840e3c02ca7e0baaaa85bff286
Opcode Fuzzy Hash: 7fa2203b5ce5cf4252278981a869295bf258e597fb1a3e488d01a74adacce12a
Instruction Fuzzy Hash: 65B15B77A14B898BEB15CF29C98636C7BA0F784B88F198921DB5D937A4CF39D851C700

Function 00007FF65749C128 Relevance: 3.2, APIs: 2, Instructions: 208COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF65749C1CD
_invalid_parameter_noinfo.LIBCMT ref: 00007FF65749C38F

Part of subcall function 00007FF65748DA30: HeapAlloc.KERNEL32(?,?,00000000,00007FF65748A0C6,?,?,-2723E8D8DEBC5093,00007FF657484E71,?,?,?,?,00007FF65748D3FC), ref: 00007FF65748DA85

Part of subcall function 00007FF65748D3C8: RtlFreeHeap.NTDLL ref: 00007FF65748D3DE
Part of subcall function 00007FF65748D3C8: GetLastError.KERNEL32 ref: 00007FF65748D3E8

Part of subcall function 00007FF65749D894: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65749D8C7

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: ErrorHeapLast_invalid_parameter_noinfo$AllocFree
String ID:
API String ID: 749460637-0
Opcode ID: 48abd3eca42c9b18cc16577c81390b59a986c53ac423976c1b2dda2ad83ccb99
Instruction ID: 40f8f62cdcf884923abca21f1e1cc0cfdb3506f915c926bbbfc6f2426c9e918f
Opcode Fuzzy Hash: 48abd3eca42c9b18cc16577c81390b59a986c53ac423976c1b2dda2ad83ccb99
Instruction Fuzzy Hash: E3612722B0974A42E7259F76A5006BEB291BF99BC0F484536EE4DE7785EE3CE4018744

Function 00007FF6574683C0 Relevance: 3.0, APIs: 2, Instructions: 38COMMON

Download Yara Rule

APIs

BCryptCloseAlgorithmProvider.BCRYPT ref: 00007FF6574683D9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657468436

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: AlgorithmCloseCryptProvider_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1900905105-0
Opcode ID: d48272242ff38cb51ff281d933a05202fbbbe6e34663287e7ca53ddf03012e02
Instruction ID: 3d373368cdf7ae32d6077457adc2972368ba4d64fab9e21085a8c6bedf8325d0
Opcode Fuzzy Hash: d48272242ff38cb51ff281d933a05202fbbbe6e34663287e7ca53ddf03012e02
Instruction Fuzzy Hash: AA01C2F2B04A8986FB18DF21E44833D6365FB44F88F984431DA8C5768AEF7DC9858380

Function 00007FF6574946E4 Relevance: 2.9, Strings: 2, Instructions: 358COMMONLIBRARYCODE

Download Yara Rule

Strings

am/pm, xrefs: 00007FF657494993
a/p, xrefs: 00007FF6574949FE

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID: a/p$am/pm
API String ID: 0-3206640213
Opcode ID: d4351435efb39c397654aac4863534f6b364d586ca34e5132229a126b3ed6b80
Instruction ID: b0e01827c958c66e68f377d6acc2cb09f2e1f4b72c91ee481b97492f7a3a1ffb
Opcode Fuzzy Hash: d4351435efb39c397654aac4863534f6b364d586ca34e5132229a126b3ed6b80
Instruction Fuzzy Hash: D4E1BE22E0C64A85E7748FA9D6546BE23A5FF65784F5D4132EA4DA7B84DF3CEA40C300

Function 00007FF6574971D8 Relevance: 1.8, APIs: 1, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 068306ddd40209d889ad2deda50cfd289cb5f07b5063c8971a8727913c04ec65
Instruction ID: 611d17df2ec6d7cf485fa76668071e36080cdbe8cf3bd19656852556c63d4c7e
Opcode Fuzzy Hash: 068306ddd40209d889ad2deda50cfd289cb5f07b5063c8971a8727913c04ec65
Instruction Fuzzy Hash: BEE19132A04B4986E720CB61E5416EE77A4F794788F444632DF8DA3B52EF3CE245C740

Function 00007FF65744C0F0 Relevance: 1.7, APIs: 1, Instructions: 232COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65744C40B

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 98235232c3843070ef5bf686484d813504dcd6c2f0b038ef8300070e1db878f7
Instruction ID: 5f267e9590139ffd03397635ef98e833013d85542c06ba13fe6365efc68135b2
Opcode Fuzzy Hash: 98235232c3843070ef5bf686484d813504dcd6c2f0b038ef8300070e1db878f7
Instruction Fuzzy Hash: 69A19C22B09B998AEB00CFA9D4803AC7771F759748F588526DF8EA3B55DF38D091D350

Function 00007FF65744B780 Relevance: 1.7, APIs: 1, Instructions: 220COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65744BAA9

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: a9167eaa65478a799c7f3ec9e29dde26aa86ec3791fbfc1cbc06c4d1a3e3b434
Instruction ID: 9028e90843f32a0eaaeaa3a9e0e10e2245903d0aff08f6e14c734f8464b3e601
Opcode Fuzzy Hash: a9167eaa65478a799c7f3ec9e29dde26aa86ec3791fbfc1cbc06c4d1a3e3b434
Instruction Fuzzy Hash: A9A1AC23A19B9989EB00CFA9D8803AC37B1F759748F584526DF8DA7B55DF39D091E300

Function 00007FF65744B480 Relevance: 1.7, APIs: 1, Instructions: 214COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65744B778

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: ee73bd9d09c20f297f2a01f28865ea8fe05cc9b9492eca1e9cf794edd79c1b3c
Instruction ID: 39d2ddca3758416030458675edb1abe0929c38fbb94727b59f515a90478a66f5
Opcode Fuzzy Hash: ee73bd9d09c20f297f2a01f28865ea8fe05cc9b9492eca1e9cf794edd79c1b3c
Instruction Fuzzy Hash: F4A18C22B19B9999EB00CF69D4803AC77B1F759B48F588426CF8DA7B55DF39E091E300

Function 00007FF65744C420 Relevance: 1.7, APIs: 1, Instructions: 210COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65744C718

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 19b8e35a52236dea822ac287a77672b763b92d4e180ebbf92390928410f80ccd
Instruction ID: 603aac22a448d2f27c7736d0c104425f4e2edc2151095abdcf0e1b6822afd180
Opcode Fuzzy Hash: 19b8e35a52236dea822ac287a77672b763b92d4e180ebbf92390928410f80ccd
Instruction Fuzzy Hash: 59A18822A09B9999EB00CF69D4803BC67B1F759B48F588426DF8DA7B95DF38D091E340

Function 00007FF657499310 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF657489EEC: GetLastError.KERNEL32 ref: 00007FF657489EFB
Part of subcall function 00007FF657489EEC: FlsGetValue.KERNEL32 ref: 00007FF657489F10
Part of subcall function 00007FF657489EEC: SetLastError.KERNEL32 ref: 00007FF657489F9B

Part of subcall function 00007FF657489EEC: FlsSetValue.KERNEL32 ref: 00007FF657489F31

GetLocaleInfoW.KERNEL32 ref: 00007FF657499378

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: d3f265d93177da05e9e3079d3dae9c7822de4fa7ba26229b0f968e85ede82faf
Instruction ID: 3e8bb21312459420c6915a54c249d40f97a23d30cc3ec7f09cbe1d4d4d9bb2f8
Opcode Fuzzy Hash: d3f265d93177da05e9e3079d3dae9c7822de4fa7ba26229b0f968e85ede82faf
Instruction Fuzzy Hash: 34315E32A0868A87EB34CF22E5553BE73A1FB98785F488135DA4DE3695DF3CE4118740

Function 00007FF657416510 Relevance: 1.6, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

QN , xrefs: 00007FF657416877

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID: QN
API String ID: 0-3349929942
Opcode ID: 4adeaebae40e5ff169471ee5d4a8d23a557c17ee84dec89bc840266fd6fece81
Instruction ID: 94febc8783bf031442a7d31a1414253a7083a60fa5ac0ef22e7b1deedd2f3d37
Opcode Fuzzy Hash: 4adeaebae40e5ff169471ee5d4a8d23a557c17ee84dec89bc840266fd6fece81
Instruction Fuzzy Hash: 7102D732915FC889D7228F39E8803D9B7A4F7AD788F145225EACC66B59EF74D290C740

Function 00007FF657498F60 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF657489EEC: GetLastError.KERNEL32 ref: 00007FF657489EFB
Part of subcall function 00007FF657489EEC: FlsGetValue.KERNEL32 ref: 00007FF657489F10
Part of subcall function 00007FF657489EEC: SetLastError.KERNEL32 ref: 00007FF657489F9B

EnumSystemLocalesW.KERNEL32 ref: 00007FF657498FFE

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: b863ec2cec9009a3af30c9a1a615a32510d45c83cc126c9469ae93d30e306958
Instruction ID: 4435cf14b496b6c4558e55fb45c601d930e5c3d8b01eb0d2e1feca10e4f0589f
Opcode Fuzzy Hash: b863ec2cec9009a3af30c9a1a615a32510d45c83cc126c9469ae93d30e306958
Instruction Fuzzy Hash: 9111E463E08649CAEB148F1AD1446BC7BA1FBA0FA0F485135D629933C4DE78D5D1C740

Function 00007FF657499518 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF657489EEC: GetLastError.KERNEL32 ref: 00007FF657489EFB
Part of subcall function 00007FF657489EEC: FlsGetValue.KERNEL32 ref: 00007FF657489F10
Part of subcall function 00007FF657489EEC: SetLastError.KERNEL32 ref: 00007FF657489F9B

GetLocaleInfoW.KERNEL32(?,?,?,00007FF6574992C2), ref: 00007FF65749954F

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: 8a450860209e15821de9f16c01ed0612a725223f9a4b72f88eafb3edea00904a
Instruction ID: d07432f0335f99aa259208181d7392480a36b09d699367041e2d4d53a4a3fe6a
Opcode Fuzzy Hash: 8a450860209e15821de9f16c01ed0612a725223f9a4b72f88eafb3edea00904a
Instruction Fuzzy Hash: 91113A33F1855A97E7748725A14867F62A0EBE4774F5D8631D62EA37C4DF29D8818300

Function 00007FF657499030 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF657489EEC: GetLastError.KERNEL32 ref: 00007FF657489EFB
Part of subcall function 00007FF657489EEC: FlsGetValue.KERNEL32 ref: 00007FF657489F10
Part of subcall function 00007FF657489EEC: SetLastError.KERNEL32 ref: 00007FF657489F9B

EnumSystemLocalesW.KERNEL32 ref: 00007FF6574990AE

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 0c241287891358d20c5c1590d81d3974ae3e0a48a457f3cbc01ffa927b921278
Instruction ID: 9473748362a28cfefbfc4dd77119ffdb20b18b9c3e5495a5cb29fd6309b881b1
Opcode Fuzzy Hash: 0c241287891358d20c5c1590d81d3974ae3e0a48a457f3cbc01ffa927b921278
Instruction Fuzzy Hash: 9101D872F0828986EB904F26E5487BD7691EB90BA4F4D8231D679972D4CF7D9485C700

Function 00007FF657486164 Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

, xrefs: 00007FF657486346

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: d56b133698f6429a15668cf33a50c2b0452d3e907794045ce25e286071ddca93
Instruction ID: df7922f4f532aed3490e284b00b841598c88d929be227f08017294527a5a3d7b
Opcode Fuzzy Hash: d56b133698f6429a15668cf33a50c2b0452d3e907794045ce25e286071ddca93
Instruction Fuzzy Hash: F2B15D72A08B8D86E7A58F29D05023D3BA4F745F48F2C4135CA4EA7396DF39D441C786

Function 00007FF6574183D0 Relevance: .8, Instructions: 795COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0538767b6b45461ea7b05e4291f3168d71c376be44ab5dc851c2711e80cf8c7
Instruction ID: 4b0f44117a761415e72a79f68b08745a76fb580a68168a26f79b0bdd2479df53
Opcode Fuzzy Hash: d0538767b6b45461ea7b05e4291f3168d71c376be44ab5dc851c2711e80cf8c7
Instruction Fuzzy Hash: DDA26136615FD88AD7418FAAEC8119973B6F7487A8B101629EECC67F18EFB4C164C740

Function 00007FF657415520 Relevance: .8, Instructions: 792COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3b4314df5a9dd1bf2d416c6b90a8968c52bf1c8688550b22f47b752bc25c5be
Instruction ID: 3eb770833693b1393f62f8a74eea7daba0aa94c2ff215e8d3e15c1a9bc4671dd
Opcode Fuzzy Hash: b3b4314df5a9dd1bf2d416c6b90a8968c52bf1c8688550b22f47b752bc25c5be
Instruction Fuzzy Hash: 8792F832918BC88AD7718F25E8812DAB7A8F79D748F505315EACC66B19EF38D394C704

Function 00007FF657452750 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff8ff783da37649173626c7f7158936b22345755ff077d27462f74136c1878ba
Instruction ID: b38821ae56433776204c9289c4b6db1497e34770e7c94654b5f03cf1c0d71ec0
Opcode Fuzzy Hash: ff8ff783da37649173626c7f7158936b22345755ff077d27462f74136c1878ba
Instruction Fuzzy Hash: 35C1E2B3B2869987EB56CF12E944979B762F7D4BE0B49C131DA4A57B84CE3CD842C700

Function 00007FF6573F6610 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38d7c90575225d3cfb1e6d7dcfc875cc052531634206d00c939ffb4ffa2d96a3
Instruction ID: 46bc4fe1480b2b2c23e1b3edef4c92519c5bf796a353e713bf85fe6a206251b6
Opcode Fuzzy Hash: 38d7c90575225d3cfb1e6d7dcfc875cc052531634206d00c939ffb4ffa2d96a3
Instruction Fuzzy Hash: 7012E932919FC989D7708F29E84129AB3A4F79D788F545325EACC67B19EF38D250CB04

Function 00007FF65748A924 Relevance: .3, Instructions: 309COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: a2379e98abae736fe33e8b4f9fedcc0141c51f1be06055089ccb01d873b85599
Instruction ID: c8b35ed1eaf838bc48ba5cc1e8e9cb3ff9ef113e1e5819e1ad13c6c688467404
Opcode Fuzzy Hash: a2379e98abae736fe33e8b4f9fedcc0141c51f1be06055089ccb01d873b85599
Instruction Fuzzy Hash: EDC1F663B0868E85EB609B6599103BA27E1FB94788F484036DE8DE7B84EF7CD545C780

Function 00007FF65748666C Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0c2dc1868310f7be340402d514fcc5ddbcaaf30b09b4b1a75e66e521b583746
Instruction ID: e6b3354bd44015a24e295cdb045c61039d03a5c41b9d69046b5a3ad99d894f19
Opcode Fuzzy Hash: f0c2dc1868310f7be340402d514fcc5ddbcaaf30b09b4b1a75e66e521b583746
Instruction Fuzzy Hash: B2C1E222A0864E86EBA9CF29C44067D37A1FB05B48F184235CE1DA77D6DF39E845C7C2

Function 00007FF657498674 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: ErrorLast$Value_invalid_parameter_noinfo
String ID:
API String ID: 1500699246-0
Opcode ID: 468b93f19c7ca54f8d79ce9aecab092ca155e8bca1880fa3cbddf3014db9fedd
Instruction ID: 7cc4559bdbb9ce26295b32191bec9964f5c32e80e03b6cdfba97fbf5b16c5f87
Opcode Fuzzy Hash: 468b93f19c7ca54f8d79ce9aecab092ca155e8bca1880fa3cbddf3014db9fedd
Instruction Fuzzy Hash: 17B11A32E1864E82EB64DF29DA116BA73A4FB60B88F084131DA5DD36C9DF3CE541C340

Function 00007FF657444720 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8096616a82d0af589e55529d9e21aaaddb0a4067eb04550f42ec58ec897b5e0e
Instruction ID: 975f9e89fbbe752ece3ccde21c509e2e300db4dcd499e86354079fa99ce75270
Opcode Fuzzy Hash: 8096616a82d0af589e55529d9e21aaaddb0a4067eb04550f42ec58ec897b5e0e
Instruction Fuzzy Hash: A261E722B18BC982DA10CF2DE4456A9A361F7597D4F589231DBDD97B88EF7CE180D340

Function 00007FF6574AFFBC Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6b3816cb3a988972d41337c60df476b316031ac7a58811eca424fd60ba025d64
Instruction ID: d9d679e0de19839e20c860dd604c8eb114666bc9dd397754e492ea2b8f1d20fd
Opcode Fuzzy Hash: 6b3816cb3a988972d41337c60df476b316031ac7a58811eca424fd60ba025d64
Instruction Fuzzy Hash: 5061F822E1C24A86FF788B38D45063D6681AF80761F1C4239EA6DE27E5EE7DFC408700

Function 00007FF65748F7E6 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afd72482e03d17e0c267891211c2a08fffdf3b2de236a6c27577c882ac387638
Instruction ID: 188c18fd27a845e3db436c32e12f131a0235b64267738e085f5994eff1a58f86
Opcode Fuzzy Hash: afd72482e03d17e0c267891211c2a08fffdf3b2de236a6c27577c882ac387638
Instruction Fuzzy Hash: 795109B2A0C78D86EB74CB19E440379B690FB467D4F184235DA9EA3B9ADF3CD4408B40

Function 00007FF65746E2F0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fb7937483d9751731351928e76aee8723c875862e1f4a830a78d4c5ab3ff41f
Instruction ID: 21d563e5d2b1b8e2e2524344eaad289f83ad517f7391eb7a0ec9a5cea8ed641c
Opcode Fuzzy Hash: 8fb7937483d9751731351928e76aee8723c875862e1f4a830a78d4c5ab3ff41f
Instruction Fuzzy Hash: E05104A3B0568443DB248B59F842796F7A5FB987C5F04A126EE8D57B68EB3CD580C700

Function 00007FF65748579C Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction ID: 63f94340d9a9208a64a12a53a0676e4c96819ce7c195b03c5c95f27300549f0d
Opcode Fuzzy Hash: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction Fuzzy Hash: D0516536A1869D85E7648B2AC064278B7A1EB45F58F2C8131CE4DA7794CF3AE953C7C0

Function 00007FF657485598 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction ID: 5d9cf76ee741fd19157adbf16b9d35e92c9f2e8abefa1c182c730f8cccd80a51
Opcode Fuzzy Hash: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction Fuzzy Hash: B9518536A1869D86E7258B2AD060239B7A1EB44B58F6C4131CE4DA7794DF3AED43C7C0

Function 00007FF657485394 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction ID: 44b23129882846e639f39eb05dd0e67771106876dfd7b047fb98ed5427f97e1a
Opcode Fuzzy Hash: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction Fuzzy Hash: E4518976A2869D86E7248B1AD06033877A1EB45F58F3D4131DE4DA7794DF3AE842C7C0

Function 00007FF657465180 Relevance: 18.5, APIs: 12, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF657464A30: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF657464A86
Part of subcall function 00007FF657464A30: Process32FirstW.KERNEL32 ref: 00007FF657464ACA
Part of subcall function 00007FF657464A30: Process32NextW.KERNEL32 ref: 00007FF657464ADF
Part of subcall function 00007FF657464A30: OpenProcess.KERNEL32 ref: 00007FF657464B1B
Part of subcall function 00007FF657464A30: OpenProcessToken.ADVAPI32 ref: 00007FF657464B42
Part of subcall function 00007FF657464A30: CloseHandle.KERNEL32 ref: 00007FF657464CB6
Part of subcall function 00007FF657464A30: Process32NextW.KERNEL32 ref: 00007FF657464CC3
Part of subcall function 00007FF657464A30: CloseHandle.KERNEL32 ref: 00007FF657464D07

ImpersonateLoggedOnUser.ADVAPI32 ref: 00007FF6574656C8
RevertToSelf.ADVAPI32 ref: 00007FF6574656E6
ImpersonateLoggedOnUser.ADVAPI32 ref: 00007FF6574651DD

Part of subcall function 00007FF65741F380: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65741F3E3

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574658D5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574658DB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574658E1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574658E7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574658ED
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574658F3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6574658F9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657465905

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Process32$CloseHandleImpersonateLoggedNextOpenProcessUser$CreateFirstRevertSelfSnapshotTokenToolhelp32
String ID:
API String ID: 2435156947-0
Opcode ID: 9eb6316bf9a3d5c729c92944e00dde4c55d48e24f54c754d0e24de184432b793
Instruction ID: b2fcab2ae45a328b0edb86e84f72ec10db91cc4d5af80a52f631434d5642fadb
Opcode Fuzzy Hash: 9eb6316bf9a3d5c729c92944e00dde4c55d48e24f54c754d0e24de184432b793
Instruction Fuzzy Hash: 8922F362F187C986FB00DB69D4443ADA761FB817A4F544231EA6DA7ADADF7CE480C700

Function 00007FF65743B780 Relevance: 17.9, APIs: 5, Strings: 5, Instructions: 365COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65743BCDA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65743BCE0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65743BCE6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65743BCEC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65743BCF2

Strings

; expected , xrefs: 00007FF65743BC37
; last read: ', xrefs: 00007FF65743B9AC
syntax error , xrefs: 00007FF65743B7BF
while parsing , xrefs: 00007FF65743B828
unexpected , xrefs: 00007FF65743BB37

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: ; expected $; last read: '$syntax error $unexpected $while parsing
API String ID: 3668304517-4239264347
Opcode ID: 5482d99d6467dd541796cf15ca70dd4478214447603d9d44f67822b737eefd82
Instruction ID: 625e112b17e10cacffd566cd27754be9cbbfbea96e9e537c9dc0229f35254d3a
Opcode Fuzzy Hash: 5482d99d6467dd541796cf15ca70dd4478214447603d9d44f67822b737eefd82
Instruction Fuzzy Hash: 50F1B662F14A8589FB10DBA5E4403ED2B72FB017A8F584235DE2DABAC9DF7894C5D340

Function 00007FF657480254 Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 407COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF657480283
_invalid_parameter_noinfo.LIBCMT ref: 00007FF657480353

Strings

0, xrefs: 00007FF65748037D
0, xrefs: 00007FF657480325
0, xrefs: 00007FF65748038F

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$0$0
API String ID: 3215553584-3137946472
Opcode ID: 4b936a4394e80428ad7bf41d875096a3e7add69c0315c25dc0869b4c3066c4ac
Instruction ID: 2d4dd572102570d7880e14560fa0df54f509815935a91cf2407e45e0148e6945
Opcode Fuzzy Hash: 4b936a4394e80428ad7bf41d875096a3e7add69c0315c25dc0869b4c3066c4ac
Instruction Fuzzy Hash: E9E1C732E6E64E8AF7608F28C1903BD37959B51B84F5D8032C68DE77A5CE3DA459C780

Function 00007FF65746B2D0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00007FF65746B33B
InternetOpenUrlA.WININET ref: 00007FF65746B370
InternetReadFile.WININET ref: 00007FF65746B391
InternetReadFile.WININET ref: 00007FF65746B3CF
InternetCloseHandle.WININET ref: 00007FF65746B3DC
InternetCloseHandle.WININET ref: 00007FF65746B3E5

Strings

File Downloader, xrefs: 00007FF65746B334

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Internet$CloseFileHandleOpenRead
String ID: File Downloader
API String ID: 4038090926-3631955488
Opcode ID: 2d8777ee4260c80b314c9bed156458a8780df2b315401914807f3b6119ccca09
Instruction ID: 1e5281bd11dc58c4e9818d8559498b137289bbb40d2923cdd9ba4edf3e6f8a23
Opcode Fuzzy Hash: 2d8777ee4260c80b314c9bed156458a8780df2b315401914807f3b6119ccca09
Instruction Fuzzy Hash: C2317232B1878986E7108F12E9546AEB365FB88BC4F684135EE4D93B58DF7CE585CB00

Function 00007FF6574838F0 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF657483933
_invalid_parameter_noinfo.LIBCMT ref: 00007FF657483D20
_invalid_parameter_noinfo.LIBCMT ref: 00007FF657483FBC

Strings

p, xrefs: 00007FF657483A5D
f, xrefs: 00007FF657483A55
p, xrefs: 00007FF6574839E5

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: eea83e675726579202ae46558f478e57f494447b85c4049c91ddb9471f815998
Instruction ID: 73963f90099a9759e85a7aba9d2f7f4427f2fee66c821eae37b510d35fa358ec
Opcode Fuzzy Hash: eea83e675726579202ae46558f478e57f494447b85c4049c91ddb9471f815998
Instruction Fuzzy Hash: D412A262E0C24F86FB609B15E0542BE76A1FB80B54F8C4135E799E76C4DF7CE9808B90

Function 00007FF6574388C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF657438AA3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657438B2D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657438B33
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657438B39
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657438B3F

Strings

other_error, xrefs: 00007FF657438932

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy
String ID: other_error
API String ID: 1944019136-896093151
Opcode ID: bd17b13001254d9c0a850478066115979c2a22dcbc699032d68308099a5f5bb4
Instruction ID: 4f9dee807d35bc0775bb65f79056d2391e7124a06de7bab736784d418a75639c
Opcode Fuzzy Hash: bd17b13001254d9c0a850478066115979c2a22dcbc699032d68308099a5f5bb4
Instruction Fuzzy Hash: 6971B563F18B8A89FB00DF74D4403BD6361EB957A8F049331EA6C666DADE78E185C340

Function 00007FF65747E0C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF65747E2A3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65747E32D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65747E333
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65747E339
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65747E33F

Strings

out_of_range, xrefs: 00007FF65747E132

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy
String ID: out_of_range
API String ID: 1944019136-3053435996
Opcode ID: 5eed338d1f6e747650b889ae1832e06230ab75ee1c132848c2bc39e2781bf826
Instruction ID: e13994de40454c1a360f0a31f81a541f6ab3e348aaec1da00eb72b09a7b1df67
Opcode Fuzzy Hash: 5eed338d1f6e747650b889ae1832e06230ab75ee1c132848c2bc39e2781bf826
Instruction Fuzzy Hash: F771A363F59B8A89FB00CF75D4413AC6361EB557A8F049331EA6C66ADADE3CD185C340

Function 00007FF65749C8CC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF65749C8FD
GetLastError.KERNEL32 ref: 00007FF65749C909
CloseHandle.KERNEL32 ref: 00007FF65749C921
CreateFileW.KERNEL32 ref: 00007FF65749C94C
WriteConsoleW.KERNEL32 ref: 00007FF65749C96B

Strings

CONOUT$, xrefs: 00007FF65749C92D

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 53dac6272d403f79ff27e653aa55d51cb6535fcae6368453f164039c5e4e95e8
Instruction ID: ff78e109609e1e35944bb057e47aea0d919f30266d2f03fcb9463de0933d4d87
Opcode Fuzzy Hash: 53dac6272d403f79ff27e653aa55d51cb6535fcae6368453f164039c5e4e95e8
Instruction Fuzzy Hash: AC11B221B18B8586E7508B12E85832DA2A4FB98FE5F184234EE5ED7794DF3CD9448744

Function 00007FF6574AD42C Relevance: 9.2, APIs: 6, Instructions: 239COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF6574AD4D9
MultiByteToWideChar.KERNEL32 ref: 00007FF6574AD575
MultiByteToWideChar.KERNEL32 ref: 00007FF6574AD61E
MultiByteToWideChar.KERNEL32 ref: 00007FF6574AD648
MultiByteToWideChar.KERNEL32 ref: 00007FF6574AD6F0
CompareStringEx.KERNEL32 ref: 00007FF6574AD73D

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: 26eb7e015d5d110b74ff0d84bcaa31491d724dbf353ec7a17117fafe3eaea0ab
Instruction ID: b0bec205ef195f487c6d9d3522c4732f5dc75759177cc97496a2cf53576a949c
Opcode Fuzzy Hash: 26eb7e015d5d110b74ff0d84bcaa31491d724dbf353ec7a17117fafe3eaea0ab
Instruction Fuzzy Hash: 5BA1E762A0979A8AFF259F2484143BD6792EF44BA8F4D4631DA1DA77C9DF3CE444CB00

Function 00007FF6574AD0CC Relevance: 9.2, APIs: 6, Instructions: 206COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF6574AD13C
MultiByteToWideChar.KERNEL32 ref: 00007FF6574AD1DA
LCMapStringEx.KERNEL32 ref: 00007FF6574AD243
LCMapStringEx.KERNEL32 ref: 00007FF6574AD295
LCMapStringEx.KERNEL32 ref: 00007FF6574AD33A
WideCharToMultiByte.KERNEL32 ref: 00007FF6574AD394

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 7d9f455a94f84a05f587d57d339c879795f99f0f1217d4298ff39db3fa6ba98e
Instruction ID: a9366dd581b7e74867f316d9379b5c10d5b419666f50fd6caa776d5e198f8575
Opcode Fuzzy Hash: 7d9f455a94f84a05f587d57d339c879795f99f0f1217d4298ff39db3fa6ba98e
Instruction Fuzzy Hash: B0819672A0879986EB248F25E44027D73E6FF54BA4F584635EA5DA7BD8DF3CD4048B00

Function 00007FF657480840 Relevance: 9.2, APIs: 6, Instructions: 157COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6574808B2
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6574808E3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF657480923
_invalid_parameter_noinfo.LIBCMT ref: 00007FF657480965
_invalid_parameter_noinfo.LIBCMT ref: 00007FF65748099A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF657480A17

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 619b2885e3fd1682f6a864358b33df5452abb606e6c6f730ccce56a3fdc98189
Instruction ID: 0c73e02976a88056540b58422fe2068621b1055da438b1b34fdb3f2fb1e30ddf
Opcode Fuzzy Hash: 619b2885e3fd1682f6a864358b33df5452abb606e6c6f730ccce56a3fdc98189
Instruction Fuzzy Hash: 0D51952291D78E85F7A29F24D0603BD3791AF56B44F4C8072C6CCA73A6DE2D9446C792

Function 00007FF65748A064 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,-2723E8D8DEBC5093,00007FF657484E71,?,?,?,?,00007FF65748D3FC), ref: 00007FF65748A073
FlsSetValue.KERNEL32(?,?,-2723E8D8DEBC5093,00007FF657484E71,?,?,?,?,00007FF65748D3FC), ref: 00007FF65748A0A9
FlsSetValue.KERNEL32(?,?,-2723E8D8DEBC5093,00007FF657484E71,?,?,?,?,00007FF65748D3FC), ref: 00007FF65748A0D6
FlsSetValue.KERNEL32(?,?,-2723E8D8DEBC5093,00007FF657484E71,?,?,?,?,00007FF65748D3FC), ref: 00007FF65748A0E7
FlsSetValue.KERNEL32(?,?,-2723E8D8DEBC5093,00007FF657484E71,?,?,?,?,00007FF65748D3FC), ref: 00007FF65748A0F8
SetLastError.KERNEL32(?,?,-2723E8D8DEBC5093,00007FF657484E71,?,?,?,?,00007FF65748D3FC), ref: 00007FF65748A113

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4746ab0ae01667e2e6d412b6dde833982c3e02e747b32d9b2c8a8ce8ac8a1f22
Instruction ID: ff0faba2f617d8bff77353650d17f9c430030f95a0b8b366e4373f7742e35f1f
Opcode Fuzzy Hash: 4746ab0ae01667e2e6d412b6dde833982c3e02e747b32d9b2c8a8ce8ac8a1f22
Instruction Fuzzy Hash: F6118421F0E29E82FA5467315A5513D61925F497B0F1C0734E93EE77C6DE6CF4418781

Function 00007FF657476F40 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF657476FCB

Strings

?, xrefs: 00007FF657476F80

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Open
String ID: ?
API String ID: 71445658-1684325040
Opcode ID: 1fa6786e14b346f4e6826204825e922f72f81fb5a2e64c07a28b6b89c63cd2eb
Instruction ID: 5d53b4fdc49e1eaed00b76f9fc4541efe7c6e746600b3a39b15e5279da6ccadf
Opcode Fuzzy Hash: 1fa6786e14b346f4e6826204825e922f72f81fb5a2e64c07a28b6b89c63cd2eb
Instruction Fuzzy Hash: 8341C172A18BC985EB508B25F48036FB760FB85794F544235FB9D92A99DF3CE084CB40

Function 00007FF657494FB8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF657494FDD
GetProcAddress.KERNEL32 ref: 00007FF657494FF3
FreeLibrary.KERNEL32 ref: 00007FF65749501A

Strings

CorExitProcess, xrefs: 00007FF657494FEC
mscoree.dll, xrefs: 00007FF657494FD4

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 780b3f1f3aecbe1eb4b75bb10cd40d76e1f940e32b271abccdf7c11bca0f4dbd
Instruction ID: 6ee7d98084363eaee551349d62afa47d24c07c4a0677f25e9390471029aa3659
Opcode Fuzzy Hash: 780b3f1f3aecbe1eb4b75bb10cd40d76e1f940e32b271abccdf7c11bca0f4dbd
Instruction Fuzzy Hash: 38F09661B1964A82EB148B25E45C33A9324FF587A2FAC0235D66ED62F4DF7CD44CC740

Function 00007FF657426490 Relevance: 7.8, APIs: 5, Instructions: 312COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657426922
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657426928
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742692E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657426934
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65742693A

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 52514754f333d11c16f0aaacb59aecb138880b1369c3e25e416246a4c3b28f2a
Instruction ID: 47ab59bf4cdeef9fc0fed961184eb00f41ef13f78f3e960ef1a173a5cddd5e33
Opcode Fuzzy Hash: 52514754f333d11c16f0aaacb59aecb138880b1369c3e25e416246a4c3b28f2a
Instruction Fuzzy Hash: E0D1C362F18A9985EB10DB65E8402BD6761FB857E8F180231EE5DA7AD9DF78E490C300

Function 00007FF6574911C8 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF657491207
_set_statfp.LIBCMT ref: 00007FF657491225
_set_statfp.LIBCMT ref: 00007FF65749124E
_set_statfp.LIBCMT ref: 00007FF65749148A

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: dafef7e4c20223e5ca6141b6b5924ce650fb2efe4a4f2b5535d10e0333dca376
Instruction ID: 4849fdd137b9b98cbc50c62f89b429127754c75b729f112ee41babd82052ff71
Opcode Fuzzy Hash: dafef7e4c20223e5ca6141b6b5924ce650fb2efe4a4f2b5535d10e0333dca376
Instruction Fuzzy Hash: 7C810712D68A4E89F7329B35A6403BA6364AF69794F0C4331ED4EF65E5EF3CE5818700

Function 00007FF65747A260 Relevance: 7.6, APIs: 5, Instructions: 123COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00007FF65747A280
FreeEnvironmentStringsW.KERNEL32 ref: 00007FF65747A37B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65747A3A5
RtlInitUnicodeString.NTDLL ref: 00007FF65747A3EE
RtlInitUnicodeString.NTDLL ref: 00007FF65747A3FB

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: EnvironmentInitStringStringsUnicode$Free_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1868271193-0
Opcode ID: f38410d1663a3c3ea2f5305d9f7767b79f8e6583bd52c22dc4790f0fe6c50e43
Instruction ID: 1a7747d03735d9aa06dd5fefc7bd58088c40dc0b46ffae5a1e611dc7b8f56a7f
Opcode Fuzzy Hash: f38410d1663a3c3ea2f5305d9f7767b79f8e6583bd52c22dc4790f0fe6c50e43
Instruction Fuzzy Hash: 4D519F32A18B85C2EB108F29E44436DB760FB94B94F589621EB9D53B95DF7CE1E1C700

Function 00007FF65748A12C Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF657487EF7,?,?,00000000,00007FF657488192,?,?,?,?,-2723E8D8DEBC5093,00007FF65748811E), ref: 00007FF65748A14B
FlsSetValue.KERNEL32(?,?,?,00007FF657487EF7,?,?,00000000,00007FF657488192,?,?,?,?,-2723E8D8DEBC5093,00007FF65748811E), ref: 00007FF65748A16A
FlsSetValue.KERNEL32(?,?,?,00007FF657487EF7,?,?,00000000,00007FF657488192,?,?,?,?,-2723E8D8DEBC5093,00007FF65748811E), ref: 00007FF65748A192
FlsSetValue.KERNEL32(?,?,?,00007FF657487EF7,?,?,00000000,00007FF657488192,?,?,?,?,-2723E8D8DEBC5093,00007FF65748811E), ref: 00007FF65748A1A3
FlsSetValue.KERNEL32(?,?,?,00007FF657487EF7,?,?,00000000,00007FF657488192,?,?,?,?,-2723E8D8DEBC5093,00007FF65748811E), ref: 00007FF65748A1B4

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 87f7a83e7e24ccfef4c6b1bd58f14a392e8ac5d2182fad35838833e4213b73d6
Instruction ID: 26ed76d35b3591709fdf7fb9d27aa2769e15c780220b3e7b72c168f14e5ea36a
Opcode Fuzzy Hash: 87f7a83e7e24ccfef4c6b1bd58f14a392e8ac5d2182fad35838833e4213b73d6
Instruction Fuzzy Hash: 4911B221F0E35E42FA5893219D5117A21514F487B0F4C4334E93EE67DADE6CF401C780

Function 00007FF657489FC0 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF657489FD1
FlsSetValue.KERNEL32 ref: 00007FF657489FF0
FlsSetValue.KERNEL32 ref: 00007FF65748A018
FlsSetValue.KERNEL32 ref: 00007FF65748A029
FlsSetValue.KERNEL32 ref: 00007FF65748A03A

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b9717bcdbdab5c025e14c049e15c7c026f29638aaabd23829ef005a7220a7657
Instruction ID: 4ec515f2101b59504ffe426106b3e17b1adbe7c15885e6280017440a7fa45002
Opcode Fuzzy Hash: b9717bcdbdab5c025e14c049e15c7c026f29638aaabd23829ef005a7220a7657
Instruction Fuzzy Hash: 21112D11F0E20F82F968AB31585657D11924F4A370F1C4738EA3EFA2C6EE6DB44197C6

Function 00007FF65743F2C0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 292COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65743F4C6
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65743F4D2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65743F6D1

Strings

Nk, xrefs: 00007FF65743F5AD

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID: Nk
API String ID: 3936042273-1353404103
Opcode ID: 45261aa562b15e0f10247d9b059b39559e5c0b1ad76f68835ce0c5880bbcecd9
Instruction ID: 3d61f68f67707736db520b52b90a76d92757d56bd58581a2cfca908ab8f737af
Opcode Fuzzy Hash: 45261aa562b15e0f10247d9b059b39559e5c0b1ad76f68835ce0c5880bbcecd9
Instruction Fuzzy Hash: 35C18C33A14B858AEB10CF75E8402AD73B1FB59798F145625EF8D63B59EF38E1A18300

Function 00007FF6574AF0DC Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6574AF3BB

Part of subcall function 00007FF65749C4AC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65749C4C9

Strings

UTF-8, xrefs: 00007FF6574AF33A
UTF-16LEUNICODE, xrefs: 00007FF6574AF359
ccs, xrefs: 00007FF6574AF2F6

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: a61b9dafeebeef71c778538e02d1dd93d241f4be75a88b4b5df5efb2b9ec5def
Instruction ID: d7128ec5c6336bb39a50bc013ae34e015943dae960f48d5e05fe64c38d168de6
Opcode Fuzzy Hash: a61b9dafeebeef71c778538e02d1dd93d241f4be75a88b4b5df5efb2b9ec5def
Instruction Fuzzy Hash: D48191F7E0C20B86FBA59F25C15027837A2AB11B48F9D8035CA0AF7695DF3EE8019341

Function 00007FF657470526 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF657470647
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65747064D

Part of subcall function 00007FF6574A0E88: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,-2723E8D8DEBC5094,00007FF6574AC3D2), ref: 00007FF6574A0ED8
Part of subcall function 00007FF6574A0E88: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,-2723E8D8DEBC5094,00007FF6574AC3D2), ref: 00007FF6574A0F19

Strings

ios_base::badbit set, xrefs: 00007FF657470685, 00007FF6574706BC, 00007FF6574706FA
exists, xrefs: 00007FF657470663

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ExceptionFileHeaderRaise
String ID: exists$ios_base::badbit set
API String ID: 240014264-2074760687
Opcode ID: a4f327a84339e12cc55e92ce62d72d2997565a8db53c75ec50c66e7b8b607d78
Instruction ID: 4f82cd2b0039717dfd7d104d25b31cbe1725c8ce2e7156f8a7c030bd8c9897fe
Opcode Fuzzy Hash: a4f327a84339e12cc55e92ce62d72d2997565a8db53c75ec50c66e7b8b607d78
Instruction Fuzzy Hash: F5417272618BCE95DA21EB14E4943EE7361FBC5344F844532CA8CA3AA9DF7CD509CB40

Function 00007FF6574AB210 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF6574AB8FA), ref: 00007FF6574AB226
GetProcAddress.KERNEL32(?,?,?,00007FF6574AB8FA), ref: 00007FF6574AB236

Strings

kernel32.dll, xrefs: 00007FF6574AB21F
GetTempPath2W, xrefs: 00007FF6574AB22C

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetTempPath2W$kernel32.dll
API String ID: 1646373207-1846531799
Opcode ID: 85c4015c5df5ee79752990f65a767554006cfd6127e60443cb10f02faa6b2ab0
Instruction ID: 0306221ff1c42fd04b9a933fa9be2247a86a98be85c39c076ffbac6ab47039f8
Opcode Fuzzy Hash: 85c4015c5df5ee79752990f65a767554006cfd6127e60443cb10f02faa6b2ab0
Instruction Fuzzy Hash: FFE0ED21B08A8A86EF059B52F98C079A365BF48B92B9C5035C90E97334DE3CD49D8700

Function 00007FF65746D620 Relevance: 6.4, APIs: 4, Instructions: 370COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65746DB64
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65746DB6A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65746DB76
SysFreeString.OLEAUT32 ref: 00007FF65746DB97

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$FreeString
String ID:
API String ID: 1965679434-0
Opcode ID: fe4ae8b51c36065a66d9d8d5b874696c9f275a6234de97d390eeecfe0b6acba0
Instruction ID: f2ddbd32f6ce2c8e07389ca43acf755818d0bbdc5e293f0b764bdf32ce2ff850
Opcode Fuzzy Hash: fe4ae8b51c36065a66d9d8d5b874696c9f275a6234de97d390eeecfe0b6acba0
Instruction Fuzzy Hash: 67E1C062F18A998AFF00DBA1D4542FC2372EB45B98F444536DE1DABB9ADF38D145C380

Function 00007FF65748C578 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF65748C5F7
WriteFile.KERNEL32 ref: 00007FF65748C8BF
WriteFile.KERNEL32 ref: 00007FF65748C905
GetLastError.KERNEL32 ref: 00007FF65748C9BB

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 51ca5d62aa19301a18794717acfbf1a46562df65ce568f5fb7798e040ec77a5b
Instruction ID: 635f4c020c16f3a552c00ea77dda844a3d7b789015d426d39ab657e6ada7edbb
Opcode Fuzzy Hash: 51ca5d62aa19301a18794717acfbf1a46562df65ce568f5fb7798e040ec77a5b
Instruction Fuzzy Hash: 01D10472B18A8989E711CF75D4406AC37B1FB55BD8F0842B6CE9DA7B99DE38D406C380

Function 00007FF65748CF38 Relevance: 6.2, APIs: 4, Instructions: 218COMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,00007FF65748CF23), ref: 00007FF65748D054
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,00007FF65748CF23), ref: 00007FF65748D0DF

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 3f62383259c36c84ae499e9679ffdb2c1832cde853ef017496f7ee74174e2e70
Instruction ID: edc806b4cf2d2628fa28a59ff7113cc8da83260a518e584f5b00138f160606d8
Opcode Fuzzy Hash: 3f62383259c36c84ae499e9679ffdb2c1832cde853ef017496f7ee74174e2e70
Instruction Fuzzy Hash: D591D322F1966E85FB509F7594402BD2BA0BB49B98F5C4139DE0EB7A85CF3CD482C740

Function 00007FF65743B3D0 Relevance: 6.1, APIs: 4, Instructions: 147COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65743B528
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65743B52E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65743B534
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65743B59C

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: dc1f7467f6b438ed16d1ac356133b9821a069205ebe8ddfd552de79892740363
Instruction ID: c5d6ae9d1dba7f6571b58f911e3c8c777178039355c3488f353a91f78b885913
Opcode Fuzzy Hash: dc1f7467f6b438ed16d1ac356133b9821a069205ebe8ddfd552de79892740363
Instruction Fuzzy Hash: 18519C72716B8991EE08CF24E04436C73A5FB44F94F584636EAAC57A89CF3CD8A0C340

Function 00007FF6574806FC Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF657480775
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6574807D1
_invalid_parameter_noinfo.LIBCMT ref: 00007FF65748080C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF657480831

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f1f9df1a05da3301ed415653e8360f7cb12179a044a2575d07df28b1a0800ec9
Instruction ID: 223e1c2adf12e95f929e01eb05545a1c94310c0e6d2ac5f64c5907f4906a6b60
Opcode Fuzzy Hash: f1f9df1a05da3301ed415653e8360f7cb12179a044a2575d07df28b1a0800ec9
Instruction Fuzzy Hash: 80415222919A8D85EB52DF24C42027D3BA0EF45F84F4DC072CA8CA73A9DE3DD455C792

Function 00007FF6574378A0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6574378CB
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6574378F0
std::_Facet_Register.LIBCPMT ref: 00007FF65743799B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6574379E6

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: fce11bbf2716b712929d21612f2a8f238f427733906def6abb3c40e1e27c6ea6
Instruction ID: 2365e587069544b67fd6498cc0f77cabce0c5d58333633167791d3892c514ac8
Opcode Fuzzy Hash: fce11bbf2716b712929d21612f2a8f238f427733906def6abb3c40e1e27c6ea6
Instruction Fuzzy Hash: EF417722A18A4A84FA15DF25E88027A6760FF45BA4F5C0631EB8DE77A5DF3CE481C700

Function 00007FF6574AB3F4 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF6574AB43D
GetLastError.KERNEL32 ref: 00007FF6574AB44B
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00007FF6574350C9), ref: 00007FF6574AB480
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00007FF6574350C9), ref: 00007FF6574AB48E

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: b0c4d9c72fcc6461851340ae7f6c093d4e41e08a8bab11e5154c9cbc0382217d
Instruction ID: cacf1fb7bfbf5b7080bc0a83c848cc881c9efa21928e56d23ca3ced7c7901c36
Opcode Fuzzy Hash: b0c4d9c72fcc6461851340ae7f6c093d4e41e08a8bab11e5154c9cbc0382217d
Instruction Fuzzy Hash: DF214F76A18B8587E7208F12E44832EB7B5F789B95F284134DB89A7B54DF3CD805CB00

Function 00007FF6574AB8E0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6574AB210: GetModuleHandleW.KERNEL32(?,?,?,00007FF6574AB8FA), ref: 00007FF6574AB226
Part of subcall function 00007FF6574AB210: GetProcAddress.KERNEL32(?,?,?,00007FF6574AB8FA), ref: 00007FF6574AB236

GetLastError.KERNEL32 ref: 00007FF6574AB904

Part of subcall function 00007FF6574898B4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF65747F8CA,?,?,-2723E8D8DEBC5093,00007FF657488156), ref: 00007FF6574898DA

GetFileAttributesW.KERNEL32 ref: 00007FF6574AB913
__std_fs_open_handle.LIBCPMT ref: 00007FF6574AB93C
CloseHandle.KERNEL32 ref: 00007FF6574AB94E

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: Handle$AddressAttributesCloseErrorFeatureFileLastModulePresentProcProcessor__std_fs_open_handle
String ID:
API String ID: 156590933-0
Opcode ID: 6a84e7cc61d3f6faa1a02f0b285c9e89f06a54f244136a8e8d2e5cb925bd3053
Instruction ID: 043738ce4f5ed30a73574cbc3993f2a4bc038099710a36a8af82328cb694522d
Opcode Fuzzy Hash: 6a84e7cc61d3f6faa1a02f0b285c9e89f06a54f244136a8e8d2e5cb925bd3053
Instruction Fuzzy Hash: D011A731A1C68A45E7504B66A09863E666AEF457B0F184630F9BEE7AE5DE3CD444CB00

Function 00007FF65746B100 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF65746B16F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF65746B1B7

Strings

bad locale name, xrefs: 00007FF65746B28C

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 9bc398037248068cc44563fcd4d97228cb2260c103f1eda9f07e57ea8117e093
Instruction ID: f05774277261b27ba2f56eb2e26860c04dc5464d7651ec298526a52f1491fe6d
Opcode Fuzzy Hash: 9bc398037248068cc44563fcd4d97228cb2260c103f1eda9f07e57ea8117e093
Instruction Fuzzy Hash: BD515832B19A498AEB51DFB0E4902BD33A5EF44B48F0C4435EA4DB7A95DF38D525C384

Function 00007FF65743A600 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF65743A66F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF65743A6B7

Strings

bad locale name, xrefs: 00007FF65743A796

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 0f6e678ff38fce358cefbbf5e54777a6ab38128617fd1b418caebc232191c41d
Instruction ID: c29404841af6027039af654f8131a2e532286858ba53791c42fa00c5f67e25dd
Opcode Fuzzy Hash: 0f6e678ff38fce358cefbbf5e54777a6ab38128617fd1b418caebc232191c41d
Instruction Fuzzy Hash: 16515732B0AA4A89EB55DFB0E4902BD33B4EF44748F0C4435EA8DB6A95DF38D4658384

Function 00007FF65744B198 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65744B382

Strings

iterator does not fit current value, xrefs: 00007FF65744B3C4
iterator out of range, xrefs: 00007FF65744B3F8

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: iterator does not fit current value$iterator out of range
API String ID: 3668304517-1046077056
Opcode ID: c783f45f6ac9ed78e5ccc847484a86fd53dc522b74bb063e9fdd151bce9c54cb
Instruction ID: 17a41658aa9ba47832df36e0dfb127357a4d357db6ee5f347ba841b71c44f440
Opcode Fuzzy Hash: c783f45f6ac9ed78e5ccc847484a86fd53dc522b74bb063e9fdd151bce9c54cb
Instruction Fuzzy Hash: 1141C5A3F08ACA96EB11DB60D8543FC2731EB51748F984076CB4DA3ADADE38D55AD340

Function 00007FF65744B1F5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65744B382

Strings

iterator does not fit current value, xrefs: 00007FF65744B3C4
iterator out of range, xrefs: 00007FF65744B3F8

Memory Dump Source

Source File: 00000000.00000002.2362128767.00007FF6573F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6573F0000, based on PE: true

Associated: 00000000.00000002.2362108380.00007FF6573F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362194593.00007FF6574C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362235648.00007FF657520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362258754.00007FF657522000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362280488.00007FF657525000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2362301217.00007FF657528000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6573f0000_markiz.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: iterator does not fit current value$iterator out of range
API String ID: 3668304517-1046077056
Opcode ID: 5241b744fb5bd14edf4650fb39449879ec2e0fa76d064271e4a9ac59758b63dd
Instruction ID: 75e97402e5bb4db83a8574262a0d72ee1fb2efb189cb2baf9b7cd78b57d6fae0
Opcode Fuzzy Hash: 5241b744fb5bd14edf4650fb39449879ec2e0fa76d064271e4a9ac59758b63dd
Instruction Fuzzy Hash: 4341D6A3F08AC996EB11DF60D8942FC2321AB51748F985436CB4DA3ADADE38D55AD340

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report markiz.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
markiz.exe

Function 00007FF657478330 Relevance: 50.4, APIs: 19, Strings: 9, Instructions: 1376
COMMON

Function 00007FF657456350 Relevance: 46.6, APIs: 20, Strings: 6, Instructions: 1136
COMMON

Function 00007FF657475B70 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 225
windowCOMMON

Function 00007FF65742D570 Relevance: 35.9, APIs: 17, Strings: 3, Instructions: 862
libraryloaderCOMMON

Function 00007FF657422CA0 Relevance: 32.3, APIs: 13, Strings: 5, Instructions: 789
registryCOMMON

Function 00007FF6574220B0 Relevance: 28.7, APIs: 12, Strings: 4, Instructions: 684
registryCOMMON

Function 00007FF65745D080 Relevance: 28.6, APIs: 11, Strings: 5, Instructions: 599
COMMON

Function 00007FF6574AB5B0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Function 00007FF65742CA10 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 671
COMMON

Function 00007FF657439F80 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 417
COMMON

Function 00007FF65746C600 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 170
COMMON

Function 00007FF657455970 Relevance: 17.8, Strings: 14, Instructions: 304
COMMON

Function 00007FF65746EBF0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 194
windowCOMMON

Function 00007FF65746FCA0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 226
networkCOMMON

Function 00007FF657474A30 Relevance: 19.9, APIs: 13, Instructions: 417
networkCOMMON

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre